0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:41 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:41 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a01000000", 0xc, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}, {@fault_injection={'fault_injection', 0x3d, 0x8f}}]}) [ 330.199686] erofs: read_super, device -> /dev/loop4 [ 330.205111] erofs: read_super, device -> /dev/loop2 [ 330.232668] erofs: options -> noacl,noacl,acl, [ 330.242063] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 330.262599] erofs: root inode @ nid 36 [ 330.293629] erofs: FAULT_INJECTION was not selected [ 330.302480] erofs: bogus i_mode (0) @ nid 36 [ 330.311134] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 330.318443] erofs: root inode @ nid 36 20:42:41 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="050000", 0x3, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 330.347663] erofs: read_super, device -> /dev/loop0 [ 330.353620] erofs: mounted on /dev/loop2 with opts: noacl. [ 330.378481] 9pnet: Could not find request transport: xen [ 330.382150] erofs: options -> noacl,noacl,acl,fault_injection=0x000000000000008f, 20:42:41 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 17) [ 330.434454] erofs: unmounted for /dev/loop2 [ 330.476084] erofs: blksize 1 isn't supported on this platform [ 330.574609] erofs: read_super, device -> /dev/loop4 [ 330.574710] 9pnet: Could not find request transport: xen [ 330.589834] FAULT_INJECTION: forcing a failure. [ 330.589834] name failslab, interval 1, probability 0, space 0, times 0 [ 330.601313] erofs: options -> noacl,noacl,acl, [ 330.608533] CPU: 1 PID: 21263 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 330.616418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 330.625767] Call Trace: [ 330.628360] dump_stack+0x1fc/0x2ef [ 330.632083] should_fail.cold+0xa/0xf [ 330.633752] erofs: root inode @ nid 36 [ 330.635886] ? setup_fault_attr+0x200/0x200 [ 330.635904] ? lock_acquire+0x170/0x3c0 [ 330.635926] __should_failslab+0x115/0x180 [ 330.635944] should_failslab+0x5/0x10 [ 330.635957] kmem_cache_alloc+0x277/0x370 [ 330.635975] __kernfs_new_node+0xd2/0x680 [ 330.655067] overlayfs: './file0' not a directory [ 330.656114] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 330.656134] ? __mutex_unlock_slowpath+0xea/0x610 [ 330.656151] ? wait_for_completion_io+0x10/0x10 [ 330.656168] ? kernfs_next_descendant_post+0x19c/0x290 [ 330.656190] kernfs_new_node+0x92/0x120 [ 330.656209] __kernfs_create_file+0x51/0x340 [ 330.656233] sysfs_add_file_mode_ns+0x226/0x540 [ 330.701631] internal_create_group+0x355/0xb20 [ 330.706205] ? sysfs_remove_link_from_group+0x70/0x70 [ 330.711380] ? lock_downgrade+0x720/0x720 [ 330.715523] lo_ioctl+0xf7c/0x20e0 [ 330.719054] ? loop_set_status64+0x110/0x110 [ 330.723450] blkdev_ioctl+0x5cb/0x1a80 [ 330.727326] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 330.732675] ? blkpg_ioctl+0x9d0/0x9d0 [ 330.736551] ? mark_held_locks+0xf0/0xf0 [ 330.740597] ? mark_held_locks+0xf0/0xf0 [ 330.744647] ? debug_check_no_obj_freed+0x201/0x490 [ 330.749651] ? lock_downgrade+0x720/0x720 [ 330.753785] block_ioctl+0xe9/0x130 [ 330.757395] ? blkdev_fallocate+0x3f0/0x3f0 [ 330.761701] do_vfs_ioctl+0xcdb/0x12e0 [ 330.765574] ? lock_downgrade+0x720/0x720 [ 330.769710] ? check_preemption_disabled+0x41/0x280 [ 330.774710] ? ioctl_preallocate+0x200/0x200 [ 330.779106] ? __fget+0x356/0x510 [ 330.782544] ? do_dup2+0x450/0x450 [ 330.786072] ? do_sys_open+0x2bf/0x520 [ 330.789950] ksys_ioctl+0x9b/0xc0 [ 330.793390] __x64_sys_ioctl+0x6f/0xb0 [ 330.797262] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 330.801827] do_syscall_64+0xf9/0x620 [ 330.805616] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 330.810792] RIP: 0033:0x7ff625ceb037 [ 330.814491] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 330.833373] RSP: 002b:00007ff62465ff28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 330.841063] RAX: ffffffffffffffda RBX: 00007ff625d34a20 RCX: 00007ff625ceb037 [ 330.848317] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 330.855568] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007ff6246601d0 [ 330.862823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 20:42:42 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:42 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 330.870078] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 330.878399] erofs: bogus i_mode (0) @ nid 36 20:42:42 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a01000000", 0xc, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}, {@fault_injection={'fault_injection', 0x3d, 0x8f}}]}) 20:42:42 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="050000", 0x3, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 331.062117] erofs: read_super, device -> /dev/loop2 [ 331.067160] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 331.157504] erofs: FAULT_INJECTION was not selected [ 331.175645] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 331.192666] erofs: read_super, device -> /dev/loop0 [ 331.197595] erofs: root inode @ nid 36 20:42:42 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="050000", 0x3, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 331.197683] erofs: options -> noacl,noacl,acl,fault_injection=0x000000000000008f, [ 331.202286] erofs: read_super, device -> /dev/loop4 [ 331.214446] erofs: options -> noacl,noacl,acl, [ 331.219246] erofs: root inode @ nid 36 [ 331.224364] erofs: bogus i_mode (0) @ nid 36 [ 331.229126] erofs: mounted on /dev/loop2 with opts: noacl. [ 331.230423] erofs: blksize 1 isn't supported on this platform [ 331.243841] 9pnet: Could not find request transport: xen 20:42:42 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 331.360395] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 331.370845] erofs: unmounted for /dev/loop2 [ 331.415573] 9pnet: Could not find request transport: xen [ 331.428275] erofs: read_super, device -> /dev/loop4 [ 331.438846] erofs: options -> noacl,noacl,acl, [ 331.483098] erofs: root inode @ nid 36 [ 331.490213] erofs: bogus i_mode (0) @ nid 36 [ 331.608266] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 331.661108] 9pnet: Could not find request transport: xen 20:42:43 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}, {@fault_injection={'fault_injection', 0x3d, 0x8f}}]}) 20:42:43 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 18) 20:42:43 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:43 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c0", 0x5, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:43 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:43 executing program 1: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 331.841759] FAULT_INJECTION: forcing a failure. [ 331.841759] name failslab, interval 1, probability 0, space 0, times 0 [ 331.891030] CPU: 1 PID: 21310 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 331.898935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 331.908289] Call Trace: [ 331.910885] dump_stack+0x1fc/0x2ef [ 331.914522] should_fail.cold+0xa/0xf [ 331.918331] ? setup_fault_attr+0x200/0x200 [ 331.922658] ? lock_acquire+0x170/0x3c0 [ 331.926645] __should_failslab+0x115/0x180 [ 331.930883] should_failslab+0x5/0x10 [ 331.934686] kmem_cache_alloc+0x277/0x370 [ 331.938837] __kernfs_new_node+0xd2/0x680 [ 331.942994] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 331.947750] ? __mutex_unlock_slowpath+0xea/0x610 [ 331.952596] ? wait_for_completion_io+0x10/0x10 [ 331.957272] ? kernfs_next_descendant_post+0x19c/0x290 [ 331.962556] kernfs_new_node+0x92/0x120 [ 331.966538] __kernfs_create_file+0x51/0x340 [ 331.970958] sysfs_add_file_mode_ns+0x226/0x540 [ 331.975636] internal_create_group+0x355/0xb20 [ 331.980228] ? sysfs_remove_link_from_group+0x70/0x70 [ 331.985420] ? lock_downgrade+0x720/0x720 [ 331.989583] lo_ioctl+0xf7c/0x20e0 [ 331.993129] ? loop_set_status64+0x110/0x110 [ 331.997539] blkdev_ioctl+0x5cb/0x1a80 [ 332.001427] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 332.006787] ? blkpg_ioctl+0x9d0/0x9d0 [ 332.010677] ? mark_held_locks+0xf0/0xf0 [ 332.014740] ? mark_held_locks+0xf0/0xf0 [ 332.018807] ? debug_check_no_obj_freed+0x201/0x490 [ 332.023826] ? lock_downgrade+0x720/0x720 [ 332.027977] block_ioctl+0xe9/0x130 [ 332.031603] ? blkdev_fallocate+0x3f0/0x3f0 [ 332.035929] do_vfs_ioctl+0xcdb/0x12e0 [ 332.039818] ? lock_downgrade+0x720/0x720 [ 332.043968] ? check_preemption_disabled+0x41/0x280 [ 332.048984] ? ioctl_preallocate+0x200/0x200 [ 332.053396] ? __fget+0x356/0x510 [ 332.056856] ? do_dup2+0x450/0x450 [ 332.057692] 9pnet: Could not find request transport: xen [ 332.060393] ? do_sys_open+0x2bf/0x520 [ 332.060416] ksys_ioctl+0x9b/0xc0 [ 332.060434] __x64_sys_ioctl+0x6f/0xb0 [ 332.060449] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 332.060463] do_syscall_64+0xf9/0x620 [ 332.060482] entry_SYSCALL_64_after_hwframe+0x49/0xbe 20:42:43 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 332.071330] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 332.073211] RIP: 0033:0x7ff625ceb037 [ 332.073226] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 332.073234] RSP: 002b:00007ff62465ff28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 332.073248] RAX: ffffffffffffffda RBX: 00007ff625d34a20 RCX: 00007ff625ceb037 [ 332.073257] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 332.073265] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007ff6246601d0 [ 332.073273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 332.073287] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 332.179519] erofs: read_super, device -> /dev/loop0 [ 332.184680] erofs: options -> noacl,noacl,acl,fault_injection=0x000000000000008f, [ 332.194060] erofs: read_super, device -> /dev/loop2 [ 332.199085] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 332.208862] erofs: FAULT_INJECTION was not selected [ 332.214419] erofs: cannot find valid erofs superblock [ 332.217199] erofs: read_super, device -> /dev/loop4 [ 332.220260] erofs: root inode @ nid 36 [ 332.237217] erofs: mounted on /dev/loop2 with opts: noacl. [ 332.248798] erofs: options -> noacl,noacl,acl, 20:42:43 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 19) 20:42:43 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}, {@fault_injection={'fault_injection', 0x3d, 0x8f}}]}) [ 332.293908] erofs: root inode @ nid 36 [ 332.299073] erofs: bogus i_mode (300) @ nid 36 [ 332.303958] erofs: unmounted for /dev/loop2 [ 332.332916] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 20:42:43 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c0", 0x5, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 332.436962] FAULT_INJECTION: forcing a failure. [ 332.436962] name failslab, interval 1, probability 0, space 0, times 0 [ 332.451474] 9pnet: Could not find request transport: xen [ 332.491538] CPU: 0 PID: 21333 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 332.497489] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 332.499428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 332.499434] Call Trace: [ 332.499455] dump_stack+0x1fc/0x2ef [ 332.499475] should_fail.cold+0xa/0xf [ 332.499494] ? setup_fault_attr+0x200/0x200 [ 332.499510] ? lock_acquire+0x170/0x3c0 [ 332.499530] __should_failslab+0x115/0x180 [ 332.499549] should_failslab+0x5/0x10 [ 332.499561] kmem_cache_alloc+0x277/0x370 [ 332.499579] __kernfs_new_node+0xd2/0x680 [ 332.499597] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 332.499614] ? __mutex_unlock_slowpath+0xea/0x610 [ 332.499637] ? wait_for_completion_io+0x10/0x10 [ 332.499654] ? kernfs_next_descendant_post+0x19c/0x290 [ 332.499674] kernfs_new_node+0x92/0x120 [ 332.499693] __kernfs_create_file+0x51/0x340 [ 332.499713] sysfs_add_file_mode_ns+0x226/0x540 [ 332.499734] internal_create_group+0x355/0xb20 [ 332.499753] ? sysfs_remove_link_from_group+0x70/0x70 [ 332.499767] ? lock_downgrade+0x720/0x720 [ 332.499792] lo_ioctl+0xf7c/0x20e0 [ 332.499812] ? loop_set_status64+0x110/0x110 [ 332.499828] blkdev_ioctl+0x5cb/0x1a80 [ 332.499843] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 332.499856] ? blkpg_ioctl+0x9d0/0x9d0 [ 332.499870] ? mark_held_locks+0xf0/0xf0 [ 332.499884] ? mark_held_locks+0xf0/0xf0 [ 332.499901] ? debug_check_no_obj_freed+0x201/0x490 [ 332.499920] ? lock_downgrade+0x720/0x720 [ 332.499935] block_ioctl+0xe9/0x130 [ 332.499947] ? blkdev_fallocate+0x3f0/0x3f0 [ 332.499962] do_vfs_ioctl+0xcdb/0x12e0 [ 332.499978] ? lock_downgrade+0x720/0x720 [ 332.499994] ? check_preemption_disabled+0x41/0x280 [ 332.500008] ? ioctl_preallocate+0x200/0x200 [ 332.500025] ? __fget+0x356/0x510 [ 332.500041] ? do_dup2+0x450/0x450 [ 332.500056] ? do_sys_open+0x2bf/0x520 [ 332.500077] ksys_ioctl+0x9b/0xc0 [ 332.500093] __x64_sys_ioctl+0x6f/0xb0 [ 332.500108] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 332.500121] do_syscall_64+0xf9/0x620 [ 332.500139] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 332.500150] RIP: 0033:0x7ff625ceb037 [ 332.500163] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 332.500170] RSP: 002b:00007ff62465ff28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 332.500184] RAX: ffffffffffffffda RBX: 00007ff625d34a20 RCX: 00007ff625ceb037 [ 332.500191] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 332.500199] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007ff6246601d0 [ 332.500207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 332.500215] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 332.559703] 9pnet: Could not find request transport: xen [ 332.729455] erofs: read_super, device -> /dev/loop2 [ 332.750535] erofs: read_super, device -> /dev/loop4 [ 332.788224] erofs: read_super, device -> /dev/loop0 [ 332.793647] erofs: options -> noacl,noacl,acl,fault_injection=0x000000000000008f, [ 332.802849] erofs: cannot find valid erofs superblock [ 332.803773] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 332.808455] erofs: options -> noacl,noacl,acl, [ 332.819688] erofs: root inode @ nid 36 [ 332.826538] erofs: FAULT_INJECTION was not selected [ 332.832694] erofs: root inode @ nid 36 [ 332.832833] erofs: bogus i_mode (300) @ nid 36 20:42:44 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}, {@fault_injection={'fault_injection', 0x3d, 0x8f}}]}) [ 332.847350] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:44 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 20) [ 332.923167] erofs: unmounted for /dev/loop2 20:42:44 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 332.945777] erofs: read_super, device -> /dev/loop0 [ 332.953462] erofs: options -> noacl,noacl,acl,fault_injection=0x000000000000008f, [ 332.973320] erofs: cannot find valid erofs superblock 20:42:44 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c0", 0x5, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:44 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 333.038065] FAULT_INJECTION: forcing a failure. [ 333.038065] name failslab, interval 1, probability 0, space 0, times 0 [ 333.054540] CPU: 1 PID: 21358 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 333.062430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 333.071778] Call Trace: [ 333.074365] dump_stack+0x1fc/0x2ef [ 333.077998] should_fail.cold+0xa/0xf [ 333.081804] ? setup_fault_attr+0x200/0x200 [ 333.086125] ? lock_acquire+0x170/0x3c0 [ 333.090108] __should_failslab+0x115/0x180 [ 333.094346] should_failslab+0x5/0x10 [ 333.098146] __kmalloc+0x2ab/0x3c0 [ 333.101683] ? kobject_get_path+0xbf/0x240 [ 333.105923] kobject_get_path+0xbf/0x240 [ 333.109984] kobject_uevent_env+0x25c/0x1480 [ 333.114398] lo_ioctl+0xff9/0x20e0 [ 333.117942] ? loop_set_status64+0x110/0x110 [ 333.122352] blkdev_ioctl+0x5cb/0x1a80 [ 333.126237] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 333.131601] ? blkpg_ioctl+0x9d0/0x9d0 [ 333.135489] ? mark_held_locks+0xf0/0xf0 [ 333.139549] ? mark_held_locks+0xf0/0xf0 [ 333.143616] ? debug_check_no_obj_freed+0x201/0x490 [ 333.148634] ? lock_downgrade+0x720/0x720 [ 333.152782] block_ioctl+0xe9/0x130 [ 333.156402] ? blkdev_fallocate+0x3f0/0x3f0 [ 333.160718] do_vfs_ioctl+0xcdb/0x12e0 [ 333.164605] ? lock_downgrade+0x720/0x720 [ 333.168754] ? check_preemption_disabled+0x41/0x280 [ 333.173765] ? ioctl_preallocate+0x200/0x200 [ 333.178173] ? __fget+0x356/0x510 [ 333.181626] ? do_dup2+0x450/0x450 20:42:44 executing program 1: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 333.185167] ? do_sys_open+0x2bf/0x520 [ 333.189058] ksys_ioctl+0x9b/0xc0 [ 333.192513] __x64_sys_ioctl+0x6f/0xb0 [ 333.196405] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 333.200985] do_syscall_64+0xf9/0x620 [ 333.204788] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 333.209973] RIP: 0033:0x7ff625ceb037 [ 333.213680] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 333.232570] RSP: 002b:00007ff62465ff28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 333.240260] RAX: ffffffffffffffda RBX: 00007ff625d34a20 RCX: 00007ff625ceb037 [ 333.247506] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 333.254753] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007ff6246601d0 [ 333.262001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 333.269247] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 20:42:44 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, 0x0) [ 333.324114] erofs: read_super, device -> /dev/loop2 [ 333.329149] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 333.348696] erofs: FAULT_INJECTION was not selected 20:42:44 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 21) [ 333.372955] erofs: root inode @ nid 36 [ 333.385554] erofs: read_super, device -> /dev/loop4 [ 333.393261] erofs: mounted on /dev/loop2 with opts: noacl. [ 333.404577] erofs: options -> noacl,noacl,acl, [ 333.415894] erofs: root inode @ nid 36 [ 333.436092] erofs: bogus i_mode (300) @ nid 36 [ 333.442416] erofs: unmounted for /dev/loop2 20:42:44 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, 0x0) [ 333.553626] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 333.564792] 9pnet: Could not find request transport: xen 20:42:44 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 333.595233] FAULT_INJECTION: forcing a failure. [ 333.595233] name failslab, interval 1, probability 0, space 0, times 0 [ 333.604305] overlayfs: './file0' not a directory [ 333.609743] 9pnet: Could not find request transport: xen [ 333.626556] CPU: 0 PID: 21387 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 333.634454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 333.643808] Call Trace: [ 333.646406] dump_stack+0x1fc/0x2ef [ 333.650049] should_fail.cold+0xa/0xf [ 333.653856] ? setup_fault_attr+0x200/0x200 [ 333.658182] ? lock_acquire+0x170/0x3c0 [ 333.662166] __should_failslab+0x115/0x180 [ 333.666409] should_failslab+0x5/0x10 [ 333.670211] kmem_cache_alloc_node+0x245/0x3b0 [ 333.674801] __alloc_skb+0x71/0x560 [ 333.678441] alloc_uevent_skb+0x7b/0x210 [ 333.682511] kobject_uevent_env+0xa90/0x1480 [ 333.686934] lo_ioctl+0xff9/0x20e0 [ 333.690488] ? loop_set_status64+0x110/0x110 [ 333.694894] blkdev_ioctl+0x5cb/0x1a80 [ 333.698784] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 333.704146] ? blkpg_ioctl+0x9d0/0x9d0 [ 333.708034] ? mark_held_locks+0xf0/0xf0 [ 333.712105] ? mark_held_locks+0xf0/0xf0 [ 333.716173] ? debug_check_no_obj_freed+0x201/0x490 [ 333.721193] ? lock_downgrade+0x720/0x720 [ 333.725342] block_ioctl+0xe9/0x130 [ 333.728962] ? blkdev_fallocate+0x3f0/0x3f0 [ 333.733281] do_vfs_ioctl+0xcdb/0x12e0 [ 333.737169] ? lock_downgrade+0x720/0x720 [ 333.741319] ? check_preemption_disabled+0x41/0x280 [ 333.746333] ? ioctl_preallocate+0x200/0x200 [ 333.750744] ? __fget+0x356/0x510 [ 333.754198] ? do_dup2+0x450/0x450 [ 333.757737] ? do_sys_open+0x2bf/0x520 [ 333.761630] ksys_ioctl+0x9b/0xc0 [ 333.765085] __x64_sys_ioctl+0x6f/0xb0 [ 333.768968] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 333.773547] do_syscall_64+0xf9/0x620 [ 333.777348] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 333.782531] RIP: 0033:0x7ff625ceb037 [ 333.786239] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 333.805132] RSP: 002b:00007ff62465ff28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 333.812835] RAX: ffffffffffffffda RBX: 00007ff625d34a20 RCX: 00007ff625ceb037 [ 333.820102] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 333.827364] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007ff6246601d0 [ 333.834630] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 20:42:45 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:45 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 333.841895] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 333.929543] erofs: read_super, device -> /dev/loop2 [ 333.934585] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 333.969239] erofs: read_super, device -> /dev/loop4 [ 333.986520] erofs: FAULT_INJECTION was not selected [ 333.997876] erofs: root inode @ nid 36 [ 334.010287] erofs: mounted on /dev/loop2 with opts: noacl. [ 334.023948] erofs: options -> noacl,noacl,acl, 20:42:45 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, 0x0) [ 334.057850] erofs: root inode @ nid 36 20:42:45 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 22) [ 334.084189] erofs: bogus i_mode (0) @ nid 36 [ 334.121981] erofs: unmounted for /dev/loop2 [ 334.138708] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) 20:42:45 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 334.208475] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 334.219615] 9pnet: Could not find request transport: xen [ 334.248044] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 334.265531] FAULT_INJECTION: forcing a failure. [ 334.265531] name failslab, interval 1, probability 0, space 0, times 0 [ 334.289611] CPU: 0 PID: 21417 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 334.297498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 334.306844] Call Trace: [ 334.309435] dump_stack+0x1fc/0x2ef [ 334.313068] should_fail.cold+0xa/0xf [ 334.316868] ? setup_fault_attr+0x200/0x200 [ 334.321185] ? lock_acquire+0x170/0x3c0 [ 334.325164] __should_failslab+0x115/0x180 [ 334.329403] should_failslab+0x5/0x10 [ 334.333207] kmem_cache_alloc+0x277/0x370 [ 334.337360] skb_clone+0x151/0x3d0 [ 334.340904] netlink_broadcast_filtered+0x8e5/0xbc0 [ 334.346109] netlink_broadcast+0x35/0x40 [ 334.350174] kobject_uevent_env+0xa56/0x1480 [ 334.354593] lo_ioctl+0xff9/0x20e0 [ 334.358134] ? loop_set_status64+0x110/0x110 [ 334.362541] blkdev_ioctl+0x5cb/0x1a80 [ 334.366423] ? finish_task_switch+0x118/0x760 [ 334.370921] ? blkpg_ioctl+0x9d0/0x9d0 [ 334.374807] ? mark_held_locks+0xf0/0xf0 [ 334.378863] ? __schedule+0x88f/0x2040 [ 334.382751] ? io_schedule_timeout+0x140/0x140 [ 334.384424] 9pnet: Could not find request transport: xen [ 334.387330] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 334.397537] block_ioctl+0xe9/0x130 [ 334.401162] ? blkdev_fallocate+0x3f0/0x3f0 [ 334.405484] do_vfs_ioctl+0xcdb/0x12e0 [ 334.409377] ? lock_downgrade+0x720/0x720 [ 334.413528] ? check_preemption_disabled+0x41/0x280 [ 334.418545] ? ioctl_preallocate+0x200/0x200 [ 334.422959] ? __fget+0x356/0x510 [ 334.426418] ? do_dup2+0x450/0x450 [ 334.429964] ? do_sys_open+0x2bf/0x520 [ 334.433856] ksys_ioctl+0x9b/0xc0 [ 334.437312] __x64_sys_ioctl+0x6f/0xb0 [ 334.441201] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 334.445783] do_syscall_64+0xf9/0x620 [ 334.449590] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 334.454779] RIP: 0033:0x7ff625ceb037 [ 334.458488] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 334.477388] RSP: 002b:00007ff62465ff28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 334.485094] RAX: ffffffffffffffda RBX: 00007ff625d34a20 RCX: 00007ff625ceb037 [ 334.492383] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 334.499650] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007ff6246601d0 [ 334.507268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 20:42:45 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:45 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 334.514534] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 334.591206] erofs: read_super, device -> /dev/loop2 [ 334.605096] erofs: read_super, device -> /dev/loop4 [ 334.621508] erofs: options -> noacl,noacl,acl, [ 334.628186] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 334.637729] erofs: root inode @ nid 36 [ 334.673285] erofs: FAULT_INJECTION was not selected [ 334.698820] erofs: bogus i_mode (0) @ nid 36 [ 334.723886] erofs: root inode @ nid 36 [ 334.753552] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:46 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:42:46 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:46 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:46 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 23) [ 334.833787] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 334.847303] erofs: unmounted for /dev/loop2 [ 334.858598] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 334.897917] 9pnet: Could not find request transport: xen [ 334.937105] 9pnet: Could not find request transport: xen [ 334.938004] erofs: read_super, device -> /dev/loop0 [ 334.961396] erofs: read_super, device -> /dev/loop4 [ 334.967575] erofs: options -> noacl,noacl,acl, [ 334.983075] erofs: options -> noacl,noacl,acl, [ 334.994101] erofs: root inode @ nid 0 [ 335.007190] erofs: root inode @ nid 36 [ 335.016822] erofs: bogus i_mode (0) @ nid 0 [ 335.023932] FAULT_INJECTION: forcing a failure. [ 335.023932] name failslab, interval 1, probability 0, space 0, times 0 [ 335.043942] erofs: bogus i_mode (0) @ nid 36 [ 335.056462] CPU: 0 PID: 21450 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 335.064351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 335.073703] Call Trace: [ 335.076324] dump_stack+0x1fc/0x2ef [ 335.079967] should_fail.cold+0xa/0xf [ 335.083778] ? setup_fault_attr+0x200/0x200 [ 335.088104] ? lock_acquire+0x170/0x3c0 [ 335.092088] __should_failslab+0x115/0x180 [ 335.096328] should_failslab+0x5/0x10 [ 335.100135] kmem_cache_alloc+0x277/0x370 [ 335.104292] skb_clone+0x151/0x3d0 [ 335.107839] netlink_broadcast_filtered+0x8e5/0xbc0 [ 335.112871] netlink_broadcast+0x35/0x40 [ 335.116947] kobject_uevent_env+0xa56/0x1480 [ 335.121370] lo_ioctl+0xff9/0x20e0 [ 335.124923] ? loop_set_status64+0x110/0x110 [ 335.129344] blkdev_ioctl+0x5cb/0x1a80 [ 335.133239] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 335.138629] ? blkpg_ioctl+0x9d0/0x9d0 [ 335.142519] ? mark_held_locks+0xf0/0xf0 [ 335.146585] ? mark_held_locks+0xf0/0xf0 [ 335.150651] ? debug_check_no_obj_freed+0x201/0x490 [ 335.155673] ? lock_downgrade+0x720/0x720 [ 335.159822] block_ioctl+0xe9/0x130 [ 335.163535] ? blkdev_fallocate+0x3f0/0x3f0 [ 335.167855] do_vfs_ioctl+0xcdb/0x12e0 [ 335.171742] ? lock_downgrade+0x720/0x720 [ 335.175895] ? check_preemption_disabled+0x41/0x280 [ 335.180924] ? ioctl_preallocate+0x200/0x200 [ 335.185346] ? __fget+0x356/0x510 [ 335.188802] ? do_dup2+0x450/0x450 [ 335.192345] ? do_sys_open+0x2bf/0x520 [ 335.196243] ksys_ioctl+0x9b/0xc0 [ 335.199700] __x64_sys_ioctl+0x6f/0xb0 [ 335.203590] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 335.208172] do_syscall_64+0xf9/0x620 [ 335.211980] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 335.217167] RIP: 0033:0x7ff625ceb037 [ 335.220878] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 335.239775] RSP: 002b:00007ff62465ff28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 335.247485] RAX: ffffffffffffffda RBX: 00007ff625d34a20 RCX: 00007ff625ceb037 [ 335.254759] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 20:42:46 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 335.262029] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007ff6246601d0 [ 335.269298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 335.276654] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 20:42:46 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:46 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 335.429304] erofs: read_super, device -> /dev/loop2 [ 335.434346] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 335.473041] erofs: FAULT_INJECTION was not selected 20:42:46 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 335.493798] erofs: read_super, device -> /dev/loop4 [ 335.502723] erofs: root inode @ nid 36 [ 335.534027] erofs: options -> noacl,noacl,acl, [ 335.538821] erofs: mounted on /dev/loop2 with opts: noacl. [ 335.558937] erofs: cannot find valid erofs superblock 20:42:46 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 24) 20:42:47 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 335.596287] overlayfs: failed to resolve './file1': -2 [ 335.604710] erofs: unmounted for /dev/loop2 [ 335.638179] erofs: read_super, device -> /dev/loop0 [ 335.685142] 9pnet: Could not find request transport: xen [ 335.692418] erofs: options -> noacl,noacl,acl, [ 335.711070] 9pnet: Could not find request transport: xen [ 335.718557] erofs: root inode @ nid 0 20:42:47 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 335.733228] overlayfs: './file0' not a directory [ 335.744667] erofs: bogus i_mode (0) @ nid 0 [ 335.758759] erofs: read_super, device -> /dev/loop4 [ 335.774585] FAULT_INJECTION: forcing a failure. [ 335.774585] name failslab, interval 1, probability 0, space 0, times 0 [ 335.795025] erofs: options -> noacl,noacl,acl, [ 335.810887] erofs: cannot find valid erofs superblock [ 335.817239] CPU: 0 PID: 21485 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 335.825120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 335.834468] Call Trace: [ 335.837062] dump_stack+0x1fc/0x2ef [ 335.840693] should_fail.cold+0xa/0xf [ 335.844497] ? setup_fault_attr+0x200/0x200 [ 335.848819] ? lock_acquire+0x170/0x3c0 [ 335.852808] __should_failslab+0x115/0x180 [ 335.857048] should_failslab+0x5/0x10 [ 335.860848] kmem_cache_alloc_trace+0x284/0x380 [ 335.865513] ? wait_for_completion_io+0x10/0x10 [ 335.870182] ? kobj_ns_initial+0x90/0x90 [ 335.874270] call_usermodehelper_setup+0x84/0x300 [ 335.879129] kobject_uevent_env+0xe83/0x1480 [ 335.883557] lo_ioctl+0xff9/0x20e0 [ 335.887107] ? loop_set_status64+0x110/0x110 [ 335.891519] blkdev_ioctl+0x5cb/0x1a80 [ 335.895410] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 335.900776] ? blkpg_ioctl+0x9d0/0x9d0 [ 335.904667] ? mark_held_locks+0xf0/0xf0 [ 335.908731] ? mark_held_locks+0xf0/0xf0 [ 335.912803] ? debug_check_no_obj_freed+0x201/0x490 [ 335.917833] ? lock_downgrade+0x720/0x720 [ 335.921991] block_ioctl+0xe9/0x130 [ 335.925620] ? blkdev_fallocate+0x3f0/0x3f0 [ 335.929950] do_vfs_ioctl+0xcdb/0x12e0 [ 335.933846] ? lock_downgrade+0x720/0x720 [ 335.937995] ? check_preemption_disabled+0x41/0x280 20:42:47 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 335.943008] ? ioctl_preallocate+0x200/0x200 [ 335.947423] ? __fget+0x356/0x510 [ 335.950883] ? do_dup2+0x450/0x450 [ 335.954420] ? do_sys_open+0x2bf/0x520 [ 335.958318] ksys_ioctl+0x9b/0xc0 [ 335.961780] __x64_sys_ioctl+0x6f/0xb0 [ 335.965669] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 335.970251] do_syscall_64+0xf9/0x620 [ 335.974057] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 335.979242] RIP: 0033:0x7ff625ceb037 20:42:47 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 335.982958] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 336.001857] RSP: 002b:00007ff62465ff28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 336.009564] RAX: ffffffffffffffda RBX: 00007ff625d34a20 RCX: 00007ff625ceb037 [ 336.016829] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 336.024095] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007ff6246601d0 [ 336.031361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 336.038626] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 20:42:47 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:47 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 336.161284] erofs: read_super, device -> /dev/loop2 [ 336.185776] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 336.212340] erofs: read_super, device -> /dev/loop0 [ 336.217380] erofs: options -> noacl,noacl,acl, [ 336.239920] erofs: FAULT_INJECTION was not selected [ 336.273149] erofs: root inode @ nid 36 [ 336.297185] erofs: mounted on /dev/loop2 with opts: noacl. [ 336.302445] erofs: root inode @ nid 0 [ 336.322804] erofs: read_super, device -> /dev/loop4 20:42:47 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 25) [ 336.369674] erofs: bogus i_mode (0) @ nid 0 [ 336.400578] erofs: unmounted for /dev/loop2 [ 336.412190] 9pnet: Could not find request transport: xen [ 336.414515] erofs: options -> noacl,noacl,acl, [ 336.425278] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 336.443810] 9pnet: Could not find request transport: xen 20:42:47 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 336.451038] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 336.471964] erofs: cannot find valid erofs superblock [ 336.514996] FAULT_INJECTION: forcing a failure. [ 336.514996] name failslab, interval 1, probability 0, space 0, times 0 [ 336.536230] CPU: 0 PID: 21517 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 336.544125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 336.553562] Call Trace: [ 336.556157] dump_stack+0x1fc/0x2ef [ 336.559794] should_fail.cold+0xa/0xf [ 336.563599] ? setup_fault_attr+0x200/0x200 [ 336.567921] ? lock_acquire+0x170/0x3c0 [ 336.571911] __should_failslab+0x115/0x180 [ 336.576152] should_failslab+0x5/0x10 [ 336.579965] kmem_cache_alloc+0x277/0x370 [ 336.584125] getname_flags+0xce/0x590 [ 336.587927] ? rcu_nmi_exit+0xb3/0x180 [ 336.591820] do_mkdirat+0x8d/0x2d0 [ 336.595363] ? __ia32_sys_mknod+0x120/0x120 [ 336.599690] ? do_syscall_64+0xbf/0x620 [ 336.603672] do_syscall_64+0xf9/0x620 [ 336.607482] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 336.612667] RIP: 0033:0x7ff625cea387 [ 336.616385] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 336.635285] RSP: 002b:00007ff62465ff88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 336.642994] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007ff625cea387 [ 336.650476] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 336.657770] RBP: 00007ff6246601d0 R08: 0000000000000000 R09: 00007ff6246601d0 20:42:48 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}, {@fault_injection}]}) 20:42:48 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 336.665042] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 336.672326] R13: 0000000020000100 R14: 00007ff62465ffe0 R15: 0000000020000080 20:42:48 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 26) [ 336.773747] erofs: read_super, device -> /dev/loop0 [ 336.782321] erofs: options -> noacl,noacl,acl,fault_injection=0x0000000000000000, [ 336.800335] erofs: FAULT_INJECTION was not selected 20:42:48 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{0x0, 0x0, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 336.830426] erofs: root inode @ nid 0 [ 336.842404] erofs: bogus i_mode (0) @ nid 0 20:42:48 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@fault_injection}]}) [ 336.897046] erofs: read_super, device -> /dev/loop4 [ 336.906940] erofs: options -> noacl,noacl,acl, [ 336.923397] erofs: cannot find valid erofs superblock 20:42:48 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{0x0, 0x0, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 336.992405] 9pnet: Could not find request transport: xen [ 337.004026] FAULT_INJECTION: forcing a failure. [ 337.004026] name failslab, interval 1, probability 0, space 0, times 0 [ 337.031728] CPU: 0 PID: 21541 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 337.039633] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 337.048989] Call Trace: [ 337.050306] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 337.051579] dump_stack+0x1fc/0x2ef [ 337.065473] should_fail.cold+0xa/0xf [ 337.069289] ? setup_fault_attr+0x200/0x200 [ 337.073621] ? lock_acquire+0x170/0x3c0 [ 337.077617] __should_failslab+0x115/0x180 [ 337.081864] should_failslab+0x5/0x10 [ 337.085668] kmem_cache_alloc+0x277/0x370 [ 337.089821] __d_alloc+0x2b/0xa10 [ 337.093296] d_alloc+0x4a/0x230 [ 337.096274] 9pnet: Could not find request transport: xen [ 337.096579] __lookup_hash+0xc8/0x180 [ 337.096595] filename_create+0x186/0x490 [ 337.109870] ? kern_path_mountpoint+0x40/0x40 [ 337.114366] ? strncpy_from_user+0x2a2/0x350 [ 337.118783] ? getname_flags+0x25b/0x590 [ 337.122894] do_mkdirat+0xa0/0x2d0 [ 337.126439] ? __ia32_sys_mknod+0x120/0x120 [ 337.130769] ? trace_hardirqs_off_caller+0x6e/0x210 [ 337.135791] ? do_syscall_64+0x21/0x620 [ 337.139769] do_syscall_64+0xf9/0x620 [ 337.143575] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 337.148764] RIP: 0033:0x7ff625cea387 [ 337.152480] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 337.171404] RSP: 002b:00007ff62465ff88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 337.179140] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007ff625cea387 [ 337.186428] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 337.193700] RBP: 00007ff6246601d0 R08: 0000000000000000 R09: 00007ff6246601d0 [ 337.200968] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 337.208237] R13: 0000000020000100 R14: 00007ff62465ffe0 R15: 0000000020000080 [ 337.228846] erofs: read_super, device -> /dev/loop4 20:42:48 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 337.244796] erofs: options -> noacl,noacl,acl, [ 337.256256] erofs: cannot find valid erofs superblock [ 337.264763] erofs: read_super, device -> /dev/loop0 [ 337.287058] erofs: options -> noacl,noacl,fault_injection=0x0000000000000000, [ 337.295415] erofs: FAULT_INJECTION was not selected [ 337.315459] erofs: root inode @ nid 0 [ 337.329967] erofs: bogus i_mode (0) @ nid 0 [ 337.429714] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 337.468655] 9pnet: Could not find request transport: xen 20:42:49 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:42:49 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:49 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{0x0, 0x0, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:49 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 27) 20:42:49 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@fault_injection}]}) 20:42:49 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 337.729041] FAULT_INJECTION: forcing a failure. [ 337.729041] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 337.740872] CPU: 0 PID: 21579 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 337.748752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 337.758105] Call Trace: [ 337.760702] dump_stack+0x1fc/0x2ef [ 337.764338] should_fail.cold+0xa/0xf [ 337.768146] ? setup_fault_attr+0x200/0x200 [ 337.769543] erofs: read_super, device -> /dev/loop4 [ 337.772496] ? wake_up_q+0x93/0xe0 [ 337.777490] erofs: options -> noacl,noacl,acl, [ 337.781021] ? __mutex_unlock_slowpath+0x2be/0x610 [ 337.781041] __alloc_pages_nodemask+0x239/0x2890 [ 337.781066] ? __lock_acquire+0x6de/0x3ff0 [ 337.781086] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 337.781098] ? blkdev_ioctl+0x11a/0x1a80 [ 337.781113] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 337.781125] ? blkpg_ioctl+0x9d0/0x9d0 [ 337.781148] ? debug_check_no_obj_freed+0x201/0x490 [ 337.781165] ? lock_downgrade+0x720/0x720 [ 337.781183] cache_grow_begin+0xa4/0x8a0 [ 337.781200] ? setup_fault_attr+0x200/0x200 [ 337.835225] ? lock_acquire+0x170/0x3c0 [ 337.839210] cache_alloc_refill+0x273/0x340 [ 337.843542] kmem_cache_alloc+0x346/0x370 [ 337.847701] getname_flags+0xce/0x590 [ 337.851509] do_mkdirat+0x8d/0x2d0 [ 337.855054] ? __ia32_sys_mknod+0x120/0x120 [ 337.859382] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 337.864753] ? trace_hardirqs_off_caller+0x6e/0x210 [ 337.869779] ? do_syscall_64+0x21/0x620 [ 337.873776] do_syscall_64+0xf9/0x620 [ 337.877586] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 337.882777] RIP: 0033:0x7ff625cea387 [ 337.886490] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 337.895581] erofs: cannot find valid erofs superblock [ 337.905382] RSP: 002b:00007ff62465ff88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 337.905397] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007ff625cea387 [ 337.905405] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 337.905414] RBP: 00007ff6246601d0 R08: 0000000000000000 R09: 00007ff6246601d0 [ 337.905422] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 337.905430] R13: 0000000020000100 R14: 00007ff62465ffe0 R15: 0000000020000080 [ 337.906083] erofs: read_super, device -> /dev/loop0 [ 337.935661] overlayfs: failed to resolve './file1': -2 [ 337.940962] erofs: options -> noacl,noacl,fault_injection=0x0000000000000000, [ 337.941034] erofs: FAULT_INJECTION was not selected 20:42:49 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 338.049299] 9pnet: Could not find request transport: xen [ 338.069051] erofs: root inode @ nid 0 [ 338.072908] erofs: bogus i_mode (0) @ nid 0 20:42:49 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@fault_injection}]}) [ 338.104976] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 20:42:49 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000), 0x0, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 338.150761] 9pnet: Could not find request transport: xen [ 338.254380] erofs: read_super, device -> /dev/loop0 [ 338.317929] erofs: read_super, device -> /dev/loop4 [ 338.323228] erofs: options -> noacl,noacl,fault_injection=0x0000000000000000, [ 338.335215] erofs: read_super, device -> /dev/loop2 [ 338.354401] erofs: options -> noacl,noacl,acl, [ 338.364065] erofs: FAULT_INJECTION was not selected [ 338.374483] erofs: cannot find valid erofs superblock [ 338.380372] erofs: root inode @ nid 0 [ 338.384585] erofs: bogus i_mode (0) @ nid 0 [ 338.390102] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 338.397468] erofs: FAULT_INJECTION was not selected [ 338.411862] erofs: root inode @ nid 36 20:42:49 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000), 0x0, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:49 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 338.413685] overlayfs: failed to resolve './file1': -2 [ 338.423664] erofs: mounted on /dev/loop2 with opts: noacl. [ 338.456579] 9pnet: Could not find request transport: xen 20:42:49 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 338.519611] erofs: unmounted for /dev/loop2 [ 338.567215] erofs: read_super, device -> /dev/loop4 [ 338.581823] erofs: options -> noacl,noacl,acl, [ 338.590337] erofs: read_super, device -> /dev/loop0 [ 338.599306] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 338.612587] erofs: cannot find valid erofs superblock [ 338.631395] erofs: FAULT_INJECTION was not selected [ 338.649191] erofs: root inode @ nid 0 [ 338.676472] erofs: bogus i_mode (0) @ nid 0 [ 338.754728] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 338.779385] 9pnet: Could not find request transport: xen 20:42:50 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:42:50 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 28) 20:42:50 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:50 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000), 0x0, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:50 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@acl}, {@fault_injection}]}) 20:42:50 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 339.012150] erofs: read_super, device -> /dev/loop0 [ 339.026015] FAULT_INJECTION: forcing a failure. [ 339.026015] name failslab, interval 1, probability 0, space 0, times 0 [ 339.035267] erofs: options -> acl,fault_injection=0x0000000000000000, [ 339.075393] erofs: read_super, device -> /dev/loop4 [ 339.097945] CPU: 0 PID: 21651 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 339.105852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 339.108197] erofs: FAULT_INJECTION was not selected [ 339.115208] Call Trace: [ 339.115230] dump_stack+0x1fc/0x2ef [ 339.115252] should_fail.cold+0xa/0xf [ 339.115270] ? setup_fault_attr+0x200/0x200 [ 339.115284] ? lock_acquire+0x170/0x3c0 [ 339.115304] __should_failslab+0x115/0x180 [ 339.115322] should_failslab+0x5/0x10 [ 339.115335] kmem_cache_alloc+0x277/0x370 [ 339.115354] __d_alloc+0x2b/0xa10 [ 339.115371] d_alloc+0x4a/0x230 [ 339.157494] __lookup_hash+0xc8/0x180 [ 339.161327] filename_create+0x186/0x490 [ 339.165395] ? kern_path_mountpoint+0x40/0x40 [ 339.169893] ? strncpy_from_user+0x2a2/0x350 [ 339.174310] ? getname_flags+0x25b/0x590 [ 339.178374] do_mkdirat+0xa0/0x2d0 [ 339.181925] ? __ia32_sys_mknod+0x120/0x120 [ 339.186258] ? trace_hardirqs_off_caller+0x6e/0x210 [ 339.191282] ? do_syscall_64+0x21/0x620 [ 339.192473] erofs: root inode @ nid 0 [ 339.195261] do_syscall_64+0xf9/0x620 [ 339.195282] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 339.195295] RIP: 0033:0x7ff625cea387 [ 339.195307] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 339.195318] RSP: 002b:00007ff62465ff88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 339.238401] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007ff625cea387 [ 339.245673] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 339.245941] erofs: bogus i_mode (0) @ nid 0 [ 339.252936] RBP: 00007ff6246601d0 R08: 0000000000000000 R09: 00007ff6246601d0 [ 339.252944] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 339.252953] R13: 0000000020000100 R14: 00007ff62465ffe0 R15: 0000000020000080 [ 339.281969] erofs: options -> noacl,noacl,acl, [ 339.287044] erofs: cannot find valid erofs superblock 20:42:50 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a", 0x8, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:50 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@acl}, {@fault_injection}]}) [ 339.352831] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 339.392386] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 339.394214] 9pnet: Could not find request transport: xen 20:42:50 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 29) [ 339.434089] 9pnet: Could not find request transport: xen 20:42:50 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 339.483269] erofs: read_super, device -> /dev/loop0 [ 339.488471] erofs: options -> acl,fault_injection=0x0000000000000000, [ 339.512084] erofs: FAULT_INJECTION was not selected [ 339.525334] erofs: root inode @ nid 0 [ 339.531900] erofs: bogus i_mode (0) @ nid 0 [ 339.537892] erofs: read_super, device -> /dev/loop4 [ 339.555611] erofs: options -> noacl,noacl,acl, [ 339.561924] FAULT_INJECTION: forcing a failure. [ 339.561924] name failslab, interval 1, probability 0, space 0, times 0 [ 339.574465] CPU: 1 PID: 21682 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 [ 339.582350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 339.591702] Call Trace: [ 339.594295] dump_stack+0x1fc/0x2ef [ 339.597926] should_fail.cold+0xa/0xf [ 339.601729] ? setup_fault_attr+0x200/0x200 [ 339.606052] ? __es_tree_search.isra.0+0x1af/0x210 [ 339.610991] __should_failslab+0x115/0x180 [ 339.615231] should_failslab+0x5/0x10 [ 339.619030] kmem_cache_alloc+0x3f/0x370 [ 339.623092] __es_insert_extent+0x39b/0x13b0 [ 339.627511] ? lock_acquire+0x170/0x3c0 [ 339.631494] ? ext4_es_insert_extent+0x17e/0x5e0 [ 339.636255] ext4_es_insert_extent+0x22e/0x5e0 [ 339.640841] ? lock_downgrade+0x720/0x720 [ 339.644995] ? ext4_es_find_delayed_extent_range+0x9f0/0x9f0 [ 339.650905] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 339.655928] ? ext4_es_find_delayed_extent_range+0x7d9/0x9f0 [ 339.661730] ext4_ext_map_blocks+0x2129/0x7390 [ 339.666313] ? __lock_acquire+0x6de/0x3ff0 [ 339.670557] ? __lock_acquire+0x6de/0x3ff0 [ 339.674801] ? mark_held_locks+0xf0/0xf0 [ 339.678861] ? __ext4_handle_dirty_metadata+0x1e0/0x590 [ 339.684226] ? ext4_find_delalloc_cluster+0x1f0/0x1f0 [ 339.689413] ? mark_held_locks+0xf0/0xf0 [ 339.693479] ? ext4_mark_iloc_dirty+0x1b0d/0x2b30 [ 339.698325] ? ext4_es_lookup_extent+0x375/0xb60 [ 339.703085] ? check_preemption_disabled+0x41/0x280 [ 339.708106] ? lock_acquire+0x170/0x3c0 [ 339.712081] ? ext4_map_blocks+0x33e/0x1a50 [ 339.716410] ext4_map_blocks+0xd88/0x1a50 [ 339.720566] ? check_preemption_disabled+0x41/0x280 [ 339.725600] ? ext4_issue_zeroout+0x160/0x160 [ 339.730094] ? __brelse+0x84/0xa0 [ 339.733546] ? __ext4_new_inode+0x2eb/0x5a20 [ 339.737962] ext4_getblk+0xad/0x4f0 [ 339.741593] ? ext4_iomap_begin+0xe00/0xe00 [ 339.745914] ? ext4_free_inode+0x1780/0x1780 [ 339.750323] ? debug_check_no_obj_freed+0x201/0x490 [ 339.755336] ? __dquot_initialize+0x298/0xb70 [ 339.759837] ext4_bread+0x7c/0x210 [ 339.763377] ? ext4_getblk+0x4f0/0x4f0 [ 339.767263] ? dquot_initialize_needed+0x290/0x290 [ 339.772196] ? trace_hardirqs_off+0x64/0x200 [ 339.776613] ext4_append+0x155/0x370 [ 339.780330] ext4_mkdir+0x5bd/0xe10 [ 339.784002] ? ext4_init_dot_dotdot+0x600/0x600 [ 339.788675] ? generic_permission+0x116/0x4d0 [ 339.793171] ? inode_permission.part.0+0x10c/0x450 [ 339.798104] vfs_mkdir+0x508/0x7a0 [ 339.801643] do_mkdirat+0x262/0x2d0 [ 339.805267] ? __ia32_sys_mknod+0x120/0x120 [ 339.809599] ? trace_hardirqs_off_caller+0x6e/0x210 [ 339.814616] ? do_syscall_64+0x21/0x620 [ 339.818598] do_syscall_64+0xf9/0x620 [ 339.822402] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 339.827592] RIP: 0033:0x7ff625cea387 [ 339.831302] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 339.850197] RSP: 002b:00007ff62465ff88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 339.857902] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007ff625cea387 [ 339.865180] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 339.872447] RBP: 00007ff6246601d0 R08: 0000000000000000 R09: 00007ff6246601d0 20:42:51 executing program 5: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}, {@fault_injection}]}) [ 339.879733] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 339.887004] R13: 0000000020000100 R14: 00007ff62465ffe0 R15: 0000000020000080 [ 339.905921] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 339.936226] erofs: blksize 1 isn't supported on this platform 20:42:51 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@acl}, {@fault_injection}]}) [ 340.068397] erofs: read_super, device -> /dev/loop5 [ 340.073657] erofs: options -> noacl,noacl,acl,fault_injection=0x0000000000000000, [ 340.091769] erofs: read_super, device -> /dev/loop0 [ 340.104673] erofs: options -> acl,fault_injection=0x0000000000000000, [ 340.145012] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 340.152421] erofs: FAULT_INJECTION was not selected [ 340.158999] 9pnet: Could not find request transport: xen [ 340.173741] erofs: FAULT_INJECTION was not selected [ 340.190630] erofs: root inode @ nid 0 [ 340.196854] erofs: root inode @ nid 0 [ 340.229239] erofs: bogus i_mode (0) @ nid 0 [ 340.237111] erofs: bogus i_mode (0) @ nid 0 20:42:51 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:42:51 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a", 0x8, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:51 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 340.325511] erofs: read_super, device -> /dev/loop2 [ 340.349607] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 340.389288] erofs: FAULT_INJECTION was not selected 20:42:51 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:51 executing program 0: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 340.422877] erofs: read_super, device -> /dev/loop4 [ 340.429601] erofs: root inode @ nid 36 [ 340.453746] erofs: options -> noacl,noacl,acl, [ 340.458719] erofs: blksize 1 isn't supported on this platform 20:42:51 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a", 0x8, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 340.480974] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:51 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 340.607301] erofs: unmounted for /dev/loop2 [ 340.629644] 9pnet: Could not find request transport: xen [ 340.646907] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 340.669706] erofs: read_super, device -> /dev/loop4 [ 340.677597] erofs: options -> noacl,noacl,acl, [ 340.718082] erofs: blksize 1 isn't supported on this platform 20:42:52 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a01000000", 0xc, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:52 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 340.813914] erofs: read_super, device -> /dev/loop2 [ 340.824809] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 340.839252] erofs: FAULT_INJECTION was not selected [ 340.844369] erofs: root inode @ nid 36 [ 340.848558] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:52 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 340.879501] erofs: unmounted for /dev/loop2 [ 340.926561] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 340.932642] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 340.948139] erofs: read_super, device -> /dev/loop4 [ 340.967787] erofs: options -> noacl,noacl,acl, [ 340.978476] 9pnet: Could not find request transport: xen [ 340.981553] 9pnet: Could not find request transport: xen [ 341.006922] erofs: blksize 1 isn't supported on this platform [ 341.012409] erofs: read_super, device -> /dev/loop2 20:42:52 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a01000000", 0xc, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 341.047413] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:42:52 executing program 0: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 341.118304] erofs: FAULT_INJECTION was not selected [ 341.166981] erofs: read_super, device -> /dev/loop4 [ 341.174125] erofs: root inode @ nid 36 [ 341.201280] erofs: mounted on /dev/loop2 with opts: noacl. [ 341.204053] erofs: options -> noacl,noacl,acl, [ 341.240484] erofs: blksize 1 isn't supported on this platform [ 341.247905] 9pnet: Could not find request transport: xen [ 341.284353] overlayfs: './file0' not a directory [ 341.302261] erofs: unmounted for /dev/loop2 [ 341.417607] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 341.454054] 9pnet: Could not find request transport: xen 20:42:53 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:42:53 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:53 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:42:53 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:53 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a01000000", 0xc, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:53 executing program 0: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 341.720822] erofs: read_super, device -> /dev/loop4 [ 341.755626] erofs: read_super, device -> /dev/loop2 [ 341.759848] erofs: options -> noacl,noacl,acl, [ 341.792190] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 341.816273] erofs: blksize 1 isn't supported on this platform [ 341.840699] erofs: FAULT_INJECTION was not selected [ 341.858698] erofs: root inode @ nid 36 [ 341.867827] overlayfs: failed to resolve './file1': -2 20:42:53 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c00", 0xe, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:53 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 341.925751] 9pnet: Could not find request transport: xen [ 341.946668] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:53 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x4, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 342.011651] erofs: unmounted for /dev/loop2 [ 342.088271] erofs: read_super, device -> /dev/loop4 [ 342.092438] 9pnet: Could not find request transport: xen [ 342.111136] erofs: options -> noacl,noacl,acl, [ 342.119173] erofs: root inode @ nid 0 [ 342.132997] erofs: bogus i_mode (0) @ nid 0 20:42:53 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c00", 0xe, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 342.150523] 9pnet: Could not find request transport: xen [ 342.161531] overlayfs: './file0' not a directory [ 342.174821] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 342.221841] erofs: read_super, device -> /dev/loop2 [ 342.236516] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 342.292373] erofs: FAULT_INJECTION was not selected 20:42:53 executing program 0: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:53 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 342.332403] erofs: root inode @ nid 36 [ 342.337035] overlayfs: failed to resolve './file1': -2 [ 342.378842] erofs: read_super, device -> /dev/loop4 [ 342.379095] erofs: mounted on /dev/loop2 with opts: noacl. [ 342.406364] 9pnet: Could not find request transport: xen [ 342.423006] erofs: options -> noacl,noacl,acl, [ 342.446565] erofs: unmounted for /dev/loop2 [ 342.456832] erofs: root inode @ nid 0 [ 342.472849] erofs: bogus i_mode (0) @ nid 0 [ 342.690039] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 342.760865] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 342.773370] 9pnet: Could not find request transport: xen [ 342.792558] 9pnet: Could not find request transport: xen 20:42:54 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:42:54 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x5, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:42:54 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:54 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c00", 0xe, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:54 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:54 executing program 0: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 343.072535] erofs: read_super, device -> /dev/loop2 [ 343.175431] erofs: read_super, device -> /dev/loop4 [ 343.257073] erofs: options -> noacl,noacl,acl, [ 343.282986] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 343.366615] erofs: FAULT_INJECTION was not selected [ 343.369509] erofs: root inode @ nid 0 [ 343.371835] erofs: root inode @ nid 36 [ 343.379770] erofs: mounted on /dev/loop2 with opts: noacl. [ 343.403171] erofs: bogus i_mode (0) @ nid 0 20:42:54 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x6, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:42:54 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 343.477976] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 343.497140] 9pnet: Could not find request transport: xen [ 343.503686] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 20:42:54 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 343.528811] erofs: unmounted for /dev/loop2 [ 343.545884] 9pnet: Could not find request transport: xen [ 343.568052] 9pnet: Could not find request transport: xen [ 343.625536] erofs: read_super, device -> /dev/loop4 [ 343.656218] erofs: options -> noacl,noacl,acl, [ 343.692660] erofs: cannot find valid erofs superblock [ 343.710640] erofs: read_super, device -> /dev/loop2 20:42:55 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 343.751472] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:42:55 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) 20:42:55 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 343.859545] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 343.902094] erofs: FAULT_INJECTION was not selected [ 343.909649] 9pnet: Could not find request transport: xen [ 343.962623] erofs: root inode @ nid 36 [ 343.979690] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:55 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 1) [ 344.015306] erofs: read_super, device -> /dev/loop4 [ 344.049449] erofs: options -> noacl,noacl,acl, 20:42:55 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x7, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:42:55 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 344.127086] erofs: cannot find valid erofs superblock [ 344.137588] erofs: unmounted for /dev/loop2 [ 344.159124] overlayfs: failed to resolve './file1': -2 [ 344.235183] 9pnet: Could not find request transport: xen 20:42:55 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 344.278061] FAULT_INJECTION: forcing a failure. [ 344.278061] name failslab, interval 1, probability 0, space 0, times 0 [ 344.315319] CPU: 1 PID: 21907 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 [ 344.323218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 344.332562] Call Trace: [ 344.335140] dump_stack+0x1fc/0x2ef [ 344.338753] should_fail.cold+0xa/0xf [ 344.342535] ? setup_fault_attr+0x200/0x200 [ 344.346837] ? lock_acquire+0x170/0x3c0 [ 344.350796] __should_failslab+0x115/0x180 [ 344.355012] should_failslab+0x5/0x10 [ 344.358792] __kmalloc+0x2ab/0x3c0 [ 344.362312] ? __se_sys_memfd_create+0xf8/0x440 [ 344.366963] __se_sys_memfd_create+0xf8/0x440 [ 344.371439] ? memfd_file_seals_ptr+0x150/0x150 [ 344.376089] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 344.381438] ? trace_hardirqs_off_caller+0x6e/0x210 [ 344.386437] ? do_syscall_64+0x21/0x620 [ 344.390413] do_syscall_64+0xf9/0x620 [ 344.394198] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 344.399368] RIP: 0033:0x7f51fd66f279 [ 344.403060] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:42:55 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 2) [ 344.421941] RSP: 002b:00007f51fbfe3f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 344.429628] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f51fd66f279 [ 344.436964] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f51fd6c8424 [ 344.444228] RBP: 0000000000000002 R08: 0000000000001000 R09: 00007f51fbfe41d0 [ 344.451478] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000008100000 [ 344.458754] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 20:42:55 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}, {@acl}]}) [ 344.564633] FAULT_INJECTION: forcing a failure. [ 344.564633] name failslab, interval 1, probability 0, space 0, times 0 [ 344.607554] erofs: read_super, device -> /dev/loop2 [ 344.611433] erofs: read_super, device -> /dev/loop4 [ 344.623341] erofs: options -> noacl,noacl,acl, [ 344.643021] CPU: 1 PID: 21917 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 [ 344.643054] erofs: cannot find valid erofs superblock [ 344.650934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 344.650940] Call Trace: [ 344.650962] dump_stack+0x1fc/0x2ef [ 344.650983] should_fail.cold+0xa/0xf [ 344.651003] ? setup_fault_attr+0x200/0x200 [ 344.651018] ? lock_acquire+0x170/0x3c0 [ 344.651038] __should_failslab+0x115/0x180 [ 344.651056] should_failslab+0x5/0x10 [ 344.651071] kmem_cache_alloc+0x277/0x370 [ 344.651113] ? shmem_destroy_callback+0xb0/0xb0 [ 344.651131] shmem_alloc_inode+0x18/0x40 [ 344.704725] ? shmem_destroy_callback+0xb0/0xb0 [ 344.709395] alloc_inode+0x5d/0x180 [ 344.713025] new_inode+0x1d/0xf0 [ 344.716397] shmem_get_inode+0x96/0x8d0 [ 344.720382] __shmem_file_setup.part.0+0x7a/0x2b0 [ 344.725240] shmem_file_setup+0x61/0x90 [ 344.729224] __se_sys_memfd_create+0x26b/0x440 [ 344.733808] ? memfd_file_seals_ptr+0x150/0x150 [ 344.738483] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 344.743850] ? trace_hardirqs_off_caller+0x6e/0x210 [ 344.748865] ? do_syscall_64+0x21/0x620 [ 344.752847] do_syscall_64+0xf9/0x620 [ 344.756653] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 344.761845] RIP: 0033:0x7f51fd66f279 [ 344.765559] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 344.775049] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 344.784453] RSP: 002b:00007f51fbfe3f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f 20:42:56 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:42:56 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 3) [ 344.784467] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f51fd66f279 [ 344.784474] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f51fd6c8424 [ 344.784482] RBP: 0000000000000002 R08: 0000000000001000 R09: 00007f51fbfe41d0 [ 344.784490] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000008100000 [ 344.784499] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 [ 344.795232] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 344.850536] erofs: FAULT_INJECTION was not selected 20:42:56 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x8, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:42:56 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, 0x0) [ 344.855674] erofs: root inode @ nid 36 [ 344.860106] erofs: mounted on /dev/loop2 with opts: noacl. [ 344.890384] erofs: unmounted for /dev/loop2 20:42:56 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 344.916683] FAULT_INJECTION: forcing a failure. [ 344.916683] name failslab, interval 1, probability 0, space 0, times 0 [ 344.921954] 9pnet: Could not find request transport: xen [ 344.966319] CPU: 1 PID: 21935 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 [ 344.974220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 344.983569] Call Trace: [ 344.986170] dump_stack+0x1fc/0x2ef [ 344.989807] should_fail.cold+0xa/0xf [ 344.993619] ? setup_fault_attr+0x200/0x200 [ 344.997948] ? lock_acquire+0x170/0x3c0 [ 345.001935] __should_failslab+0x115/0x180 [ 345.006178] should_failslab+0x5/0x10 [ 345.009982] kmem_cache_alloc+0x277/0x370 [ 345.014143] __d_alloc+0x2b/0xa10 [ 345.017604] d_alloc_pseudo+0x19/0x70 [ 345.021407] alloc_file_pseudo+0xc6/0x250 [ 345.025558] ? alloc_file+0x4d0/0x4d0 [ 345.029362] ? lockdep_annotate_inode_mutex_key+0x43/0x130 [ 345.034996] ? shmem_get_inode+0x44c/0x8d0 [ 345.039239] __shmem_file_setup.part.0+0x102/0x2b0 [ 345.044174] shmem_file_setup+0x61/0x90 [ 345.048152] __se_sys_memfd_create+0x26b/0x440 [ 345.052732] ? memfd_file_seals_ptr+0x150/0x150 [ 345.057406] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 345.062774] ? trace_hardirqs_off_caller+0x6e/0x210 [ 345.067791] ? do_syscall_64+0x21/0x620 [ 345.071769] do_syscall_64+0xf9/0x620 [ 345.075578] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 345.080765] RIP: 0033:0x7f51fd66f279 [ 345.084475] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 345.103374] RSP: 002b:00007f51fbfe3f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 345.111081] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f51fd66f279 [ 345.118347] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f51fd6c8424 [ 345.125616] RBP: 0000000000000002 R08: 0000000000001000 R09: 00007f51fbfe41d0 [ 345.132883] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000008100000 [ 345.140153] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 20:42:56 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 4) 20:42:56 executing program 5: perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6844}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x41009432, &(0x7f0000000040)) r1 = perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={r2, 0x11, 0x0, 0x0, 0x0}, 0x20) close(r2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={r3, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) perf_event_open(0x0, r3, 0x7, r1, 0x9) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f00000000c0)='memory.max\x00', 0x2, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000280)="93e6bd75738c5c9b80ee3f2d3756afaebf452e2ba7c7266e92000d7d507af1bf9cc1960ce171e73af0ea73edcc2546280ed0a83538e1084238995139d06a10478b0cfb574ea42093d8ac219b10f06e5a73d1adc64399ce4c272dbabdcb59897288294348734eb635d260f827bd338ec0d9959ac39c79d3e2ec2f42b3065afa90bfa9e830aa79fa0746a73b02060632b06774682576a841afccfcf444f6c9a779b2ea8491c590e8637e7aa5e22b749c95ecc0462e71115a81aa184cf62ea565e0faab558996e36733955504abc66a82a685bf", 0xd2) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8922, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc87,\x00\xd2\x97C\x00\x00\x00') write$cgroup_int(r5, &(0x7f00000001c0), 0x12) [ 345.373226] 9pnet: Could not find request transport: xen [ 345.393718] FAULT_INJECTION: forcing a failure. [ 345.393718] name failslab, interval 1, probability 0, space 0, times 0 [ 345.433889] CPU: 0 PID: 21952 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 [ 345.441782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 345.451134] Call Trace: [ 345.453728] dump_stack+0x1fc/0x2ef [ 345.454442] erofs: read_super, device -> /dev/loop2 [ 345.457361] should_fail.cold+0xa/0xf [ 345.457381] ? setup_fault_attr+0x200/0x200 [ 345.457397] ? lock_acquire+0x170/0x3c0 [ 345.457419] __should_failslab+0x115/0x180 [ 345.457438] should_failslab+0x5/0x10 [ 345.482462] kmem_cache_alloc+0x277/0x370 [ 345.486606] __alloc_file+0x21/0x340 [ 345.490310] alloc_empty_file+0x6d/0x170 [ 345.494363] alloc_file+0x5e/0x4d0 [ 345.497893] alloc_file_pseudo+0x165/0x250 [ 345.502115] ? alloc_file+0x4d0/0x4d0 [ 345.505904] ? lockdep_annotate_inode_mutex_key+0x43/0x130 [ 345.511516] ? shmem_get_inode+0x44c/0x8d0 [ 345.515743] __shmem_file_setup.part.0+0x102/0x2b0 [ 345.520664] shmem_file_setup+0x61/0x90 [ 345.524625] __se_sys_memfd_create+0x26b/0x440 [ 345.529193] ? memfd_file_seals_ptr+0x150/0x150 [ 345.533848] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 345.539204] ? trace_hardirqs_off_caller+0x6e/0x210 [ 345.544207] ? do_syscall_64+0x21/0x620 [ 345.548173] do_syscall_64+0xf9/0x620 [ 345.551964] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 345.557141] RIP: 0033:0x7f51fd66f279 [ 345.560839] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:42:57 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, 0x0) 20:42:57 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 5) [ 345.579725] RSP: 002b:00007f51fbfe3f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 345.587416] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f51fd66f279 [ 345.594671] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f51fd6c8424 [ 345.601921] RBP: 0000000000000002 R08: 0000000000001000 R09: 00007f51fbfe41d0 [ 345.609180] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000008100000 [ 345.616444] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 [ 345.653271] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 345.661833] overlayfs: './file0' not a directory [ 345.677665] erofs: FAULT_INJECTION was not selected [ 345.694672] FAULT_INJECTION: forcing a failure. 20:42:57 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 345.694672] name failslab, interval 1, probability 0, space 0, times 0 [ 345.694783] erofs: root inode @ nid 36 [ 345.730024] CPU: 1 PID: 21957 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 [ 345.737921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 345.747272] Call Trace: [ 345.749865] dump_stack+0x1fc/0x2ef [ 345.753500] should_fail.cold+0xa/0xf [ 345.757308] ? setup_fault_attr+0x200/0x200 [ 345.761636] ? lock_acquire+0x170/0x3c0 [ 345.765619] __should_failslab+0x115/0x180 [ 345.769864] should_failslab+0x5/0x10 [ 345.773671] kmem_cache_alloc_trace+0x284/0x380 [ 345.778349] apparmor_file_alloc_security+0x394/0xad0 [ 345.783557] ? apparmor_file_receive+0x160/0x160 [ 345.788320] ? __alloc_file+0x21/0x340 [ 345.792215] security_file_alloc+0x40/0x90 [ 345.796456] __alloc_file+0xd8/0x340 [ 345.800176] alloc_empty_file+0x6d/0x170 [ 345.804242] alloc_file+0x5e/0x4d0 [ 345.807793] alloc_file_pseudo+0x165/0x250 [ 345.812036] ? alloc_file+0x4d0/0x4d0 [ 345.815838] ? lockdep_annotate_inode_mutex_key+0x43/0x130 [ 345.821464] ? shmem_get_inode+0x44c/0x8d0 [ 345.825707] __shmem_file_setup.part.0+0x102/0x2b0 [ 345.830644] shmem_file_setup+0x61/0x90 [ 345.834620] __se_sys_memfd_create+0x26b/0x440 [ 345.839208] ? memfd_file_seals_ptr+0x150/0x150 [ 345.843884] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 345.849252] ? trace_hardirqs_off_caller+0x6e/0x210 20:42:57 executing program 5: perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6844}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x41009432, &(0x7f0000000040)) r1 = perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={r2, 0x11, 0x0, 0x0, 0x0}, 0x20) close(r2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={r3, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) perf_event_open(0x0, r3, 0x7, r1, 0x9) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f00000000c0)='memory.max\x00', 0x2, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000280)="93e6bd75738c5c9b80ee3f2d3756afaebf452e2ba7c7266e92000d7d507af1bf9cc1960ce171e73af0ea73edcc2546280ed0a83538e1084238995139d06a10478b0cfb574ea42093d8ac219b10f06e5a73d1adc64399ce4c272dbabdcb59897288294348734eb635d260f827bd338ec0d9959ac39c79d3e2ec2f42b3065afa90bfa9e830aa79fa0746a73b02060632b06774682576a841afccfcf444f6c9a779b2ea8491c590e8637e7aa5e22b749c95ecc0462e71115a81aa184cf62ea565e0faab558996e36733955504abc66a82a685bf", 0xd2) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8922, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc87,\x00\xd2\x97C\x00\x00\x00') write$cgroup_int(r5, &(0x7f00000001c0), 0x12) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6844}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) (async) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x41009432, &(0x7f0000000040)) (async) perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/net\x00') (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={r2, 0x11, 0x0, 0x0, 0x0}, 0x20) (async) close(r2) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={r3, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) (async) perf_event_open(0x0, r3, 0x7, r1, 0x9) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_int(r4, &(0x7f00000000c0)='memory.max\x00', 0x2, 0x0) (async) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) (async) write(r0, &(0x7f0000000280)="93e6bd75738c5c9b80ee3f2d3756afaebf452e2ba7c7266e92000d7d507af1bf9cc1960ce171e73af0ea73edcc2546280ed0a83538e1084238995139d06a10478b0cfb574ea42093d8ac219b10f06e5a73d1adc64399ce4c272dbabdcb59897288294348734eb635d260f827bd338ec0d9959ac39c79d3e2ec2f42b3065afa90bfa9e830aa79fa0746a73b02060632b06774682576a841afccfcf444f6c9a779b2ea8491c590e8637e7aa5e22b749c95ecc0462e71115a81aa184cf62ea565e0faab558996e36733955504abc66a82a685bf", 0xd2) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8922, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc87,\x00\xd2\x97C\x00\x00\x00') (async) write$cgroup_int(r5, &(0x7f00000001c0), 0x12) (async) [ 345.854279] ? do_syscall_64+0x21/0x620 [ 345.858260] do_syscall_64+0xf9/0x620 [ 345.862069] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 345.867261] RIP: 0033:0x7f51fd66f279 [ 345.870971] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 345.889877] RSP: 002b:00007f51fbfe3f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 345.897568] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f51fd66f279 [ 345.904818] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f51fd6c8424 [ 345.912065] RBP: 0000000000000002 R08: 0000000000001000 R09: 00007f51fbfe41d0 [ 345.919315] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000008100000 [ 345.926563] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 20:42:57 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 345.954854] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:57 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x9, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:42:57 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) (fail_nth: 6) [ 346.042501] erofs: unmounted for /dev/loop2 [ 346.076273] FAULT_INJECTION: forcing a failure. [ 346.076273] name fail_page_alloc, interval 1, probability 0, space 0, times 0 20:42:57 executing program 5: perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6844}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x41009432, &(0x7f0000000040)) r1 = perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={r2, 0x11, 0x0, 0x0, 0x0}, 0x20) close(r2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={r3, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) perf_event_open(0x0, r3, 0x7, r1, 0x9) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f00000000c0)='memory.max\x00', 0x2, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000280)="93e6bd75738c5c9b80ee3f2d3756afaebf452e2ba7c7266e92000d7d507af1bf9cc1960ce171e73af0ea73edcc2546280ed0a83538e1084238995139d06a10478b0cfb574ea42093d8ac219b10f06e5a73d1adc64399ce4c272dbabdcb59897288294348734eb635d260f827bd338ec0d9959ac39c79d3e2ec2f42b3065afa90bfa9e830aa79fa0746a73b02060632b06774682576a841afccfcf444f6c9a779b2ea8491c590e8637e7aa5e22b749c95ecc0462e71115a81aa184cf62ea565e0faab558996e36733955504abc66a82a685bf", 0xd2) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8922, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc87,\x00\xd2\x97C\x00\x00\x00') write$cgroup_int(r5, &(0x7f00000001c0), 0x12) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x6844}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x3f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) (async) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x41009432, &(0x7f0000000040)) (async) perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/net\x00') (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={r2, 0x11, 0x0, 0x0, 0x0}, 0x20) (async) close(r2) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={r3, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) (async) perf_event_open(0x0, r3, 0x7, r1, 0x9) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_int(r4, &(0x7f00000000c0)='memory.max\x00', 0x2, 0x0) (async) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) (async) write(r0, &(0x7f0000000280)="93e6bd75738c5c9b80ee3f2d3756afaebf452e2ba7c7266e92000d7d507af1bf9cc1960ce171e73af0ea73edcc2546280ed0a83538e1084238995139d06a10478b0cfb574ea42093d8ac219b10f06e5a73d1adc64399ce4c272dbabdcb59897288294348734eb635d260f827bd338ec0d9959ac39c79d3e2ec2f42b3065afa90bfa9e830aa79fa0746a73b02060632b06774682576a841afccfcf444f6c9a779b2ea8491c590e8637e7aa5e22b749c95ecc0462e71115a81aa184cf62ea565e0faab558996e36733955504abc66a82a685bf", 0xd2) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) (async) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8922, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc87,\x00\xd2\x97C\x00\x00\x00') (async) write$cgroup_int(r5, &(0x7f00000001c0), 0x12) (async) [ 346.134415] CPU: 1 PID: 21972 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 [ 346.142314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 346.151664] Call Trace: [ 346.154259] dump_stack+0x1fc/0x2ef [ 346.157896] should_fail.cold+0xa/0xf [ 346.161700] ? lock_acquire+0x170/0x3c0 [ 346.165678] ? setup_fault_attr+0x200/0x200 [ 346.170018] __alloc_pages_nodemask+0x239/0x2890 [ 346.174782] ? __lock_acquire+0x6de/0x3ff0 [ 346.179028] ? static_obj+0x50/0x50 [ 346.182666] ? __lock_acquire+0x6de/0x3ff0 [ 346.186904] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 346.191754] ? __lock_acquire+0x6de/0x3ff0 [ 346.195999] ? mark_held_locks+0xf0/0xf0 [ 346.200066] ? unwind_next_frame+0xeee/0x1400 [ 346.204563] ? mark_held_locks+0xf0/0xf0 [ 346.208626] ? deref_stack_reg+0x134/0x1d0 [ 346.212861] ? get_reg+0x176/0x1f0 [ 346.216407] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 346.222295] alloc_pages_vma+0xf2/0x780 [ 346.226279] shmem_alloc_page+0x11c/0x1f0 [ 346.226852] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 346.230424] ? shmem_swapin+0x220/0x220 [ 346.230460] ? percpu_counter_add_batch+0x126/0x180 [ 346.230476] ? __vm_enough_memory+0x316/0x650 [ 346.230500] shmem_alloc_and_acct_page+0x15a/0x850 [ 346.230523] shmem_getpage_gfp+0x4e9/0x37f0 [ 346.242472] 9pnet: Could not find request transport: xen [ 346.244704] ? shmem_alloc_and_acct_page+0x850/0x850 [ 346.244722] ? mark_held_locks+0xa6/0xf0 [ 346.244739] ? ktime_get_coarse_real_ts64+0x1c7/0x290 [ 346.283168] ? iov_iter_fault_in_readable+0x1fc/0x3f0 [ 346.288370] shmem_write_begin+0xff/0x1e0 [ 346.292531] generic_perform_write+0x1f8/0x4d0 [ 346.297132] ? filemap_page_mkwrite+0x2f0/0x2f0 [ 346.301801] ? current_time+0x1c0/0x1c0 [ 346.305782] ? lock_acquire+0x170/0x3c0 [ 346.309760] __generic_file_write_iter+0x24b/0x610 [ 346.314694] generic_file_write_iter+0x3f8/0x730 [ 346.319456] __vfs_write+0x51b/0x770 [ 346.323172] ? kernel_read+0x110/0x110 [ 346.327070] ? check_preemption_disabled+0x41/0x280 [ 346.332102] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 346.337126] vfs_write+0x1f3/0x540 [ 346.340671] __x64_sys_pwrite64+0x1f7/0x250 [ 346.344994] ? ksys_pwrite64+0x1a0/0x1a0 [ 346.349060] ? trace_hardirqs_off_caller+0x6e/0x210 [ 346.354075] ? do_syscall_64+0x21/0x620 [ 346.358048] do_syscall_64+0xf9/0x620 [ 346.361850] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 346.367033] RIP: 0033:0x7f51fd622247 20:42:57 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 346.370744] Code: 08 89 3c 24 48 89 4c 24 18 e8 e5 f8 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 48 8b 74 24 08 8b 3c 24 b8 12 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 04 24 e8 15 f9 ff ff 48 8b [ 346.389642] RSP: 002b:00007f51fbfe3f00 EFLAGS: 00000293 ORIG_RAX: 0000000000000012 [ 346.397350] RAX: ffffffffffffffda RBX: 00007f51fd6b8a20 RCX: 00007f51fd622247 [ 346.404619] RDX: 000000000000000d RSI: 0000000020010000 RDI: 0000000000000004 [ 346.411883] RBP: 0000000000000002 R08: 0000000000000000 R09: 00007f51fbfe41d0 [ 346.419138] R10: 0000000000000400 R11: 0000000000000293 R12: 0000000000000004 [ 346.426392] R13: 0000000000000004 R14: 0000000020000140 R15: 0000000000000000 [ 346.490656] erofs: read_super, device -> /dev/loop2 20:42:57 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, 0x0) [ 346.524344] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 346.554284] erofs: FAULT_INJECTION was not selected [ 346.592013] erofs: root inode @ nid 36 [ 346.617989] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:58 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}}, 0x54, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 346.799794] erofs: read_super, device -> /dev/loop0 20:42:58 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x10, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 346.837626] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 346.861918] erofs: unmounted for /dev/loop2 20:42:58 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 346.910517] erofs: cannot find valid erofs superblock 20:42:58 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 346.998220] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 347.029660] 9pnet: Could not find request transport: xen [ 347.091720] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 347.128345] 9pnet: Could not find request transport: xen 20:42:58 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:58 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}]}) 20:42:58 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 347.342574] erofs: read_super, device -> /dev/loop2 [ 347.367399] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 347.398895] erofs: FAULT_INJECTION was not selected [ 347.425057] erofs: root inode @ nid 36 [ 347.453288] erofs: mounted on /dev/loop2 with opts: noacl. [ 347.467707] erofs: read_super, device -> /dev/loop4 [ 347.470148] erofs: read_super, device -> /dev/loop0 [ 347.477867] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 347.478086] erofs: options -> noacl,noacl, [ 347.512669] 9pnet: Could not find request transport: xen [ 347.524283] erofs: FAULT_INJECTION was not selected [ 347.542716] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 20:42:58 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x23, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:42:59 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}]}) [ 347.557646] erofs: root inode @ nid 36 [ 347.557845] erofs: mounted on /dev/loop4 with opts: noacl. [ 347.579996] erofs: unmounted for /dev/loop2 [ 347.587669] erofs: root inode @ nid 0 [ 347.593836] erofs: bogus i_mode (0) @ nid 0 20:42:59 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 347.613867] erofs: unmounted for /dev/loop4 20:42:59 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 347.664698] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 347.695003] erofs: read_super, device -> /dev/loop2 [ 347.701735] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:42:59 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xe204}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r1, &(0x7f0000000140)=[{&(0x7f0000000080)='4', 0x1}], 0x1) ioctl$BTRFS_IOC_QUOTA_RESCAN(r0, 0x4040942c, &(0x7f0000000000)={0x0, 0x6, [0x33c, 0x4, 0x7ff, 0x0, 0x0, 0x7ff]}) [ 347.713825] erofs: FAULT_INJECTION was not selected [ 347.725635] erofs: root inode @ nid 36 [ 347.732317] 9pnet: Could not find request transport: xen [ 347.743645] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:59 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:42:59 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x60, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 347.796070] erofs: read_super, device -> /dev/loop0 [ 347.802652] erofs: read_super, device -> /dev/loop4 [ 347.820760] erofs: options -> noacl,noacl, [ 347.826477] erofs: unmounted for /dev/loop2 [ 347.841638] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 347.863158] erofs: root inode @ nid 36 [ 347.889883] overlayfs: failed to resolve './file1': -2 [ 347.897251] erofs: FAULT_INJECTION was not selected [ 347.900109] erofs: mounted on /dev/loop4 with opts: noacl. [ 347.948909] 9pnet: Could not find request transport: xen [ 347.957943] erofs: root inode @ nid 0 [ 347.990493] erofs: bogus i_mode (0) @ nid 0 [ 348.028151] erofs: unmounted for /dev/loop4 20:42:59 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@noacl}]}) 20:42:59 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xe204}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r1, &(0x7f0000000140)=[{&(0x7f0000000080)='4', 0x1}], 0x1) ioctl$BTRFS_IOC_QUOTA_RESCAN(r0, 0x4040942c, &(0x7f0000000000)={0x0, 0x6, [0x33c, 0x4, 0x7ff, 0x0, 0x0, 0x7ff]}) 20:42:59 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:42:59 executing program 5: r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xe204}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r1, &(0x7f0000000140)=[{&(0x7f0000000080)='4', 0x1}], 0x1) ioctl$BTRFS_IOC_QUOTA_RESCAN(r0, 0x4040942c, &(0x7f0000000000)={0x0, 0x6, [0x33c, 0x4, 0x7ff, 0x0, 0x0, 0x7ff]}) [ 348.261857] erofs: read_super, device -> /dev/loop2 [ 348.269454] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 348.276999] erofs: FAULT_INJECTION was not selected [ 348.282504] erofs: root inode @ nid 36 [ 348.286831] erofs: mounted on /dev/loop2 with opts: noacl. 20:42:59 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xa9, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:42:59 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 348.353113] erofs: unmounted for /dev/loop2 [ 348.355138] erofs: read_super, device -> /dev/loop4 [ 348.363935] erofs: options -> noacl,noacl, [ 348.369661] erofs: root inode @ nid 36 [ 348.379493] erofs: mounted on /dev/loop4 with opts: noacl. 20:42:59 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) [ 348.421845] erofs: read_super, device -> /dev/loop0 [ 348.433795] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 348.441415] erofs: unmounted for /dev/loop4 [ 348.452244] erofs: read_super, device -> /dev/loop2 [ 348.458614] erofs: FAULT_INJECTION was not selected 20:42:59 executing program 5: shutdown(0xffffffffffffffff, 0x1) syz_emit_ethernet(0xe6, &(0x7f0000000040)={@broadcast, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "a35105", 0xb0, 0x0, 0x0, @local, @private0, {[@dstopts={0x11, 0x14, '\x00', [@enc_lim, @generic={0x0, 0x9c, "96b8921d3e0a1f2f77b9d7697d47f20ac082ed435674ef72327151630acb5dede6584f21adc972532823e7f54a4e8f137607951eed790200e7a1b9d50f30e6d6678a0a60106906b5e3a17ef1f54abcc910b1f4f978872d34d97d6c85c8cc473399a96a6acbf51efdbcbd4540c9cd9e984c64017e465e8293af375ea33904c49b6ba727183a01cae49b2f5a8c175708362acf325ab34e990d79ca47f3"}]}]}}}}}, 0x0) [ 348.467727] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 348.479951] erofs: root inode @ nid 0 [ 348.503121] erofs: bogus i_mode (0) @ nid 0 20:42:59 executing program 5: shutdown(0xffffffffffffffff, 0x1) syz_emit_ethernet(0xe6, &(0x7f0000000040)={@broadcast, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "a35105", 0xb0, 0x0, 0x0, @local, @private0, {[@dstopts={0x11, 0x14, '\x00', [@enc_lim, @generic={0x0, 0x9c, "96b8921d3e0a1f2f77b9d7697d47f20ac082ed435674ef72327151630acb5dede6584f21adc972532823e7f54a4e8f137607951eed790200e7a1b9d50f30e6d6678a0a60106906b5e3a17ef1f54abcc910b1f4f978872d34d97d6c85c8cc473399a96a6acbf51efdbcbd4540c9cd9e984c64017e465e8293af375ea33904c49b6ba727183a01cae49b2f5a8c175708362acf325ab34e990d79ca47f3"}]}]}}}}}, 0x0) 20:42:59 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x4, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 348.526596] erofs: FAULT_INJECTION was not selected [ 348.543885] erofs: root inode @ nid 36 [ 348.555836] erofs: mounted on /dev/loop2 with opts: noacl. [ 348.615524] erofs: read_super, device -> /dev/loop4 [ 348.621367] erofs: unmounted for /dev/loop2 [ 348.627005] 9pnet: Could not find request transport: xen [ 348.642337] erofs: options -> noacl,acl, [ 348.655146] erofs: root inode @ nid 36 20:43:00 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:00 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x300, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:00 executing program 5: shutdown(0xffffffffffffffff, 0x1) (async) syz_emit_ethernet(0xe6, &(0x7f0000000040)={@broadcast, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "a35105", 0xb0, 0x0, 0x0, @local, @private0, {[@dstopts={0x11, 0x14, '\x00', [@enc_lim, @generic={0x0, 0x9c, "96b8921d3e0a1f2f77b9d7697d47f20ac082ed435674ef72327151630acb5dede6584f21adc972532823e7f54a4e8f137607951eed790200e7a1b9d50f30e6d6678a0a60106906b5e3a17ef1f54abcc910b1f4f978872d34d97d6c85c8cc473399a96a6acbf51efdbcbd4540c9cd9e984c64017e465e8293af375ea33904c49b6ba727183a01cae49b2f5a8c175708362acf325ab34e990d79ca47f3"}]}]}}}}}, 0x0) 20:43:00 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 348.687479] erofs: read_super, device -> /dev/loop0 [ 348.687678] erofs: mounted on /dev/loop4 with opts: noacl. [ 348.697697] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 348.715234] erofs: FAULT_INJECTION was not selected 20:43:00 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@acl}]}) 20:43:00 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x13ac}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f0000000300)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, 0x0) setregid(0x0, 0x0) r2 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2000}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockopt$PNPIPE_INITSTATE(r3, 0x113, 0x4, &(0x7f0000001280), 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000001240)={0x0, 0x0}, 0x10) setxattr$system_posix_acl(&(0x7f0000000340)='./file0\x00', &(0x7f00000020c0)='system.posix_acl_default\x00', 0x0, 0x34, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000300000000f000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b00000000020000280200000284", 0x62, 0x400}, {&(0x7f0000010400)="02000000030000000400000030000f", 0xf, 0x1000}, {&(0x7f0000010500)="ffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0x1002, 0x2000}, {&(0x7f0000012600)="ed41000000100000dbf4655fdcf4655fdcf4655f000000000000040008", 0x1d, 0x4200}], 0x0, &(0x7f0000013a00)) fstat(0xffffffffffffffff, &(0x7f0000002680)) syz_mount_image$ext4(0x0, &(0x7f00000011c0)='./file0\x00', 0x0, 0x3, &(0x7f0000002600)=[{&(0x7f0000001200)="9453f5ea5b1f6f469a3f90472ffa966fbbcbfb024fd070fc8c0c513f7ab7", 0x1e, 0x2}, {&(0x7f0000002140), 0x0, 0x7fffffff}, {0x0}], 0x1001000, &(0x7f0000002700)={[], [{@fowner_gt}, {@euid_lt}]}) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f00000012c0)='./file0\x00', 0x180, 0x2, &(0x7f00000014c0)=[{&(0x7f0000001300)="54e8421b5bff9a833734f00317a63c4cd18909d835d6124ad91088c12d93276fcc8ac831241fa9ee59c59a3757fd016288733128979f66b7fb546516234e1691654383400dfbf4ff82b03c35b922a15925e6cc26d093d06933389294530018ffaa41e009a338ef2eac41fb0f6895ffed585ac497a3366245125b11d70ee1313ebb90bdc1f7ad11e7f3ca253c6a0ef3d99e78f508c1d65a76cbfbd023292bda997567c71535f84d64e190c10c05e7d95f24a789793e", 0xb5, 0x9}, {0x0, 0x0, 0xffffffffffffffff}], 0x104800, &(0x7f0000001640)={[{@mblk_io_submit}], [{@appraise}, {@smackfsfloor={'smackfsfloor', 0x3d, 'ext4\x00'}}, {@euid_lt={'euid<', r1}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@appraise}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@fsname={'fsname', 0x3d, 'euid'}}]}) setxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), &(0x7f00000034c0)=ANY=[@ANYBLOB="00fb1600006c09ecfa2d815613e88c55159d7bde328b9314c8d1dc44832863a17d12ec2253589e73b5c026fe20b4f2bc4d6745fad01b0041044fe001ec106e50dfacc64cf2bcc833d311dba624b3230f03e9314c67d4fab8a9c195da879993bc0576be338045c6f7ebec34525327dee2513fcfc161aba086c36bcc7ff841837a13db49d1a6a292803b5f2607697305c8efff328aa4add29c3d5a9b355d529e9c19acc03ecbd5ac4f5c2bac6e7c8fb53753c2d1981083b782a10eec2776574195989a709fa4e083f8f3b87c5f6ddbef3dc977cbe84d2fbca58a518b051f76eab38a082aab990b8ac4d07549d1ec109f732478290e3cb60b154a1edd1a85544391bca7da8dcfcc205cf3038f42c0e8722eca37128b07d107d985f7250de5d54682f6244e739ec8f4ed8bf77a5a20d8ec27bc7286d9018ab8de38981aa87f0c6c0fd46f1f73763b743d3e1207289334562590fcf2ab2766850d052489841441e9574ce821cfbf7b1dfadd61b503aa7623a9c664360c5358bf102dfa0d3e552bf387fdc8dc873f4b59bddce9beb00e74a189de0258ff7276dba0757d3086a284359f9ce0195d08492edc817127ec99e7e33b74d7ec6b32dd4c9f882d9748dbc99b97d24114a39f2210cecafc36b91988a4bddf1d2b7c7e647dfa9f88da6549a26eb55c917479061e6674fc4224dd35e8924be5e61d114604a138069c02db7ea9033fa665fdb8950ee87935d76672072d8523f526e11fde80b5cba875672aa7b9dc6078caf3eb6d806bd4ff7f8198da138906007ce45099e0523184f8200f89629d3f1abefaa12afa59d7e0c0674dfeb60138d94c34a224e95eded0d1e34561386b945e3c7cc0ac3b2d77d0ddaa7911a01aed5b6159c411baed6533bce1ce76985017762aa996d79b82b29d514d28db106ffe5d1e561804f54ea7884d8b3d158510bdd08bb59955adee054130bedeaf9b2d26f21b7d0bce325933821c3cc973a2795c1421ec3b0b1957292c3bf43ff83f0ef102155ac2dc1a4c55f0ed70c9b3614b3896e021f117c3a80c2aae09092bcd3bc634017fffc154f8aa21394431b63c100f19298de204b27a77a00681a207506ad1eb03e97f81e9d1671d026186e0b551252eed4f7d12d0480616e7b17d16aea3418dba6ff29520404f77d67581eac956f80ae36a1e5e07a92c32e69d4dd676c5b63daa80c656fd222f4b406db28a399c14267f3dea94879aecad9cf13f3964c7ae5447afab8be34db87fa1e483fe09c628d231a8dbbb35096004fbb0cf5a6e13ab374f17d05249215ba4280a2c61732b187d698b66ec7314c21ec4c2c97c288d395104e2db29529f992da8b6cbe4d425b23b3304d457b75328a40b3936a6d5587c068a449501704f637c85fb046df24c4c462e09e1bfa5f7d3943b462da69c1ffc460a82aad0191ba77fa18aaa7ea9fdc168b9361e9ca16d56b36a6821b22764fda8000dc857db9ee5aa7e53202b35e7b3acb59f8151c3fd74063f132f51dceb0b3fb7920d5d2ffbc4847a65ab1d9f88088b2f28254f2695ba55deb705429db7d3167158676083e5df15c4318333f4870cbbdee2866259d8a1d84f7f141887f232230ff973c2fbfaa21933c0e7661b83a52e0a135820f20ef4725b025c4ef1f433a93d05a75a3ccee3748d02b14b3ebfad8b8a819bc97358abbe516725ea5b145612d7416b264b52e49301092301e7bceb75cec58e1657ca7076d721c76cfec1811394f7158f451c87e586dab0cff7eccea7af211b308422edb5caadd615dcf0a96b9d460dd60e4d802120795bb3b659ef88fca4d758be1f5dd83d7f3946accfefdde5c50551f586fe73ef33dcc42b84781e943b18e2ae05cb209ebe4b5f3a26eac806777b9c9e18ee617609c6909d1581eb60a9a9d1053c26738e8491795865bd090b2fe97948d1b6f49a0f6e4253add1fda4545c19dafb86e5966739d39ec57310a45d646f33c0f6a339d560c96aad2120738d0b430a011189cab1d795095c11609efda879614286cbe7ddec26a4e9ff17135c63af046800ca11dbd82711f4fc570b50d799eba2a4ec2b04f15e87703bd54fc1d5f3c137ff8185414387c995113225795072630f49125b5b1fd0322793b2bb6fb24b99a521829555341ee2a2241dbe80746452dfd715bff60f4a40f56e12f6043381ebd06b44e3eaf68340efaaf36ad7cd2af8574d068e09640d6b5f0a22e1ba1dbca51e2b0aac25dab11ca88a0262293d89321181501ba32b3dac866c19d2e836209472ad2aa8a4af62af995b8c6d0b79c3edadbbc7fd38033a761ace773f2acb8ae79f84205cbcc296a65055d10b6cab38b8c0a50539b6926ebb517228af26af276da8c635b769273db475ecd8b281ea3b3fcf858bef76ce761e11e84088c44ccf0e1b986483ed1f8ade7800716f7bbde795e37ec5fc950fcdae1eafda3991b231728c7bf36c3f1d7950ba934bcec383d0ed635033426ca85e0b6ec41b467d9943805881a414b8aa11c566d0d1b763caef197d19af8546a173dd8f2eae9f5a49e7bdfe9e287de4e16a5f96074553622a7fd3d0646d4e07ebdd402c6579b8f8ed25f468ce2427567563cfec729e1af74a62d92c03b1e45df4d29deb4f3a247e5ac1ab1fc74bfef2b8082d55f20a5fdfbe456e1493cda4035766bc9f215730456338e34b85f847377eaf0965f7b43c457bc011e61273543980ee1a1e6fea0c244e593d83e144c38416cc94a519799f2bc34d405b0a3d3f7df9c45236604d815c52f0776542141080ef27dcdc1af36f723e95a0c5103274f12f7237af76a4c5cb9498e21bc9142c3568ad93222e54389d01e6f16830b5c9cc09872671da06d8da068ed1ffed1be41902b1ba1cce6318eef7fb850624698101df4ffac57de42d1b13ce581a472b8a5e6db267dae639ff76f3348a61ebc92d6f4368da9a6c56062955ecb6d352e9af918eb473515f8bf2096b51353d7b2a804627a88a629f2e0ecd42e307faaf9807197cd775c1090dba98e2ada1833587410d3cf9fd9b68e80e9361aa16da5877b79a87985667938c2ffe6f5b8f30511301ab45ea0e1488d96e18583e590120df3cf0bf992feb9d96a421d2134aad816bbed4fde7eec2c25301beec61d64c57c0ed86b2e2efe0a95daec2ce57fb1f3f9e322d404d13ba6641aa535a1d3afd263425e66dee3687d5c38d80811170034d58872002cbbfa323fe064bde7ae7c46e8eb89ee71ef00abefc124a8d87c315465d578adc92b28f20c3a35c572765be05171d6ba756a18bbdc7fb36ec5feb02a8b2d6df43c0992b1cd117b420cbb2a765c1055557094ae894226de63a1a8afa43500706945657ef9a23376da5088c4cebaab7e18fe32b57ec0e5b345692d8bc5c6021aa34dfa88d5a66a370a867037fa0ac3fabb26b22779b9004e1bc4b3912357a7a47a67ea378c8c4bbe04b851d2363c45e55786a770e14d781b3a2d0b9bbdb4de2eed51c8d018988e5df45506e0b59a0320ad3ef9ff7ef17460b1ecb201cba6b53bb2ab63a559c497f06f313bb33028a232a7477cbc251e1395e8fa099fb0f0c46983aa66f24a2f432778da560c940d13acbe487e18c38c9187fea093d3505ca99f5dd6518b55cf45d5fcce9dab48caca06c9b5d82d96cfcde96cbca66fa5ecb2750df998613c36c3e9ffbb7f483e4c47beb0c782947be3f006bedbdcc9999cdf1ba1f2412d10f06fd74be142019cb423d23eaae5809aab6f29b85940087d1f2ce206391c27a52b28c3f6271a5a61477a74d34924d5bf5344ddd701f5b380a019708d921af8b5236fc5be7e5a025c908cc64f7370d58eb192346d255f06f58a04088d5bf9120997776b0c170139dc3d5fd7bf5ef9965764b91f399dd331cacdcd6b94be02c99f48b802e19b22dcb3294c3cb73c43dd2ab04dc0b35f28217c333dc372c20bcb6d1d85412cde8a1b9da4bfd05326a910cbb4715048bd753e134ffa537b3d349a4df3a8804e1c15595f5f2504bd7cd45c1120ab72bb7c7091a52bed9e0b9ae17e81a165039b406c88c2e84b1943f15215cd750edbfb06bbb41db6be57eb7cb1b4d45c48adee6d5823b27516bd8d9102fd0ce22508afc8229677723cd1ab59d3d79cc4d134ac3ea52069fef5d7677041d80424de8789f4d744d58ea57ea0dcebe692c0c1ace92ebc6c0f91057ef12230a43aec01c367572dfe475d10f61ba4f26a87c2387c94f5ea1db190f82d06b01177e2ff4abcd42992c70fde480315b9d7cf3cb1abb395b9d5dd3c8eb8888256e58c829f96c3d7952c5624a173c059767e427905216e6dc218854a1a42fd08e538bf7e287a47c07bd39d222bf6b1a95a0265a54f9e2ac826709782752ca38bc2545a7d002dd0f0049ae7a011223e20a9110ab3f73fa0ca575e94e588571dbb45475dfd94d01d798741cec3bae3ac35009c87b651035fb121637c905995754165e4475e8240a8705c047493df1c58bc52c811c74d636b513189068773776a976aae4df1529e5b1d1c73f3c0ffd18e0ed80ede33093d15811d4d6636337167da82d78d62a75bb608eeacb761424f51949000000008ea97cdc8acabde95e400eb2d36ad0e42b2824cb60ea40837aa8deb9ad2ea27016b4bb4611abe7983d7cddab"], 0xe16, 0x0) sendmsg$nl_route(r3, &(0x7f0000000ec0)={&(0x7f0000000080), 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)=@ipv6_newroute={0x1c, 0x18, 0x2, 0x70bd29, 0x25dfdbfb, {0xa, 0x0, 0x20, 0x1f, 0x7d, 0x0, 0xff, 0xc, 0x600}}, 0x1c}, 0x1, 0x0, 0x0, 0x20040084}, 0x4001) open$dir(&(0x7f0000000280)='./file0\x00', 0x0, 0x128) setxattr$trusted_overlay_upper(&(0x7f0000001700)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000380)={0x6, 0xfb, 0xa86, 0x4, 0x0, '\x00', "8dfa95f490b5c29ff9389f224c1d0f8d82b5401c68b18752f1f24810951641b2d28aa470a5fec7cc1cabfbdc679b6581b170cb2963e4d4421cf7cf61bf2e91106a5ccf86ced704dd5a91ce8fb6fa3bd4f0264986d9029c368058c1e293fdeab2ecadd3a1ccd738982be05e6527994f4d77691586962fb2ae58e80d061dbba03c9a595ffd4fb2788cd2a8e6147bf811fed93b0583e9ccd11df48aff0b5e0fc187392aa58728bbb313b8de8064e11cf658d4bb435e975574075faaae14529f47d687b1178c084e23c07574ca6d52155b5710231f80b96d6e3f99a05008ff65fc5a88242e8c12cf627442215a5eac9c07457af4980fb3cff8e999c94b6a95bb86457a9d71f139c054c26c88591fefa00524a080ffea5e29a99539b2beacc330b9c4c787e8adb5cf3e1dc30e877e2df587d44e9f2b204a99d914651fb183f816760ae3075916630905f52ddea2dad60a27da4650af5d05443215f78a826fd0599d12a4d9fabe4a3778ea20893b1afa01b78753cd758899b74aaad16b3f573eb2f39153b8c5cd0cbcd06274a462773e3f52bafe685084f9e482a3258cd3aedb1504cc0dcd567917600e564ff2d2fe8fb4afcd235db6db4fcda2b8f53798039f73dbd10b8c2f99697743a5b78a141f18a831aa794dd9430e2ab8b596e3d78e59d6763a86b0885e8f627002a5d77eac470fb685a4f7814b130fa4a7e5e66b3e6e3fae7bf31321c9f8858d8996c56391e41ed62fa28b4db74582f7578bc22266a64476654a23aa3878cc4e4b1c2d961f6e223498e0937572c7db8e6265063101cab017a65a7c77a503fec556060f8102caa95c5a23eebcdd3d1897f05f1328acae7446b5d5db454013c7e42c4d96accf8ddfe71fc7e5f56370d18a69dc699ad1303cb38a11f83d1a8660846755cd47a7f3a433a4011ee128b1e1ffec5a440621a6d044bd17ceee1f5cfec1dd35f41b89a816eaf5f25754307cb3968eae10d566fb79679c7af6ff82b28766cd99539dc09cefc0523a2112c5c81b269c8ec59131dbb9e5cb04d94b28f586b68b5d7df852866ad550768b34712a6080648ca5e3ddbb0996f0b0497ea907c6225d86664a4d5a659782373672b91e6c8ded3445dab6302bf55de0ba17560668426dcc562f757b019c878969a364a5e60be8eb6c3595846b7cbdbd0e1f88422a50d083bf65dd9dd2f5919bf38c2a74fce75f20517a17be51efd6f794e0f59e91da0478b833184db399e635d5c6a469bd5d1dde0c426fff46a4aea7af93ab32afef4d7864e7c7c6b81001293d1888b45f75e98707513fbd69ae16ac5b344532b7d62dcbfc1edc2bceab8a0ec62bf4638f13b968b764ece346288fceec159e68f49db618ea2ad067b301bb69ef7f983afd323738d9abdc729080130b00ee1e82997e9a41f03dd0712d73e334555e440d782adc17302bd3688b37e21dcc044cd139b7cf575ea372916ad6b94e6624cd77a97f18941e69eac13636a30e66cfdb31621145784864f25e61d66eabbafd2580bf1dd950a3e4884bf23c223711c833c715e8b1bf6a187da53bf021b53e5a3297e6d235b6effdd41c4b4de8a5bdbc84b002857e2483e35f3594809261454b257896e966c69b1fd95cc319e309e00e3f70b708794b742bb19234df85411c225b86c0115454a965b278dd5f6a7ea0e21c8679b57bf9090a1ce919c4d1056839725dcaa73640f3a9cc517284806653063fbb48bb614f1587f1cccb65f074c4508670f25e7a1fb3bb5b0c1a3d13b3a70a05f9be65880580809e80a5358132ed29a0ff8286d8de4812e4a0b5eb8bb12374ba43cf555fd033b9d4e95280293971fc81ff68c866df2cc49fecf90651b04de9d755dd77186b31de06d9828971c4202b98f757ffa00b0a7a3fab432dda48f6e3f2ac364a7a5749f56bf32142b2ad6c82f394477a7556a247d4863b2ba06b33e862f9ba43599c013d5739b3ce841e1776dbf03ef0b9c3fe3a138b2af1604c789b528dba03b5bdf6109adaf94aa24dad44b3257ca0f4e6800aaf1c0ef19c9461a56486d6909514b98603846d6ffb5d0acb57186dd9d6cd7420c86dd9f0bb66e55dd70438cf20ee740cf780ea58b9562df870fc18659a6d9185873870790c9f087082365f40d7de077b81131d1b6651cc2fbe656fa7ed8f56c03d082fbce1dc67325c57d5af51d5fd243eb34b3ff952dd17d84a5688be17341f9d1a12e14f164f1065769d1ee1500afd2b52eeb470412fe623d58815b0f1170d519659959471b23fae3175f1409148daeb6d1f27622fa63bf06ad61362aa831c5ef62a03607eb2b8542c4b17d1d3f915d93f5df579068f015f0c78d2d87805ebfe8e6f57ddeaeef2a73e0283680227f1987561999d1a4a9e1b11ab945458a17f5c8d161b82b416e00bc90d2d5f5efffeafea0c30a6dbef943d4a580c4785118da34fd15514b81a8e7b5a9eebfe59b0d3565ded6c5200b20bd56eed9f95bb0e4d68bb99ce629a646c69270492b00e984317bb17f6bb29c264f64347b4948044b9f35f72889a0733e9b5381beaa1f69a72aa57cc00c24916d98f26fe0cf0457ec975b037cca64d581dd32005b7d7d39f26eb688002561366d68057d4183e940b6509468f0268174b35e0e13a101a3071b58df7cbdbc7819b523e30b74ed088a32c7ba159abd986a4607ebfc036e396645705b076543dd27b33b7bcf5b2f7fe989902d346aea6c7ef67573c83903e09570bc48017e01bfe1686e9fe3da28e727d679ddca33ce193fd3c4a525c25eb9d4e0d727dd0c9c9ee3709755344828402a6d384ea16ad9bdac4518df78eb1a848c269c7571d56742c2ff67fba4a57aefc93c45f814e4eb8cb9c04989072a25c8ccca82862053c1c0fde1891e5c8f8783118485f25adb48a1dce26eacdd4ddc84d07473d61cf6ee6a4d28b022311f1b7151763e083488866a8a7edddc8f61ffb6451764a6008f022d346c819ec86a0256958265e5ce28da25f84e90cdf97abf746108d782661f5533547099a4f8928a071f0afbebcb4acb82eb3f8aa14df0823ceade1dfc7e052fdb79d7dabd5477f4d18b602721892c56a8de2e0a955dbd60201fbc4ebf088b6efd6ad133cdf5134825517a8a21e16ab52ce3dc4b75ff07e33d74d68d5bd04056c88cfeea72065bed06eb9ac039d8130477ca68b36c06a15567e178012e2e090b42bdc235e05ca662aae33c1f736aefb41621ed734813db359d6ee2c3ac01aec680369b7164325c6fbfe0b28363f7d88f132f0eae29f132757772fc7336c5554907ab10b7143da1b62d9dbaa960fb7e32700334ee6a00f0f4b68e86dc0cdf09a8919b37d5cca678cdb09b1ba31e32e6a8a873faff01e7e37aebdac6fe276539eb764c37b2c54942b2c3bff04ecebaffbfd871efd41b6392a1e3be49a078abd76f6ce08431ea920d04ea2972291169487a056d4719eb08c1f52ed3ea26af31ae9d9d16463387e6e1a6b0d66040a7af2f0ce3a0b8df477f06c64f30ba59f6dfade2cee217cf56fadc107d603c80a2e68dd8b11e84dad6857495435c6bf5d7af2bf02c3b05e472b736114ef171a5358908657a4923460e295097081baf8410e17c9fa58e908d67124cc25d73e8c09ddfdfc7f663fb40a72691164490b7ea506084777283b653d2622972afe4ab4b24919f12f54cb3e03fff483632543a202b4662b1056f6b20830f8bd0cdf2c48ee0f1ca966251d4c0ece6dc318a7b2da1c37204b7a699fd195b817f669c7060c958f2bddbb868aae4801325c7933833d65bc5a95a0cf"}, 0xa86, 0x0) sendmsg$nl_route(r3, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f40)=@ipv6_newnexthop={0x5c, 0x68, 0x8, 0x70bd2d, 0x25dfdbff, {0xa, 0x0, 0x2, 0x0, 0x22}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_ID={0x8}, @NHA_GROUP_TYPE={0x6}, @NHA_OIF={0x8}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP_TYPE={0x6}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @ILA_ATTR_CSUM_MODE={0x5, 0x7, 0x2}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008000}, 0x800) [ 348.748594] erofs: root inode @ nid 0 [ 348.762078] erofs: unmounted for /dev/loop4 [ 348.773044] erofs: bogus i_mode (0) @ nid 0 [ 348.805340] erofs: read_super, device -> /dev/loop2 [ 348.823864] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 349.010903] erofs: FAULT_INJECTION was not selected [ 349.019189] erofs: root inode @ nid 36 [ 349.056363] 9pnet: Could not find request transport: xen [ 349.073277] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:00 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:00 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x5, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:00 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@acl}]}) 20:43:00 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x383, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 349.104213] erofs: read_super, device -> /dev/loop4 [ 349.112495] erofs: options -> acl, [ 349.131398] erofs: root inode @ nid 36 [ 349.135397] erofs: mounted on /dev/loop4 with opts: acl. [ 349.180757] erofs: unmounted for /dev/loop4 [ 349.185464] erofs: unmounted for /dev/loop2 [ 349.274135] erofs: read_super, device -> /dev/loop0 [ 349.280405] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 349.310776] erofs: FAULT_INJECTION was not selected 20:43:00 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 349.334701] erofs: root inode @ nid 0 [ 349.346672] erofs: bogus i_mode (0) @ nid 0 [ 349.349202] 9pnet: Could not find request transport: xen 20:43:00 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x13ac}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f0000000300)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, 0x0) setregid(0x0, 0x0) r2 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2000}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockopt$PNPIPE_INITSTATE(r3, 0x113, 0x4, &(0x7f0000001280), 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000001240)={0x0, 0x0}, 0x10) setxattr$system_posix_acl(&(0x7f0000000340)='./file0\x00', &(0x7f00000020c0)='system.posix_acl_default\x00', 0x0, 0x34, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000300000000f000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b00000000020000280200000284", 0x62, 0x400}, {&(0x7f0000010400)="02000000030000000400000030000f", 0xf, 0x1000}, {&(0x7f0000010500)="ffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0x1002, 0x2000}, {&(0x7f0000012600)="ed41000000100000dbf4655fdcf4655fdcf4655f000000000000040008", 0x1d, 0x4200}], 0x0, &(0x7f0000013a00)) fstat(0xffffffffffffffff, &(0x7f0000002680)) syz_mount_image$ext4(0x0, &(0x7f00000011c0)='./file0\x00', 0x0, 0x3, &(0x7f0000002600)=[{&(0x7f0000001200)="9453f5ea5b1f6f469a3f90472ffa966fbbcbfb024fd070fc8c0c513f7ab7", 0x1e, 0x2}, {&(0x7f0000002140), 0x0, 0x7fffffff}, {0x0}], 0x1001000, &(0x7f0000002700)={[], [{@fowner_gt}, {@euid_lt}]}) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f00000012c0)='./file0\x00', 0x180, 0x2, &(0x7f00000014c0)=[{&(0x7f0000001300)="54e8421b5bff9a833734f00317a63c4cd18909d835d6124ad91088c12d93276fcc8ac831241fa9ee59c59a3757fd016288733128979f66b7fb546516234e1691654383400dfbf4ff82b03c35b922a15925e6cc26d093d06933389294530018ffaa41e009a338ef2eac41fb0f6895ffed585ac497a3366245125b11d70ee1313ebb90bdc1f7ad11e7f3ca253c6a0ef3d99e78f508c1d65a76cbfbd023292bda997567c71535f84d64e190c10c05e7d95f24a789793e", 0xb5, 0x9}, {0x0, 0x0, 0xffffffffffffffff}], 0x104800, &(0x7f0000001640)={[{@mblk_io_submit}], [{@appraise}, {@smackfsfloor={'smackfsfloor', 0x3d, 'ext4\x00'}}, {@euid_lt={'euid<', r1}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@appraise}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@fsname={'fsname', 0x3d, 'euid'}}]}) setxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), &(0x7f00000034c0)=ANY=[@ANYBLOB="00fb1600006c09ecfa2d815613e88c55159d7bde328b9314c8d1dc44832863a17d12ec2253589e73b5c026fe20b4f2bc4d6745fad01b0041044fe001ec106e50dfacc64cf2bcc833d311dba624b3230f03e9314c67d4fab8a9c195da879993bc0576be338045c6f7ebec34525327dee2513fcfc161aba086c36bcc7ff841837a13db49d1a6a292803b5f2607697305c8efff328aa4add29c3d5a9b355d529e9c19acc03ecbd5ac4f5c2bac6e7c8fb53753c2d1981083b782a10eec2776574195989a709fa4e083f8f3b87c5f6ddbef3dc977cbe84d2fbca58a518b051f76eab38a082aab990b8ac4d07549d1ec109f732478290e3cb60b154a1edd1a85544391bca7da8dcfcc205cf3038f42c0e8722eca37128b07d107d985f7250de5d54682f6244e739ec8f4ed8bf77a5a20d8ec27bc7286d9018ab8de38981aa87f0c6c0fd46f1f73763b743d3e1207289334562590fcf2ab2766850d052489841441e9574ce821cfbf7b1dfadd61b503aa7623a9c664360c5358bf102dfa0d3e552bf387fdc8dc873f4b59bddce9beb00e74a189de0258ff7276dba0757d3086a284359f9ce0195d08492edc817127ec99e7e33b74d7ec6b32dd4c9f882d9748dbc99b97d24114a39f2210cecafc36b91988a4bddf1d2b7c7e647dfa9f88da6549a26eb55c917479061e6674fc4224dd35e8924be5e61d114604a138069c02db7ea9033fa665fdb8950ee87935d76672072d8523f526e11fde80b5cba875672aa7b9dc6078caf3eb6d806bd4ff7f8198da138906007ce45099e0523184f8200f89629d3f1abefaa12afa59d7e0c0674dfeb60138d94c34a224e95eded0d1e34561386b945e3c7cc0ac3b2d77d0ddaa7911a01aed5b6159c411baed6533bce1ce76985017762aa996d79b82b29d514d28db106ffe5d1e561804f54ea7884d8b3d158510bdd08bb59955adee054130bedeaf9b2d26f21b7d0bce325933821c3cc973a2795c1421ec3b0b1957292c3bf43ff83f0ef102155ac2dc1a4c55f0ed70c9b3614b3896e021f117c3a80c2aae09092bcd3bc634017fffc154f8aa21394431b63c100f19298de204b27a77a00681a207506ad1eb03e97f81e9d1671d026186e0b551252eed4f7d12d0480616e7b17d16aea3418dba6ff29520404f77d67581eac956f80ae36a1e5e07a92c32e69d4dd676c5b63daa80c656fd222f4b406db28a399c14267f3dea94879aecad9cf13f3964c7ae5447afab8be34db87fa1e483fe09c628d231a8dbbb35096004fbb0cf5a6e13ab374f17d05249215ba4280a2c61732b187d698b66ec7314c21ec4c2c97c288d395104e2db29529f992da8b6cbe4d425b23b3304d457b75328a40b3936a6d5587c068a449501704f637c85fb046df24c4c462e09e1bfa5f7d3943b462da69c1ffc460a82aad0191ba77fa18aaa7ea9fdc168b9361e9ca16d56b36a6821b22764fda8000dc857db9ee5aa7e53202b35e7b3acb59f8151c3fd74063f132f51dceb0b3fb7920d5d2ffbc4847a65ab1d9f88088b2f28254f2695ba55deb705429db7d3167158676083e5df15c4318333f4870cbbdee2866259d8a1d84f7f141887f232230ff973c2fbfaa21933c0e7661b83a52e0a135820f20ef4725b025c4ef1f433a93d05a75a3ccee3748d02b14b3ebfad8b8a819bc97358abbe516725ea5b145612d7416b264b52e49301092301e7bceb75cec58e1657ca7076d721c76cfec1811394f7158f451c87e586dab0cff7eccea7af211b308422edb5caadd615dcf0a96b9d460dd60e4d802120795bb3b659ef88fca4d758be1f5dd83d7f3946accfefdde5c50551f586fe73ef33dcc42b84781e943b18e2ae05cb209ebe4b5f3a26eac806777b9c9e18ee617609c6909d1581eb60a9a9d1053c26738e8491795865bd090b2fe97948d1b6f49a0f6e4253add1fda4545c19dafb86e5966739d39ec57310a45d646f33c0f6a339d560c96aad2120738d0b430a011189cab1d795095c11609efda879614286cbe7ddec26a4e9ff17135c63af046800ca11dbd82711f4fc570b50d799eba2a4ec2b04f15e87703bd54fc1d5f3c137ff8185414387c995113225795072630f49125b5b1fd0322793b2bb6fb24b99a521829555341ee2a2241dbe80746452dfd715bff60f4a40f56e12f6043381ebd06b44e3eaf68340efaaf36ad7cd2af8574d068e09640d6b5f0a22e1ba1dbca51e2b0aac25dab11ca88a0262293d89321181501ba32b3dac866c19d2e836209472ad2aa8a4af62af995b8c6d0b79c3edadbbc7fd38033a761ace773f2acb8ae79f84205cbcc296a65055d10b6cab38b8c0a50539b6926ebb517228af26af276da8c635b769273db475ecd8b281ea3b3fcf858bef76ce761e11e84088c44ccf0e1b986483ed1f8ade7800716f7bbde795e37ec5fc950fcdae1eafda3991b231728c7bf36c3f1d7950ba934bcec383d0ed635033426ca85e0b6ec41b467d9943805881a414b8aa11c566d0d1b763caef197d19af8546a173dd8f2eae9f5a49e7bdfe9e287de4e16a5f96074553622a7fd3d0646d4e07ebdd402c6579b8f8ed25f468ce2427567563cfec729e1af74a62d92c03b1e45df4d29deb4f3a247e5ac1ab1fc74bfef2b8082d55f20a5fdfbe456e1493cda4035766bc9f215730456338e34b85f847377eaf0965f7b43c457bc011e61273543980ee1a1e6fea0c244e593d83e144c38416cc94a519799f2bc34d405b0a3d3f7df9c45236604d815c52f0776542141080ef27dcdc1af36f723e95a0c5103274f12f7237af76a4c5cb9498e21bc9142c3568ad93222e54389d01e6f16830b5c9cc09872671da06d8da068ed1ffed1be41902b1ba1cce6318eef7fb850624698101df4ffac57de42d1b13ce581a472b8a5e6db267dae639ff76f3348a61ebc92d6f4368da9a6c56062955ecb6d352e9af918eb473515f8bf2096b51353d7b2a804627a88a629f2e0ecd42e307faaf9807197cd775c1090dba98e2ada1833587410d3cf9fd9b68e80e9361aa16da5877b79a87985667938c2ffe6f5b8f30511301ab45ea0e1488d96e18583e590120df3cf0bf992feb9d96a421d2134aad816bbed4fde7eec2c25301beec61d64c57c0ed86b2e2efe0a95daec2ce57fb1f3f9e322d404d13ba6641aa535a1d3afd263425e66dee3687d5c38d80811170034d58872002cbbfa323fe064bde7ae7c46e8eb89ee71ef00abefc124a8d87c315465d578adc92b28f20c3a35c572765be05171d6ba756a18bbdc7fb36ec5feb02a8b2d6df43c0992b1cd117b420cbb2a765c1055557094ae894226de63a1a8afa43500706945657ef9a23376da5088c4cebaab7e18fe32b57ec0e5b345692d8bc5c6021aa34dfa88d5a66a370a867037fa0ac3fabb26b22779b9004e1bc4b3912357a7a47a67ea378c8c4bbe04b851d2363c45e55786a770e14d781b3a2d0b9bbdb4de2eed51c8d018988e5df45506e0b59a0320ad3ef9ff7ef17460b1ecb201cba6b53bb2ab63a559c497f06f313bb33028a232a7477cbc251e1395e8fa099fb0f0c46983aa66f24a2f432778da560c940d13acbe487e18c38c9187fea093d3505ca99f5dd6518b55cf45d5fcce9dab48caca06c9b5d82d96cfcde96cbca66fa5ecb2750df998613c36c3e9ffbb7f483e4c47beb0c782947be3f006bedbdcc9999cdf1ba1f2412d10f06fd74be142019cb423d23eaae5809aab6f29b85940087d1f2ce206391c27a52b28c3f6271a5a61477a74d34924d5bf5344ddd701f5b380a019708d921af8b5236fc5be7e5a025c908cc64f7370d58eb192346d255f06f58a04088d5bf9120997776b0c170139dc3d5fd7bf5ef9965764b91f399dd331cacdcd6b94be02c99f48b802e19b22dcb3294c3cb73c43dd2ab04dc0b35f28217c333dc372c20bcb6d1d85412cde8a1b9da4bfd05326a910cbb4715048bd753e134ffa537b3d349a4df3a8804e1c15595f5f2504bd7cd45c1120ab72bb7c7091a52bed9e0b9ae17e81a165039b406c88c2e84b1943f15215cd750edbfb06bbb41db6be57eb7cb1b4d45c48adee6d5823b27516bd8d9102fd0ce22508afc8229677723cd1ab59d3d79cc4d134ac3ea52069fef5d7677041d80424de8789f4d744d58ea57ea0dcebe692c0c1ace92ebc6c0f91057ef12230a43aec01c367572dfe475d10f61ba4f26a87c2387c94f5ea1db190f82d06b01177e2ff4abcd42992c70fde480315b9d7cf3cb1abb395b9d5dd3c8eb8888256e58c829f96c3d7952c5624a173c059767e427905216e6dc218854a1a42fd08e538bf7e287a47c07bd39d222bf6b1a95a0265a54f9e2ac826709782752ca38bc2545a7d002dd0f0049ae7a011223e20a9110ab3f73fa0ca575e94e588571dbb45475dfd94d01d798741cec3bae3ac35009c87b651035fb121637c905995754165e4475e8240a8705c047493df1c58bc52c811c74d636b513189068773776a976aae4df1529e5b1d1c73f3c0ffd18e0ed80ede33093d15811d4d6636337167da82d78d62a75bb608eeacb761424f51949000000008ea97cdc8acabde95e400eb2d36ad0e42b2824cb60ea40837aa8deb9ad2ea27016b4bb4611abe7983d7cddab"], 0xe16, 0x0) sendmsg$nl_route(r3, &(0x7f0000000ec0)={&(0x7f0000000080), 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)=@ipv6_newroute={0x1c, 0x18, 0x2, 0x70bd29, 0x25dfdbfb, {0xa, 0x0, 0x20, 0x1f, 0x7d, 0x0, 0xff, 0xc, 0x600}}, 0x1c}, 0x1, 0x0, 0x0, 0x20040084}, 0x4001) open$dir(&(0x7f0000000280)='./file0\x00', 0x0, 0x128) setxattr$trusted_overlay_upper(&(0x7f0000001700)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000380)={0x6, 0xfb, 0xa86, 0x4, 0x0, '\x00', "8dfa95f490b5c29ff9389f224c1d0f8d82b5401c68b18752f1f24810951641b2d28aa470a5fec7cc1cabfbdc679b6581b170cb2963e4d4421cf7cf61bf2e91106a5ccf86ced704dd5a91ce8fb6fa3bd4f0264986d9029c368058c1e293fdeab2ecadd3a1ccd738982be05e6527994f4d77691586962fb2ae58e80d061dbba03c9a595ffd4fb2788cd2a8e6147bf811fed93b0583e9ccd11df48aff0b5e0fc187392aa58728bbb313b8de8064e11cf658d4bb435e975574075faaae14529f47d687b1178c084e23c07574ca6d52155b5710231f80b96d6e3f99a05008ff65fc5a88242e8c12cf627442215a5eac9c07457af4980fb3cff8e999c94b6a95bb86457a9d71f139c054c26c88591fefa00524a080ffea5e29a99539b2beacc330b9c4c787e8adb5cf3e1dc30e877e2df587d44e9f2b204a99d914651fb183f816760ae3075916630905f52ddea2dad60a27da4650af5d05443215f78a826fd0599d12a4d9fabe4a3778ea20893b1afa01b78753cd758899b74aaad16b3f573eb2f39153b8c5cd0cbcd06274a462773e3f52bafe685084f9e482a3258cd3aedb1504cc0dcd567917600e564ff2d2fe8fb4afcd235db6db4fcda2b8f53798039f73dbd10b8c2f99697743a5b78a141f18a831aa794dd9430e2ab8b596e3d78e59d6763a86b0885e8f627002a5d77eac470fb685a4f7814b130fa4a7e5e66b3e6e3fae7bf31321c9f8858d8996c56391e41ed62fa28b4db74582f7578bc22266a64476654a23aa3878cc4e4b1c2d961f6e223498e0937572c7db8e6265063101cab017a65a7c77a503fec556060f8102caa95c5a23eebcdd3d1897f05f1328acae7446b5d5db454013c7e42c4d96accf8ddfe71fc7e5f56370d18a69dc699ad1303cb38a11f83d1a8660846755cd47a7f3a433a4011ee128b1e1ffec5a440621a6d044bd17ceee1f5cfec1dd35f41b89a816eaf5f25754307cb3968eae10d566fb79679c7af6ff82b28766cd99539dc09cefc0523a2112c5c81b269c8ec59131dbb9e5cb04d94b28f586b68b5d7df852866ad550768b34712a6080648ca5e3ddbb0996f0b0497ea907c6225d86664a4d5a659782373672b91e6c8ded3445dab6302bf55de0ba17560668426dcc562f757b019c878969a364a5e60be8eb6c3595846b7cbdbd0e1f88422a50d083bf65dd9dd2f5919bf38c2a74fce75f20517a17be51efd6f794e0f59e91da0478b833184db399e635d5c6a469bd5d1dde0c426fff46a4aea7af93ab32afef4d7864e7c7c6b81001293d1888b45f75e98707513fbd69ae16ac5b344532b7d62dcbfc1edc2bceab8a0ec62bf4638f13b968b764ece346288fceec159e68f49db618ea2ad067b301bb69ef7f983afd323738d9abdc729080130b00ee1e82997e9a41f03dd0712d73e334555e440d782adc17302bd3688b37e21dcc044cd139b7cf575ea372916ad6b94e6624cd77a97f18941e69eac13636a30e66cfdb31621145784864f25e61d66eabbafd2580bf1dd950a3e4884bf23c223711c833c715e8b1bf6a187da53bf021b53e5a3297e6d235b6effdd41c4b4de8a5bdbc84b002857e2483e35f3594809261454b257896e966c69b1fd95cc319e309e00e3f70b708794b742bb19234df85411c225b86c0115454a965b278dd5f6a7ea0e21c8679b57bf9090a1ce919c4d1056839725dcaa73640f3a9cc517284806653063fbb48bb614f1587f1cccb65f074c4508670f25e7a1fb3bb5b0c1a3d13b3a70a05f9be65880580809e80a5358132ed29a0ff8286d8de4812e4a0b5eb8bb12374ba43cf555fd033b9d4e95280293971fc81ff68c866df2cc49fecf90651b04de9d755dd77186b31de06d9828971c4202b98f757ffa00b0a7a3fab432dda48f6e3f2ac364a7a5749f56bf32142b2ad6c82f394477a7556a247d4863b2ba06b33e862f9ba43599c013d5739b3ce841e1776dbf03ef0b9c3fe3a138b2af1604c789b528dba03b5bdf6109adaf94aa24dad44b3257ca0f4e6800aaf1c0ef19c9461a56486d6909514b98603846d6ffb5d0acb57186dd9d6cd7420c86dd9f0bb66e55dd70438cf20ee740cf780ea58b9562df870fc18659a6d9185873870790c9f087082365f40d7de077b81131d1b6651cc2fbe656fa7ed8f56c03d082fbce1dc67325c57d5af51d5fd243eb34b3ff952dd17d84a5688be17341f9d1a12e14f164f1065769d1ee1500afd2b52eeb470412fe623d58815b0f1170d519659959471b23fae3175f1409148daeb6d1f27622fa63bf06ad61362aa831c5ef62a03607eb2b8542c4b17d1d3f915d93f5df579068f015f0c78d2d87805ebfe8e6f57ddeaeef2a73e0283680227f1987561999d1a4a9e1b11ab945458a17f5c8d161b82b416e00bc90d2d5f5efffeafea0c30a6dbef943d4a580c4785118da34fd15514b81a8e7b5a9eebfe59b0d3565ded6c5200b20bd56eed9f95bb0e4d68bb99ce629a646c69270492b00e984317bb17f6bb29c264f64347b4948044b9f35f72889a0733e9b5381beaa1f69a72aa57cc00c24916d98f26fe0cf0457ec975b037cca64d581dd32005b7d7d39f26eb688002561366d68057d4183e940b6509468f0268174b35e0e13a101a3071b58df7cbdbc7819b523e30b74ed088a32c7ba159abd986a4607ebfc036e396645705b076543dd27b33b7bcf5b2f7fe989902d346aea6c7ef67573c83903e09570bc48017e01bfe1686e9fe3da28e727d679ddca33ce193fd3c4a525c25eb9d4e0d727dd0c9c9ee3709755344828402a6d384ea16ad9bdac4518df78eb1a848c269c7571d56742c2ff67fba4a57aefc93c45f814e4eb8cb9c04989072a25c8ccca82862053c1c0fde1891e5c8f8783118485f25adb48a1dce26eacdd4ddc84d07473d61cf6ee6a4d28b022311f1b7151763e083488866a8a7edddc8f61ffb6451764a6008f022d346c819ec86a0256958265e5ce28da25f84e90cdf97abf746108d782661f5533547099a4f8928a071f0afbebcb4acb82eb3f8aa14df0823ceade1dfc7e052fdb79d7dabd5477f4d18b602721892c56a8de2e0a955dbd60201fbc4ebf088b6efd6ad133cdf5134825517a8a21e16ab52ce3dc4b75ff07e33d74d68d5bd04056c88cfeea72065bed06eb9ac039d8130477ca68b36c06a15567e178012e2e090b42bdc235e05ca662aae33c1f736aefb41621ed734813db359d6ee2c3ac01aec680369b7164325c6fbfe0b28363f7d88f132f0eae29f132757772fc7336c5554907ab10b7143da1b62d9dbaa960fb7e32700334ee6a00f0f4b68e86dc0cdf09a8919b37d5cca678cdb09b1ba31e32e6a8a873faff01e7e37aebdac6fe276539eb764c37b2c54942b2c3bff04ecebaffbfd871efd41b6392a1e3be49a078abd76f6ce08431ea920d04ea2972291169487a056d4719eb08c1f52ed3ea26af31ae9d9d16463387e6e1a6b0d66040a7af2f0ce3a0b8df477f06c64f30ba59f6dfade2cee217cf56fadc107d603c80a2e68dd8b11e84dad6857495435c6bf5d7af2bf02c3b05e472b736114ef171a5358908657a4923460e295097081baf8410e17c9fa58e908d67124cc25d73e8c09ddfdfc7f663fb40a72691164490b7ea506084777283b653d2622972afe4ab4b24919f12f54cb3e03fff483632543a202b4662b1056f6b20830f8bd0cdf2c48ee0f1ca966251d4c0ece6dc318a7b2da1c37204b7a699fd195b817f669c7060c958f2bddbb868aae4801325c7933833d65bc5a95a0cf"}, 0xa86, 0x0) sendmsg$nl_route(r3, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f40)=@ipv6_newnexthop={0x5c, 0x68, 0x8, 0x70bd2d, 0x25dfdbff, {0xa, 0x0, 0x2, 0x0, 0x22}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_ID={0x8}, @NHA_GROUP_TYPE={0x6}, @NHA_OIF={0x8}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP_TYPE={0x6}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @ILA_ATTR_CSUM_MODE={0x5, 0x7, 0x2}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008000}, 0x800) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x13ac}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f0000000300)) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) (async) setregid(0x0, 0x0) (async) getpgid(0x0) (async) perf_event_open(&(0x7f0000000700)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2000}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) socket(0x10, 0x3, 0x0) (async) getsockopt$PNPIPE_INITSTATE(r3, 0x113, 0x4, &(0x7f0000001280), 0x0) (async) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000001240)={0x0, 0x0}, 0x10) (async) setxattr$system_posix_acl(&(0x7f0000000340)='./file0\x00', &(0x7f00000020c0)='system.posix_acl_default\x00', 0x0, 0x34, 0x0) (async) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000300000000f000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b00000000020000280200000284", 0x62, 0x400}, {&(0x7f0000010400)="02000000030000000400000030000f", 0xf, 0x1000}, {&(0x7f0000010500)="ffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0x1002, 0x2000}, {&(0x7f0000012600)="ed41000000100000dbf4655fdcf4655fdcf4655f000000000000040008", 0x1d, 0x4200}], 0x0, &(0x7f0000013a00)) (async) fstat(0xffffffffffffffff, &(0x7f0000002680)) (async) syz_mount_image$ext4(0x0, &(0x7f00000011c0)='./file0\x00', 0x0, 0x3, &(0x7f0000002600)=[{&(0x7f0000001200)="9453f5ea5b1f6f469a3f90472ffa966fbbcbfb024fd070fc8c0c513f7ab7", 0x1e, 0x2}, {&(0x7f0000002140), 0x0, 0x7fffffff}, {0x0}], 0x1001000, &(0x7f0000002700)={[], [{@fowner_gt}, {@euid_lt}]}) (async) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f00000012c0)='./file0\x00', 0x180, 0x2, &(0x7f00000014c0)=[{&(0x7f0000001300)="54e8421b5bff9a833734f00317a63c4cd18909d835d6124ad91088c12d93276fcc8ac831241fa9ee59c59a3757fd016288733128979f66b7fb546516234e1691654383400dfbf4ff82b03c35b922a15925e6cc26d093d06933389294530018ffaa41e009a338ef2eac41fb0f6895ffed585ac497a3366245125b11d70ee1313ebb90bdc1f7ad11e7f3ca253c6a0ef3d99e78f508c1d65a76cbfbd023292bda997567c71535f84d64e190c10c05e7d95f24a789793e", 0xb5, 0x9}, {0x0, 0x0, 0xffffffffffffffff}], 0x104800, &(0x7f0000001640)={[{@mblk_io_submit}], [{@appraise}, {@smackfsfloor={'smackfsfloor', 0x3d, 'ext4\x00'}}, {@euid_lt={'euid<', r1}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@appraise}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@fsname={'fsname', 0x3d, 'euid'}}]}) (async) setxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), &(0x7f00000034c0)=ANY=[@ANYBLOB="00fb1600006c09ecfa2d815613e88c55159d7bde328b9314c8d1dc44832863a17d12ec2253589e73b5c026fe20b4f2bc4d6745fad01b0041044fe001ec106e50dfacc64cf2bcc833d311dba624b3230f03e9314c67d4fab8a9c195da879993bc0576be338045c6f7ebec34525327dee2513fcfc161aba086c36bcc7ff841837a13db49d1a6a292803b5f2607697305c8efff328aa4add29c3d5a9b355d529e9c19acc03ecbd5ac4f5c2bac6e7c8fb53753c2d1981083b782a10eec2776574195989a709fa4e083f8f3b87c5f6ddbef3dc977cbe84d2fbca58a518b051f76eab38a082aab990b8ac4d07549d1ec109f732478290e3cb60b154a1edd1a85544391bca7da8dcfcc205cf3038f42c0e8722eca37128b07d107d985f7250de5d54682f6244e739ec8f4ed8bf77a5a20d8ec27bc7286d9018ab8de38981aa87f0c6c0fd46f1f73763b743d3e1207289334562590fcf2ab2766850d052489841441e9574ce821cfbf7b1dfadd61b503aa7623a9c664360c5358bf102dfa0d3e552bf387fdc8dc873f4b59bddce9beb00e74a189de0258ff7276dba0757d3086a284359f9ce0195d08492edc817127ec99e7e33b74d7ec6b32dd4c9f882d9748dbc99b97d24114a39f2210cecafc36b91988a4bddf1d2b7c7e647dfa9f88da6549a26eb55c917479061e6674fc4224dd35e8924be5e61d114604a138069c02db7ea9033fa665fdb8950ee87935d76672072d8523f526e11fde80b5cba875672aa7b9dc6078caf3eb6d806bd4ff7f8198da138906007ce45099e0523184f8200f89629d3f1abefaa12afa59d7e0c0674dfeb60138d94c34a224e95eded0d1e34561386b945e3c7cc0ac3b2d77d0ddaa7911a01aed5b6159c411baed6533bce1ce76985017762aa996d79b82b29d514d28db106ffe5d1e561804f54ea7884d8b3d158510bdd08bb59955adee054130bedeaf9b2d26f21b7d0bce325933821c3cc973a2795c1421ec3b0b1957292c3bf43ff83f0ef102155ac2dc1a4c55f0ed70c9b3614b3896e021f117c3a80c2aae09092bcd3bc634017fffc154f8aa21394431b63c100f19298de204b27a77a00681a207506ad1eb03e97f81e9d1671d026186e0b551252eed4f7d12d0480616e7b17d16aea3418dba6ff29520404f77d67581eac956f80ae36a1e5e07a92c32e69d4dd676c5b63daa80c656fd222f4b406db28a399c14267f3dea94879aecad9cf13f3964c7ae5447afab8be34db87fa1e483fe09c628d231a8dbbb35096004fbb0cf5a6e13ab374f17d05249215ba4280a2c61732b187d698b66ec7314c21ec4c2c97c288d395104e2db29529f992da8b6cbe4d425b23b3304d457b75328a40b3936a6d5587c068a449501704f637c85fb046df24c4c462e09e1bfa5f7d3943b462da69c1ffc460a82aad0191ba77fa18aaa7ea9fdc168b9361e9ca16d56b36a6821b22764fda8000dc857db9ee5aa7e53202b35e7b3acb59f8151c3fd74063f132f51dceb0b3fb7920d5d2ffbc4847a65ab1d9f88088b2f28254f2695ba55deb705429db7d3167158676083e5df15c4318333f4870cbbdee2866259d8a1d84f7f141887f232230ff973c2fbfaa21933c0e7661b83a52e0a135820f20ef4725b025c4ef1f433a93d05a75a3ccee3748d02b14b3ebfad8b8a819bc97358abbe516725ea5b145612d7416b264b52e49301092301e7bceb75cec58e1657ca7076d721c76cfec1811394f7158f451c87e586dab0cff7eccea7af211b308422edb5caadd615dcf0a96b9d460dd60e4d802120795bb3b659ef88fca4d758be1f5dd83d7f3946accfefdde5c50551f586fe73ef33dcc42b84781e943b18e2ae05cb209ebe4b5f3a26eac806777b9c9e18ee617609c6909d1581eb60a9a9d1053c26738e8491795865bd090b2fe97948d1b6f49a0f6e4253add1fda4545c19dafb86e5966739d39ec57310a45d646f33c0f6a339d560c96aad2120738d0b430a011189cab1d795095c11609efda879614286cbe7ddec26a4e9ff17135c63af046800ca11dbd82711f4fc570b50d799eba2a4ec2b04f15e87703bd54fc1d5f3c137ff8185414387c995113225795072630f49125b5b1fd0322793b2bb6fb24b99a521829555341ee2a2241dbe80746452dfd715bff60f4a40f56e12f6043381ebd06b44e3eaf68340efaaf36ad7cd2af8574d068e09640d6b5f0a22e1ba1dbca51e2b0aac25dab11ca88a0262293d89321181501ba32b3dac866c19d2e836209472ad2aa8a4af62af995b8c6d0b79c3edadbbc7fd38033a761ace773f2acb8ae79f84205cbcc296a65055d10b6cab38b8c0a50539b6926ebb517228af26af276da8c635b769273db475ecd8b281ea3b3fcf858bef76ce761e11e84088c44ccf0e1b986483ed1f8ade7800716f7bbde795e37ec5fc950fcdae1eafda3991b231728c7bf36c3f1d7950ba934bcec383d0ed635033426ca85e0b6ec41b467d9943805881a414b8aa11c566d0d1b763caef197d19af8546a173dd8f2eae9f5a49e7bdfe9e287de4e16a5f96074553622a7fd3d0646d4e07ebdd402c6579b8f8ed25f468ce2427567563cfec729e1af74a62d92c03b1e45df4d29deb4f3a247e5ac1ab1fc74bfef2b8082d55f20a5fdfbe456e1493cda4035766bc9f215730456338e34b85f847377eaf0965f7b43c457bc011e61273543980ee1a1e6fea0c244e593d83e144c38416cc94a519799f2bc34d405b0a3d3f7df9c45236604d815c52f0776542141080ef27dcdc1af36f723e95a0c5103274f12f7237af76a4c5cb9498e21bc9142c3568ad93222e54389d01e6f16830b5c9cc09872671da06d8da068ed1ffed1be41902b1ba1cce6318eef7fb850624698101df4ffac57de42d1b13ce581a472b8a5e6db267dae639ff76f3348a61ebc92d6f4368da9a6c56062955ecb6d352e9af918eb473515f8bf2096b51353d7b2a804627a88a629f2e0ecd42e307faaf9807197cd775c1090dba98e2ada1833587410d3cf9fd9b68e80e9361aa16da5877b79a87985667938c2ffe6f5b8f30511301ab45ea0e1488d96e18583e590120df3cf0bf992feb9d96a421d2134aad816bbed4fde7eec2c25301beec61d64c57c0ed86b2e2efe0a95daec2ce57fb1f3f9e322d404d13ba6641aa535a1d3afd263425e66dee3687d5c38d80811170034d58872002cbbfa323fe064bde7ae7c46e8eb89ee71ef00abefc124a8d87c315465d578adc92b28f20c3a35c572765be05171d6ba756a18bbdc7fb36ec5feb02a8b2d6df43c0992b1cd117b420cbb2a765c1055557094ae894226de63a1a8afa43500706945657ef9a23376da5088c4cebaab7e18fe32b57ec0e5b345692d8bc5c6021aa34dfa88d5a66a370a867037fa0ac3fabb26b22779b9004e1bc4b3912357a7a47a67ea378c8c4bbe04b851d2363c45e55786a770e14d781b3a2d0b9bbdb4de2eed51c8d018988e5df45506e0b59a0320ad3ef9ff7ef17460b1ecb201cba6b53bb2ab63a559c497f06f313bb33028a232a7477cbc251e1395e8fa099fb0f0c46983aa66f24a2f432778da560c940d13acbe487e18c38c9187fea093d3505ca99f5dd6518b55cf45d5fcce9dab48caca06c9b5d82d96cfcde96cbca66fa5ecb2750df998613c36c3e9ffbb7f483e4c47beb0c782947be3f006bedbdcc9999cdf1ba1f2412d10f06fd74be142019cb423d23eaae5809aab6f29b85940087d1f2ce206391c27a52b28c3f6271a5a61477a74d34924d5bf5344ddd701f5b380a019708d921af8b5236fc5be7e5a025c908cc64f7370d58eb192346d255f06f58a04088d5bf9120997776b0c170139dc3d5fd7bf5ef9965764b91f399dd331cacdcd6b94be02c99f48b802e19b22dcb3294c3cb73c43dd2ab04dc0b35f28217c333dc372c20bcb6d1d85412cde8a1b9da4bfd05326a910cbb4715048bd753e134ffa537b3d349a4df3a8804e1c15595f5f2504bd7cd45c1120ab72bb7c7091a52bed9e0b9ae17e81a165039b406c88c2e84b1943f15215cd750edbfb06bbb41db6be57eb7cb1b4d45c48adee6d5823b27516bd8d9102fd0ce22508afc8229677723cd1ab59d3d79cc4d134ac3ea52069fef5d7677041d80424de8789f4d744d58ea57ea0dcebe692c0c1ace92ebc6c0f91057ef12230a43aec01c367572dfe475d10f61ba4f26a87c2387c94f5ea1db190f82d06b01177e2ff4abcd42992c70fde480315b9d7cf3cb1abb395b9d5dd3c8eb8888256e58c829f96c3d7952c5624a173c059767e427905216e6dc218854a1a42fd08e538bf7e287a47c07bd39d222bf6b1a95a0265a54f9e2ac826709782752ca38bc2545a7d002dd0f0049ae7a011223e20a9110ab3f73fa0ca575e94e588571dbb45475dfd94d01d798741cec3bae3ac35009c87b651035fb121637c905995754165e4475e8240a8705c047493df1c58bc52c811c74d636b513189068773776a976aae4df1529e5b1d1c73f3c0ffd18e0ed80ede33093d15811d4d6636337167da82d78d62a75bb608eeacb761424f51949000000008ea97cdc8acabde95e400eb2d36ad0e42b2824cb60ea40837aa8deb9ad2ea27016b4bb4611abe7983d7cddab"], 0xe16, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000ec0)={&(0x7f0000000080), 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)=@ipv6_newroute={0x1c, 0x18, 0x2, 0x70bd29, 0x25dfdbfb, {0xa, 0x0, 0x20, 0x1f, 0x7d, 0x0, 0xff, 0xc, 0x600}}, 0x1c}, 0x1, 0x0, 0x0, 0x20040084}, 0x4001) (async) open$dir(&(0x7f0000000280)='./file0\x00', 0x0, 0x128) (async) setxattr$trusted_overlay_upper(&(0x7f0000001700)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000380)={0x6, 0xfb, 0xa86, 0x4, 0x0, '\x00', "8dfa95f490b5c29ff9389f224c1d0f8d82b5401c68b18752f1f24810951641b2d28aa470a5fec7cc1cabfbdc679b6581b170cb2963e4d4421cf7cf61bf2e91106a5ccf86ced704dd5a91ce8fb6fa3bd4f0264986d9029c368058c1e293fdeab2ecadd3a1ccd738982be05e6527994f4d77691586962fb2ae58e80d061dbba03c9a595ffd4fb2788cd2a8e6147bf811fed93b0583e9ccd11df48aff0b5e0fc187392aa58728bbb313b8de8064e11cf658d4bb435e975574075faaae14529f47d687b1178c084e23c07574ca6d52155b5710231f80b96d6e3f99a05008ff65fc5a88242e8c12cf627442215a5eac9c07457af4980fb3cff8e999c94b6a95bb86457a9d71f139c054c26c88591fefa00524a080ffea5e29a99539b2beacc330b9c4c787e8adb5cf3e1dc30e877e2df587d44e9f2b204a99d914651fb183f816760ae3075916630905f52ddea2dad60a27da4650af5d05443215f78a826fd0599d12a4d9fabe4a3778ea20893b1afa01b78753cd758899b74aaad16b3f573eb2f39153b8c5cd0cbcd06274a462773e3f52bafe685084f9e482a3258cd3aedb1504cc0dcd567917600e564ff2d2fe8fb4afcd235db6db4fcda2b8f53798039f73dbd10b8c2f99697743a5b78a141f18a831aa794dd9430e2ab8b596e3d78e59d6763a86b0885e8f627002a5d77eac470fb685a4f7814b130fa4a7e5e66b3e6e3fae7bf31321c9f8858d8996c56391e41ed62fa28b4db74582f7578bc22266a64476654a23aa3878cc4e4b1c2d961f6e223498e0937572c7db8e6265063101cab017a65a7c77a503fec556060f8102caa95c5a23eebcdd3d1897f05f1328acae7446b5d5db454013c7e42c4d96accf8ddfe71fc7e5f56370d18a69dc699ad1303cb38a11f83d1a8660846755cd47a7f3a433a4011ee128b1e1ffec5a440621a6d044bd17ceee1f5cfec1dd35f41b89a816eaf5f25754307cb3968eae10d566fb79679c7af6ff82b28766cd99539dc09cefc0523a2112c5c81b269c8ec59131dbb9e5cb04d94b28f586b68b5d7df852866ad550768b34712a6080648ca5e3ddbb0996f0b0497ea907c6225d86664a4d5a659782373672b91e6c8ded3445dab6302bf55de0ba17560668426dcc562f757b019c878969a364a5e60be8eb6c3595846b7cbdbd0e1f88422a50d083bf65dd9dd2f5919bf38c2a74fce75f20517a17be51efd6f794e0f59e91da0478b833184db399e635d5c6a469bd5d1dde0c426fff46a4aea7af93ab32afef4d7864e7c7c6b81001293d1888b45f75e98707513fbd69ae16ac5b344532b7d62dcbfc1edc2bceab8a0ec62bf4638f13b968b764ece346288fceec159e68f49db618ea2ad067b301bb69ef7f983afd323738d9abdc729080130b00ee1e82997e9a41f03dd0712d73e334555e440d782adc17302bd3688b37e21dcc044cd139b7cf575ea372916ad6b94e6624cd77a97f18941e69eac13636a30e66cfdb31621145784864f25e61d66eabbafd2580bf1dd950a3e4884bf23c223711c833c715e8b1bf6a187da53bf021b53e5a3297e6d235b6effdd41c4b4de8a5bdbc84b002857e2483e35f3594809261454b257896e966c69b1fd95cc319e309e00e3f70b708794b742bb19234df85411c225b86c0115454a965b278dd5f6a7ea0e21c8679b57bf9090a1ce919c4d1056839725dcaa73640f3a9cc517284806653063fbb48bb614f1587f1cccb65f074c4508670f25e7a1fb3bb5b0c1a3d13b3a70a05f9be65880580809e80a5358132ed29a0ff8286d8de4812e4a0b5eb8bb12374ba43cf555fd033b9d4e95280293971fc81ff68c866df2cc49fecf90651b04de9d755dd77186b31de06d9828971c4202b98f757ffa00b0a7a3fab432dda48f6e3f2ac364a7a5749f56bf32142b2ad6c82f394477a7556a247d4863b2ba06b33e862f9ba43599c013d5739b3ce841e1776dbf03ef0b9c3fe3a138b2af1604c789b528dba03b5bdf6109adaf94aa24dad44b3257ca0f4e6800aaf1c0ef19c9461a56486d6909514b98603846d6ffb5d0acb57186dd9d6cd7420c86dd9f0bb66e55dd70438cf20ee740cf780ea58b9562df870fc18659a6d9185873870790c9f087082365f40d7de077b81131d1b6651cc2fbe656fa7ed8f56c03d082fbce1dc67325c57d5af51d5fd243eb34b3ff952dd17d84a5688be17341f9d1a12e14f164f1065769d1ee1500afd2b52eeb470412fe623d58815b0f1170d519659959471b23fae3175f1409148daeb6d1f27622fa63bf06ad61362aa831c5ef62a03607eb2b8542c4b17d1d3f915d93f5df579068f015f0c78d2d87805ebfe8e6f57ddeaeef2a73e0283680227f1987561999d1a4a9e1b11ab945458a17f5c8d161b82b416e00bc90d2d5f5efffeafea0c30a6dbef943d4a580c4785118da34fd15514b81a8e7b5a9eebfe59b0d3565ded6c5200b20bd56eed9f95bb0e4d68bb99ce629a646c69270492b00e984317bb17f6bb29c264f64347b4948044b9f35f72889a0733e9b5381beaa1f69a72aa57cc00c24916d98f26fe0cf0457ec975b037cca64d581dd32005b7d7d39f26eb688002561366d68057d4183e940b6509468f0268174b35e0e13a101a3071b58df7cbdbc7819b523e30b74ed088a32c7ba159abd986a4607ebfc036e396645705b076543dd27b33b7bcf5b2f7fe989902d346aea6c7ef67573c83903e09570bc48017e01bfe1686e9fe3da28e727d679ddca33ce193fd3c4a525c25eb9d4e0d727dd0c9c9ee3709755344828402a6d384ea16ad9bdac4518df78eb1a848c269c7571d56742c2ff67fba4a57aefc93c45f814e4eb8cb9c04989072a25c8ccca82862053c1c0fde1891e5c8f8783118485f25adb48a1dce26eacdd4ddc84d07473d61cf6ee6a4d28b022311f1b7151763e083488866a8a7edddc8f61ffb6451764a6008f022d346c819ec86a0256958265e5ce28da25f84e90cdf97abf746108d782661f5533547099a4f8928a071f0afbebcb4acb82eb3f8aa14df0823ceade1dfc7e052fdb79d7dabd5477f4d18b602721892c56a8de2e0a955dbd60201fbc4ebf088b6efd6ad133cdf5134825517a8a21e16ab52ce3dc4b75ff07e33d74d68d5bd04056c88cfeea72065bed06eb9ac039d8130477ca68b36c06a15567e178012e2e090b42bdc235e05ca662aae33c1f736aefb41621ed734813db359d6ee2c3ac01aec680369b7164325c6fbfe0b28363f7d88f132f0eae29f132757772fc7336c5554907ab10b7143da1b62d9dbaa960fb7e32700334ee6a00f0f4b68e86dc0cdf09a8919b37d5cca678cdb09b1ba31e32e6a8a873faff01e7e37aebdac6fe276539eb764c37b2c54942b2c3bff04ecebaffbfd871efd41b6392a1e3be49a078abd76f6ce08431ea920d04ea2972291169487a056d4719eb08c1f52ed3ea26af31ae9d9d16463387e6e1a6b0d66040a7af2f0ce3a0b8df477f06c64f30ba59f6dfade2cee217cf56fadc107d603c80a2e68dd8b11e84dad6857495435c6bf5d7af2bf02c3b05e472b736114ef171a5358908657a4923460e295097081baf8410e17c9fa58e908d67124cc25d73e8c09ddfdfc7f663fb40a72691164490b7ea506084777283b653d2622972afe4ab4b24919f12f54cb3e03fff483632543a202b4662b1056f6b20830f8bd0cdf2c48ee0f1ca966251d4c0ece6dc318a7b2da1c37204b7a699fd195b817f669c7060c958f2bddbb868aae4801325c7933833d65bc5a95a0cf"}, 0xa86, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f40)=@ipv6_newnexthop={0x5c, 0x68, 0x8, 0x70bd2d, 0x25dfdbff, {0xa, 0x0, 0x2, 0x0, 0x22}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_ID={0x8}, @NHA_GROUP_TYPE={0x6}, @NHA_OIF={0x8}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP_TYPE={0x6}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @ILA_ATTR_CSUM_MODE={0x5, 0x7, 0x2}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008000}, 0x800) (async) [ 349.390854] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 349.407304] erofs: read_super, device -> /dev/loop2 [ 349.413050] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 349.415390] erofs: read_super, device -> /dev/loop4 [ 349.421853] erofs: FAULT_INJECTION was not selected [ 349.461264] erofs: options -> acl, [ 349.464997] erofs: root inode @ nid 36 [ 349.470543] erofs: root inode @ nid 36 [ 349.474696] erofs: mounted on /dev/loop2 with opts: noacl. [ 349.486489] erofs: mounted on /dev/loop4 with opts: acl. 20:43:00 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:00 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x6, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:00 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@acl}]}) 20:43:00 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x399, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 349.545850] erofs: unmounted for /dev/loop4 [ 349.552798] erofs: unmounted for /dev/loop2 20:43:01 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 349.637756] 9pnet: Could not find request transport: xen [ 349.661637] erofs: read_super, device -> /dev/loop4 [ 349.691997] erofs: read_super, device -> /dev/loop2 [ 349.692073] erofs: read_super, device -> /dev/loop0 [ 349.700680] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 349.735114] erofs: options -> acl, [ 349.749093] erofs: root inode @ nid 36 [ 349.755391] erofs: FAULT_INJECTION was not selected [ 349.773618] erofs: mounted on /dev/loop4 with opts: acl. [ 349.781410] EXT4-fs: failed to create workqueue [ 349.786432] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 349.794498] erofs: root inode @ nid 36 [ 349.797145] EXT4-fs (loop5): mount failed [ 349.829028] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:01 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x39a, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 349.951520] erofs: unmounted for /dev/loop2 [ 349.996836] erofs: unmounted for /dev/loop4 [ 350.017852] erofs: FAULT_INJECTION was not selected [ 350.066564] 9pnet: Could not find request transport: xen 20:43:01 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:01 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x13ac}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f0000000300)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, 0x0) setregid(0x0, 0x0) r2 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2000}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockopt$PNPIPE_INITSTATE(r3, 0x113, 0x4, &(0x7f0000001280), 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000001240)={0x0, 0x0}, 0x10) setxattr$system_posix_acl(&(0x7f0000000340)='./file0\x00', &(0x7f00000020c0)='system.posix_acl_default\x00', 0x0, 0x34, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000300000000f000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b00000000020000280200000284", 0x62, 0x400}, {&(0x7f0000010400)="02000000030000000400000030000f", 0xf, 0x1000}, {&(0x7f0000010500)="ffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0x1002, 0x2000}, {&(0x7f0000012600)="ed41000000100000dbf4655fdcf4655fdcf4655f000000000000040008", 0x1d, 0x4200}], 0x0, &(0x7f0000013a00)) fstat(0xffffffffffffffff, &(0x7f0000002680)) syz_mount_image$ext4(0x0, &(0x7f00000011c0)='./file0\x00', 0x0, 0x3, &(0x7f0000002600)=[{&(0x7f0000001200)="9453f5ea5b1f6f469a3f90472ffa966fbbcbfb024fd070fc8c0c513f7ab7", 0x1e, 0x2}, {&(0x7f0000002140), 0x0, 0x7fffffff}, {0x0}], 0x1001000, &(0x7f0000002700)={[], [{@fowner_gt}, {@euid_lt}]}) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f00000012c0)='./file0\x00', 0x180, 0x2, &(0x7f00000014c0)=[{&(0x7f0000001300)="54e8421b5bff9a833734f00317a63c4cd18909d835d6124ad91088c12d93276fcc8ac831241fa9ee59c59a3757fd016288733128979f66b7fb546516234e1691654383400dfbf4ff82b03c35b922a15925e6cc26d093d06933389294530018ffaa41e009a338ef2eac41fb0f6895ffed585ac497a3366245125b11d70ee1313ebb90bdc1f7ad11e7f3ca253c6a0ef3d99e78f508c1d65a76cbfbd023292bda997567c71535f84d64e190c10c05e7d95f24a789793e", 0xb5, 0x9}, {0x0, 0x0, 0xffffffffffffffff}], 0x104800, &(0x7f0000001640)={[{@mblk_io_submit}], [{@appraise}, {@smackfsfloor={'smackfsfloor', 0x3d, 'ext4\x00'}}, {@euid_lt={'euid<', r1}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@appraise}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@fsname={'fsname', 0x3d, 'euid'}}]}) setxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), &(0x7f00000034c0)=ANY=[@ANYBLOB="00fb1600006c09ecfa2d815613e88c55159d7bde328b9314c8d1dc44832863a17d12ec2253589e73b5c026fe20b4f2bc4d6745fad01b0041044fe001ec106e50dfacc64cf2bcc833d311dba624b3230f03e9314c67d4fab8a9c195da879993bc0576be338045c6f7ebec34525327dee2513fcfc161aba086c36bcc7ff841837a13db49d1a6a292803b5f2607697305c8efff328aa4add29c3d5a9b355d529e9c19acc03ecbd5ac4f5c2bac6e7c8fb53753c2d1981083b782a10eec2776574195989a709fa4e083f8f3b87c5f6ddbef3dc977cbe84d2fbca58a518b051f76eab38a082aab990b8ac4d07549d1ec109f732478290e3cb60b154a1edd1a85544391bca7da8dcfcc205cf3038f42c0e8722eca37128b07d107d985f7250de5d54682f6244e739ec8f4ed8bf77a5a20d8ec27bc7286d9018ab8de38981aa87f0c6c0fd46f1f73763b743d3e1207289334562590fcf2ab2766850d052489841441e9574ce821cfbf7b1dfadd61b503aa7623a9c664360c5358bf102dfa0d3e552bf387fdc8dc873f4b59bddce9beb00e74a189de0258ff7276dba0757d3086a284359f9ce0195d08492edc817127ec99e7e33b74d7ec6b32dd4c9f882d9748dbc99b97d24114a39f2210cecafc36b91988a4bddf1d2b7c7e647dfa9f88da6549a26eb55c917479061e6674fc4224dd35e8924be5e61d114604a138069c02db7ea9033fa665fdb8950ee87935d76672072d8523f526e11fde80b5cba875672aa7b9dc6078caf3eb6d806bd4ff7f8198da138906007ce45099e0523184f8200f89629d3f1abefaa12afa59d7e0c0674dfeb60138d94c34a224e95eded0d1e34561386b945e3c7cc0ac3b2d77d0ddaa7911a01aed5b6159c411baed6533bce1ce76985017762aa996d79b82b29d514d28db106ffe5d1e561804f54ea7884d8b3d158510bdd08bb59955adee054130bedeaf9b2d26f21b7d0bce325933821c3cc973a2795c1421ec3b0b1957292c3bf43ff83f0ef102155ac2dc1a4c55f0ed70c9b3614b3896e021f117c3a80c2aae09092bcd3bc634017fffc154f8aa21394431b63c100f19298de204b27a77a00681a207506ad1eb03e97f81e9d1671d026186e0b551252eed4f7d12d0480616e7b17d16aea3418dba6ff29520404f77d67581eac956f80ae36a1e5e07a92c32e69d4dd676c5b63daa80c656fd222f4b406db28a399c14267f3dea94879aecad9cf13f3964c7ae5447afab8be34db87fa1e483fe09c628d231a8dbbb35096004fbb0cf5a6e13ab374f17d05249215ba4280a2c61732b187d698b66ec7314c21ec4c2c97c288d395104e2db29529f992da8b6cbe4d425b23b3304d457b75328a40b3936a6d5587c068a449501704f637c85fb046df24c4c462e09e1bfa5f7d3943b462da69c1ffc460a82aad0191ba77fa18aaa7ea9fdc168b9361e9ca16d56b36a6821b22764fda8000dc857db9ee5aa7e53202b35e7b3acb59f8151c3fd74063f132f51dceb0b3fb7920d5d2ffbc4847a65ab1d9f88088b2f28254f2695ba55deb705429db7d3167158676083e5df15c4318333f4870cbbdee2866259d8a1d84f7f141887f232230ff973c2fbfaa21933c0e7661b83a52e0a135820f20ef4725b025c4ef1f433a93d05a75a3ccee3748d02b14b3ebfad8b8a819bc97358abbe516725ea5b145612d7416b264b52e49301092301e7bceb75cec58e1657ca7076d721c76cfec1811394f7158f451c87e586dab0cff7eccea7af211b308422edb5caadd615dcf0a96b9d460dd60e4d802120795bb3b659ef88fca4d758be1f5dd83d7f3946accfefdde5c50551f586fe73ef33dcc42b84781e943b18e2ae05cb209ebe4b5f3a26eac806777b9c9e18ee617609c6909d1581eb60a9a9d1053c26738e8491795865bd090b2fe97948d1b6f49a0f6e4253add1fda4545c19dafb86e5966739d39ec57310a45d646f33c0f6a339d560c96aad2120738d0b430a011189cab1d795095c11609efda879614286cbe7ddec26a4e9ff17135c63af046800ca11dbd82711f4fc570b50d799eba2a4ec2b04f15e87703bd54fc1d5f3c137ff8185414387c995113225795072630f49125b5b1fd0322793b2bb6fb24b99a521829555341ee2a2241dbe80746452dfd715bff60f4a40f56e12f6043381ebd06b44e3eaf68340efaaf36ad7cd2af8574d068e09640d6b5f0a22e1ba1dbca51e2b0aac25dab11ca88a0262293d89321181501ba32b3dac866c19d2e836209472ad2aa8a4af62af995b8c6d0b79c3edadbbc7fd38033a761ace773f2acb8ae79f84205cbcc296a65055d10b6cab38b8c0a50539b6926ebb517228af26af276da8c635b769273db475ecd8b281ea3b3fcf858bef76ce761e11e84088c44ccf0e1b986483ed1f8ade7800716f7bbde795e37ec5fc950fcdae1eafda3991b231728c7bf36c3f1d7950ba934bcec383d0ed635033426ca85e0b6ec41b467d9943805881a414b8aa11c566d0d1b763caef197d19af8546a173dd8f2eae9f5a49e7bdfe9e287de4e16a5f96074553622a7fd3d0646d4e07ebdd402c6579b8f8ed25f468ce2427567563cfec729e1af74a62d92c03b1e45df4d29deb4f3a247e5ac1ab1fc74bfef2b8082d55f20a5fdfbe456e1493cda4035766bc9f215730456338e34b85f847377eaf0965f7b43c457bc011e61273543980ee1a1e6fea0c244e593d83e144c38416cc94a519799f2bc34d405b0a3d3f7df9c45236604d815c52f0776542141080ef27dcdc1af36f723e95a0c5103274f12f7237af76a4c5cb9498e21bc9142c3568ad93222e54389d01e6f16830b5c9cc09872671da06d8da068ed1ffed1be41902b1ba1cce6318eef7fb850624698101df4ffac57de42d1b13ce581a472b8a5e6db267dae639ff76f3348a61ebc92d6f4368da9a6c56062955ecb6d352e9af918eb473515f8bf2096b51353d7b2a804627a88a629f2e0ecd42e307faaf9807197cd775c1090dba98e2ada1833587410d3cf9fd9b68e80e9361aa16da5877b79a87985667938c2ffe6f5b8f30511301ab45ea0e1488d96e18583e590120df3cf0bf992feb9d96a421d2134aad816bbed4fde7eec2c25301beec61d64c57c0ed86b2e2efe0a95daec2ce57fb1f3f9e322d404d13ba6641aa535a1d3afd263425e66dee3687d5c38d80811170034d58872002cbbfa323fe064bde7ae7c46e8eb89ee71ef00abefc124a8d87c315465d578adc92b28f20c3a35c572765be05171d6ba756a18bbdc7fb36ec5feb02a8b2d6df43c0992b1cd117b420cbb2a765c1055557094ae894226de63a1a8afa43500706945657ef9a23376da5088c4cebaab7e18fe32b57ec0e5b345692d8bc5c6021aa34dfa88d5a66a370a867037fa0ac3fabb26b22779b9004e1bc4b3912357a7a47a67ea378c8c4bbe04b851d2363c45e55786a770e14d781b3a2d0b9bbdb4de2eed51c8d018988e5df45506e0b59a0320ad3ef9ff7ef17460b1ecb201cba6b53bb2ab63a559c497f06f313bb33028a232a7477cbc251e1395e8fa099fb0f0c46983aa66f24a2f432778da560c940d13acbe487e18c38c9187fea093d3505ca99f5dd6518b55cf45d5fcce9dab48caca06c9b5d82d96cfcde96cbca66fa5ecb2750df998613c36c3e9ffbb7f483e4c47beb0c782947be3f006bedbdcc9999cdf1ba1f2412d10f06fd74be142019cb423d23eaae5809aab6f29b85940087d1f2ce206391c27a52b28c3f6271a5a61477a74d34924d5bf5344ddd701f5b380a019708d921af8b5236fc5be7e5a025c908cc64f7370d58eb192346d255f06f58a04088d5bf9120997776b0c170139dc3d5fd7bf5ef9965764b91f399dd331cacdcd6b94be02c99f48b802e19b22dcb3294c3cb73c43dd2ab04dc0b35f28217c333dc372c20bcb6d1d85412cde8a1b9da4bfd05326a910cbb4715048bd753e134ffa537b3d349a4df3a8804e1c15595f5f2504bd7cd45c1120ab72bb7c7091a52bed9e0b9ae17e81a165039b406c88c2e84b1943f15215cd750edbfb06bbb41db6be57eb7cb1b4d45c48adee6d5823b27516bd8d9102fd0ce22508afc8229677723cd1ab59d3d79cc4d134ac3ea52069fef5d7677041d80424de8789f4d744d58ea57ea0dcebe692c0c1ace92ebc6c0f91057ef12230a43aec01c367572dfe475d10f61ba4f26a87c2387c94f5ea1db190f82d06b01177e2ff4abcd42992c70fde480315b9d7cf3cb1abb395b9d5dd3c8eb8888256e58c829f96c3d7952c5624a173c059767e427905216e6dc218854a1a42fd08e538bf7e287a47c07bd39d222bf6b1a95a0265a54f9e2ac826709782752ca38bc2545a7d002dd0f0049ae7a011223e20a9110ab3f73fa0ca575e94e588571dbb45475dfd94d01d798741cec3bae3ac35009c87b651035fb121637c905995754165e4475e8240a8705c047493df1c58bc52c811c74d636b513189068773776a976aae4df1529e5b1d1c73f3c0ffd18e0ed80ede33093d15811d4d6636337167da82d78d62a75bb608eeacb761424f51949000000008ea97cdc8acabde95e400eb2d36ad0e42b2824cb60ea40837aa8deb9ad2ea27016b4bb4611abe7983d7cddab"], 0xe16, 0x0) sendmsg$nl_route(r3, &(0x7f0000000ec0)={&(0x7f0000000080), 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)=@ipv6_newroute={0x1c, 0x18, 0x2, 0x70bd29, 0x25dfdbfb, {0xa, 0x0, 0x20, 0x1f, 0x7d, 0x0, 0xff, 0xc, 0x600}}, 0x1c}, 0x1, 0x0, 0x0, 0x20040084}, 0x4001) open$dir(&(0x7f0000000280)='./file0\x00', 0x0, 0x128) setxattr$trusted_overlay_upper(&(0x7f0000001700)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000380)={0x6, 0xfb, 0xa86, 0x4, 0x0, '\x00', "8dfa95f490b5c29ff9389f224c1d0f8d82b5401c68b18752f1f24810951641b2d28aa470a5fec7cc1cabfbdc679b6581b170cb2963e4d4421cf7cf61bf2e91106a5ccf86ced704dd5a91ce8fb6fa3bd4f0264986d9029c368058c1e293fdeab2ecadd3a1ccd738982be05e6527994f4d77691586962fb2ae58e80d061dbba03c9a595ffd4fb2788cd2a8e6147bf811fed93b0583e9ccd11df48aff0b5e0fc187392aa58728bbb313b8de8064e11cf658d4bb435e975574075faaae14529f47d687b1178c084e23c07574ca6d52155b5710231f80b96d6e3f99a05008ff65fc5a88242e8c12cf627442215a5eac9c07457af4980fb3cff8e999c94b6a95bb86457a9d71f139c054c26c88591fefa00524a080ffea5e29a99539b2beacc330b9c4c787e8adb5cf3e1dc30e877e2df587d44e9f2b204a99d914651fb183f816760ae3075916630905f52ddea2dad60a27da4650af5d05443215f78a826fd0599d12a4d9fabe4a3778ea20893b1afa01b78753cd758899b74aaad16b3f573eb2f39153b8c5cd0cbcd06274a462773e3f52bafe685084f9e482a3258cd3aedb1504cc0dcd567917600e564ff2d2fe8fb4afcd235db6db4fcda2b8f53798039f73dbd10b8c2f99697743a5b78a141f18a831aa794dd9430e2ab8b596e3d78e59d6763a86b0885e8f627002a5d77eac470fb685a4f7814b130fa4a7e5e66b3e6e3fae7bf31321c9f8858d8996c56391e41ed62fa28b4db74582f7578bc22266a64476654a23aa3878cc4e4b1c2d961f6e223498e0937572c7db8e6265063101cab017a65a7c77a503fec556060f8102caa95c5a23eebcdd3d1897f05f1328acae7446b5d5db454013c7e42c4d96accf8ddfe71fc7e5f56370d18a69dc699ad1303cb38a11f83d1a8660846755cd47a7f3a433a4011ee128b1e1ffec5a440621a6d044bd17ceee1f5cfec1dd35f41b89a816eaf5f25754307cb3968eae10d566fb79679c7af6ff82b28766cd99539dc09cefc0523a2112c5c81b269c8ec59131dbb9e5cb04d94b28f586b68b5d7df852866ad550768b34712a6080648ca5e3ddbb0996f0b0497ea907c6225d86664a4d5a659782373672b91e6c8ded3445dab6302bf55de0ba17560668426dcc562f757b019c878969a364a5e60be8eb6c3595846b7cbdbd0e1f88422a50d083bf65dd9dd2f5919bf38c2a74fce75f20517a17be51efd6f794e0f59e91da0478b833184db399e635d5c6a469bd5d1dde0c426fff46a4aea7af93ab32afef4d7864e7c7c6b81001293d1888b45f75e98707513fbd69ae16ac5b344532b7d62dcbfc1edc2bceab8a0ec62bf4638f13b968b764ece346288fceec159e68f49db618ea2ad067b301bb69ef7f983afd323738d9abdc729080130b00ee1e82997e9a41f03dd0712d73e334555e440d782adc17302bd3688b37e21dcc044cd139b7cf575ea372916ad6b94e6624cd77a97f18941e69eac13636a30e66cfdb31621145784864f25e61d66eabbafd2580bf1dd950a3e4884bf23c223711c833c715e8b1bf6a187da53bf021b53e5a3297e6d235b6effdd41c4b4de8a5bdbc84b002857e2483e35f3594809261454b257896e966c69b1fd95cc319e309e00e3f70b708794b742bb19234df85411c225b86c0115454a965b278dd5f6a7ea0e21c8679b57bf9090a1ce919c4d1056839725dcaa73640f3a9cc517284806653063fbb48bb614f1587f1cccb65f074c4508670f25e7a1fb3bb5b0c1a3d13b3a70a05f9be65880580809e80a5358132ed29a0ff8286d8de4812e4a0b5eb8bb12374ba43cf555fd033b9d4e95280293971fc81ff68c866df2cc49fecf90651b04de9d755dd77186b31de06d9828971c4202b98f757ffa00b0a7a3fab432dda48f6e3f2ac364a7a5749f56bf32142b2ad6c82f394477a7556a247d4863b2ba06b33e862f9ba43599c013d5739b3ce841e1776dbf03ef0b9c3fe3a138b2af1604c789b528dba03b5bdf6109adaf94aa24dad44b3257ca0f4e6800aaf1c0ef19c9461a56486d6909514b98603846d6ffb5d0acb57186dd9d6cd7420c86dd9f0bb66e55dd70438cf20ee740cf780ea58b9562df870fc18659a6d9185873870790c9f087082365f40d7de077b81131d1b6651cc2fbe656fa7ed8f56c03d082fbce1dc67325c57d5af51d5fd243eb34b3ff952dd17d84a5688be17341f9d1a12e14f164f1065769d1ee1500afd2b52eeb470412fe623d58815b0f1170d519659959471b23fae3175f1409148daeb6d1f27622fa63bf06ad61362aa831c5ef62a03607eb2b8542c4b17d1d3f915d93f5df579068f015f0c78d2d87805ebfe8e6f57ddeaeef2a73e0283680227f1987561999d1a4a9e1b11ab945458a17f5c8d161b82b416e00bc90d2d5f5efffeafea0c30a6dbef943d4a580c4785118da34fd15514b81a8e7b5a9eebfe59b0d3565ded6c5200b20bd56eed9f95bb0e4d68bb99ce629a646c69270492b00e984317bb17f6bb29c264f64347b4948044b9f35f72889a0733e9b5381beaa1f69a72aa57cc00c24916d98f26fe0cf0457ec975b037cca64d581dd32005b7d7d39f26eb688002561366d68057d4183e940b6509468f0268174b35e0e13a101a3071b58df7cbdbc7819b523e30b74ed088a32c7ba159abd986a4607ebfc036e396645705b076543dd27b33b7bcf5b2f7fe989902d346aea6c7ef67573c83903e09570bc48017e01bfe1686e9fe3da28e727d679ddca33ce193fd3c4a525c25eb9d4e0d727dd0c9c9ee3709755344828402a6d384ea16ad9bdac4518df78eb1a848c269c7571d56742c2ff67fba4a57aefc93c45f814e4eb8cb9c04989072a25c8ccca82862053c1c0fde1891e5c8f8783118485f25adb48a1dce26eacdd4ddc84d07473d61cf6ee6a4d28b022311f1b7151763e083488866a8a7edddc8f61ffb6451764a6008f022d346c819ec86a0256958265e5ce28da25f84e90cdf97abf746108d782661f5533547099a4f8928a071f0afbebcb4acb82eb3f8aa14df0823ceade1dfc7e052fdb79d7dabd5477f4d18b602721892c56a8de2e0a955dbd60201fbc4ebf088b6efd6ad133cdf5134825517a8a21e16ab52ce3dc4b75ff07e33d74d68d5bd04056c88cfeea72065bed06eb9ac039d8130477ca68b36c06a15567e178012e2e090b42bdc235e05ca662aae33c1f736aefb41621ed734813db359d6ee2c3ac01aec680369b7164325c6fbfe0b28363f7d88f132f0eae29f132757772fc7336c5554907ab10b7143da1b62d9dbaa960fb7e32700334ee6a00f0f4b68e86dc0cdf09a8919b37d5cca678cdb09b1ba31e32e6a8a873faff01e7e37aebdac6fe276539eb764c37b2c54942b2c3bff04ecebaffbfd871efd41b6392a1e3be49a078abd76f6ce08431ea920d04ea2972291169487a056d4719eb08c1f52ed3ea26af31ae9d9d16463387e6e1a6b0d66040a7af2f0ce3a0b8df477f06c64f30ba59f6dfade2cee217cf56fadc107d603c80a2e68dd8b11e84dad6857495435c6bf5d7af2bf02c3b05e472b736114ef171a5358908657a4923460e295097081baf8410e17c9fa58e908d67124cc25d73e8c09ddfdfc7f663fb40a72691164490b7ea506084777283b653d2622972afe4ab4b24919f12f54cb3e03fff483632543a202b4662b1056f6b20830f8bd0cdf2c48ee0f1ca966251d4c0ece6dc318a7b2da1c37204b7a699fd195b817f669c7060c958f2bddbb868aae4801325c7933833d65bc5a95a0cf"}, 0xa86, 0x0) sendmsg$nl_route(r3, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f40)=@ipv6_newnexthop={0x5c, 0x68, 0x8, 0x70bd2d, 0x25dfdbff, {0xa, 0x0, 0x2, 0x0, 0x22}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_ID={0x8}, @NHA_GROUP_TYPE={0x6}, @NHA_OIF={0x8}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP_TYPE={0x6}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @ILA_ATTR_CSUM_MODE={0x5, 0x7, 0x2}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008000}, 0x800) [ 350.108490] erofs: root inode @ nid 0 [ 350.113345] erofs: bogus i_mode (0) @ nid 0 20:43:01 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x13ac}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f0000000300)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, 0x0) setregid(0x0, 0x0) r2 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2000}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockopt$PNPIPE_INITSTATE(r3, 0x113, 0x4, &(0x7f0000001280), 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000001240)={0x0, 0x0}, 0x10) setxattr$system_posix_acl(&(0x7f0000000340)='./file0\x00', &(0x7f00000020c0)='system.posix_acl_default\x00', 0x0, 0x34, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000300000000f000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b00000000020000280200000284", 0x62, 0x400}, {&(0x7f0000010400)="02000000030000000400000030000f", 0xf, 0x1000}, {&(0x7f0000010500)="ffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0x1002, 0x2000}, {&(0x7f0000012600)="ed41000000100000dbf4655fdcf4655fdcf4655f000000000000040008", 0x1d, 0x4200}], 0x0, &(0x7f0000013a00)) fstat(0xffffffffffffffff, &(0x7f0000002680)) syz_mount_image$ext4(0x0, &(0x7f00000011c0)='./file0\x00', 0x0, 0x3, &(0x7f0000002600)=[{&(0x7f0000001200)="9453f5ea5b1f6f469a3f90472ffa966fbbcbfb024fd070fc8c0c513f7ab7", 0x1e, 0x2}, {&(0x7f0000002140), 0x0, 0x7fffffff}, {0x0}], 0x1001000, &(0x7f0000002700)={[], [{@fowner_gt}, {@euid_lt}]}) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f00000012c0)='./file0\x00', 0x180, 0x2, &(0x7f00000014c0)=[{&(0x7f0000001300)="54e8421b5bff9a833734f00317a63c4cd18909d835d6124ad91088c12d93276fcc8ac831241fa9ee59c59a3757fd016288733128979f66b7fb546516234e1691654383400dfbf4ff82b03c35b922a15925e6cc26d093d06933389294530018ffaa41e009a338ef2eac41fb0f6895ffed585ac497a3366245125b11d70ee1313ebb90bdc1f7ad11e7f3ca253c6a0ef3d99e78f508c1d65a76cbfbd023292bda997567c71535f84d64e190c10c05e7d95f24a789793e", 0xb5, 0x9}, {0x0, 0x0, 0xffffffffffffffff}], 0x104800, &(0x7f0000001640)={[{@mblk_io_submit}], [{@appraise}, {@smackfsfloor={'smackfsfloor', 0x3d, 'ext4\x00'}}, {@euid_lt={'euid<', r1}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@appraise}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@fsname={'fsname', 0x3d, 'euid'}}]}) setxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), &(0x7f00000034c0)=ANY=[@ANYBLOB="00fb1600006c09ecfa2d815613e88c55159d7bde328b9314c8d1dc44832863a17d12ec2253589e73b5c026fe20b4f2bc4d6745fad01b0041044fe001ec106e50dfacc64cf2bcc833d311dba624b3230f03e9314c67d4fab8a9c195da879993bc0576be338045c6f7ebec34525327dee2513fcfc161aba086c36bcc7ff841837a13db49d1a6a292803b5f2607697305c8efff328aa4add29c3d5a9b355d529e9c19acc03ecbd5ac4f5c2bac6e7c8fb53753c2d1981083b782a10eec2776574195989a709fa4e083f8f3b87c5f6ddbef3dc977cbe84d2fbca58a518b051f76eab38a082aab990b8ac4d07549d1ec109f732478290e3cb60b154a1edd1a85544391bca7da8dcfcc205cf3038f42c0e8722eca37128b07d107d985f7250de5d54682f6244e739ec8f4ed8bf77a5a20d8ec27bc7286d9018ab8de38981aa87f0c6c0fd46f1f73763b743d3e1207289334562590fcf2ab2766850d052489841441e9574ce821cfbf7b1dfadd61b503aa7623a9c664360c5358bf102dfa0d3e552bf387fdc8dc873f4b59bddce9beb00e74a189de0258ff7276dba0757d3086a284359f9ce0195d08492edc817127ec99e7e33b74d7ec6b32dd4c9f882d9748dbc99b97d24114a39f2210cecafc36b91988a4bddf1d2b7c7e647dfa9f88da6549a26eb55c917479061e6674fc4224dd35e8924be5e61d114604a138069c02db7ea9033fa665fdb8950ee87935d76672072d8523f526e11fde80b5cba875672aa7b9dc6078caf3eb6d806bd4ff7f8198da138906007ce45099e0523184f8200f89629d3f1abefaa12afa59d7e0c0674dfeb60138d94c34a224e95eded0d1e34561386b945e3c7cc0ac3b2d77d0ddaa7911a01aed5b6159c411baed6533bce1ce76985017762aa996d79b82b29d514d28db106ffe5d1e561804f54ea7884d8b3d158510bdd08bb59955adee054130bedeaf9b2d26f21b7d0bce325933821c3cc973a2795c1421ec3b0b1957292c3bf43ff83f0ef102155ac2dc1a4c55f0ed70c9b3614b3896e021f117c3a80c2aae09092bcd3bc634017fffc154f8aa21394431b63c100f19298de204b27a77a00681a207506ad1eb03e97f81e9d1671d026186e0b551252eed4f7d12d0480616e7b17d16aea3418dba6ff29520404f77d67581eac956f80ae36a1e5e07a92c32e69d4dd676c5b63daa80c656fd222f4b406db28a399c14267f3dea94879aecad9cf13f3964c7ae5447afab8be34db87fa1e483fe09c628d231a8dbbb35096004fbb0cf5a6e13ab374f17d05249215ba4280a2c61732b187d698b66ec7314c21ec4c2c97c288d395104e2db29529f992da8b6cbe4d425b23b3304d457b75328a40b3936a6d5587c068a449501704f637c85fb046df24c4c462e09e1bfa5f7d3943b462da69c1ffc460a82aad0191ba77fa18aaa7ea9fdc168b9361e9ca16d56b36a6821b22764fda8000dc857db9ee5aa7e53202b35e7b3acb59f8151c3fd74063f132f51dceb0b3fb7920d5d2ffbc4847a65ab1d9f88088b2f28254f2695ba55deb705429db7d3167158676083e5df15c4318333f4870cbbdee2866259d8a1d84f7f141887f232230ff973c2fbfaa21933c0e7661b83a52e0a135820f20ef4725b025c4ef1f433a93d05a75a3ccee3748d02b14b3ebfad8b8a819bc97358abbe516725ea5b145612d7416b264b52e49301092301e7bceb75cec58e1657ca7076d721c76cfec1811394f7158f451c87e586dab0cff7eccea7af211b308422edb5caadd615dcf0a96b9d460dd60e4d802120795bb3b659ef88fca4d758be1f5dd83d7f3946accfefdde5c50551f586fe73ef33dcc42b84781e943b18e2ae05cb209ebe4b5f3a26eac806777b9c9e18ee617609c6909d1581eb60a9a9d1053c26738e8491795865bd090b2fe97948d1b6f49a0f6e4253add1fda4545c19dafb86e5966739d39ec57310a45d646f33c0f6a339d560c96aad2120738d0b430a011189cab1d795095c11609efda879614286cbe7ddec26a4e9ff17135c63af046800ca11dbd82711f4fc570b50d799eba2a4ec2b04f15e87703bd54fc1d5f3c137ff8185414387c995113225795072630f49125b5b1fd0322793b2bb6fb24b99a521829555341ee2a2241dbe80746452dfd715bff60f4a40f56e12f6043381ebd06b44e3eaf68340efaaf36ad7cd2af8574d068e09640d6b5f0a22e1ba1dbca51e2b0aac25dab11ca88a0262293d89321181501ba32b3dac866c19d2e836209472ad2aa8a4af62af995b8c6d0b79c3edadbbc7fd38033a761ace773f2acb8ae79f84205cbcc296a65055d10b6cab38b8c0a50539b6926ebb517228af26af276da8c635b769273db475ecd8b281ea3b3fcf858bef76ce761e11e84088c44ccf0e1b986483ed1f8ade7800716f7bbde795e37ec5fc950fcdae1eafda3991b231728c7bf36c3f1d7950ba934bcec383d0ed635033426ca85e0b6ec41b467d9943805881a414b8aa11c566d0d1b763caef197d19af8546a173dd8f2eae9f5a49e7bdfe9e287de4e16a5f96074553622a7fd3d0646d4e07ebdd402c6579b8f8ed25f468ce2427567563cfec729e1af74a62d92c03b1e45df4d29deb4f3a247e5ac1ab1fc74bfef2b8082d55f20a5fdfbe456e1493cda4035766bc9f215730456338e34b85f847377eaf0965f7b43c457bc011e61273543980ee1a1e6fea0c244e593d83e144c38416cc94a519799f2bc34d405b0a3d3f7df9c45236604d815c52f0776542141080ef27dcdc1af36f723e95a0c5103274f12f7237af76a4c5cb9498e21bc9142c3568ad93222e54389d01e6f16830b5c9cc09872671da06d8da068ed1ffed1be41902b1ba1cce6318eef7fb850624698101df4ffac57de42d1b13ce581a472b8a5e6db267dae639ff76f3348a61ebc92d6f4368da9a6c56062955ecb6d352e9af918eb473515f8bf2096b51353d7b2a804627a88a629f2e0ecd42e307faaf9807197cd775c1090dba98e2ada1833587410d3cf9fd9b68e80e9361aa16da5877b79a87985667938c2ffe6f5b8f30511301ab45ea0e1488d96e18583e590120df3cf0bf992feb9d96a421d2134aad816bbed4fde7eec2c25301beec61d64c57c0ed86b2e2efe0a95daec2ce57fb1f3f9e322d404d13ba6641aa535a1d3afd263425e66dee3687d5c38d80811170034d58872002cbbfa323fe064bde7ae7c46e8eb89ee71ef00abefc124a8d87c315465d578adc92b28f20c3a35c572765be05171d6ba756a18bbdc7fb36ec5feb02a8b2d6df43c0992b1cd117b420cbb2a765c1055557094ae894226de63a1a8afa43500706945657ef9a23376da5088c4cebaab7e18fe32b57ec0e5b345692d8bc5c6021aa34dfa88d5a66a370a867037fa0ac3fabb26b22779b9004e1bc4b3912357a7a47a67ea378c8c4bbe04b851d2363c45e55786a770e14d781b3a2d0b9bbdb4de2eed51c8d018988e5df45506e0b59a0320ad3ef9ff7ef17460b1ecb201cba6b53bb2ab63a559c497f06f313bb33028a232a7477cbc251e1395e8fa099fb0f0c46983aa66f24a2f432778da560c940d13acbe487e18c38c9187fea093d3505ca99f5dd6518b55cf45d5fcce9dab48caca06c9b5d82d96cfcde96cbca66fa5ecb2750df998613c36c3e9ffbb7f483e4c47beb0c782947be3f006bedbdcc9999cdf1ba1f2412d10f06fd74be142019cb423d23eaae5809aab6f29b85940087d1f2ce206391c27a52b28c3f6271a5a61477a74d34924d5bf5344ddd701f5b380a019708d921af8b5236fc5be7e5a025c908cc64f7370d58eb192346d255f06f58a04088d5bf9120997776b0c170139dc3d5fd7bf5ef9965764b91f399dd331cacdcd6b94be02c99f48b802e19b22dcb3294c3cb73c43dd2ab04dc0b35f28217c333dc372c20bcb6d1d85412cde8a1b9da4bfd05326a910cbb4715048bd753e134ffa537b3d349a4df3a8804e1c15595f5f2504bd7cd45c1120ab72bb7c7091a52bed9e0b9ae17e81a165039b406c88c2e84b1943f15215cd750edbfb06bbb41db6be57eb7cb1b4d45c48adee6d5823b27516bd8d9102fd0ce22508afc8229677723cd1ab59d3d79cc4d134ac3ea52069fef5d7677041d80424de8789f4d744d58ea57ea0dcebe692c0c1ace92ebc6c0f91057ef12230a43aec01c367572dfe475d10f61ba4f26a87c2387c94f5ea1db190f82d06b01177e2ff4abcd42992c70fde480315b9d7cf3cb1abb395b9d5dd3c8eb8888256e58c829f96c3d7952c5624a173c059767e427905216e6dc218854a1a42fd08e538bf7e287a47c07bd39d222bf6b1a95a0265a54f9e2ac826709782752ca38bc2545a7d002dd0f0049ae7a011223e20a9110ab3f73fa0ca575e94e588571dbb45475dfd94d01d798741cec3bae3ac35009c87b651035fb121637c905995754165e4475e8240a8705c047493df1c58bc52c811c74d636b513189068773776a976aae4df1529e5b1d1c73f3c0ffd18e0ed80ede33093d15811d4d6636337167da82d78d62a75bb608eeacb761424f51949000000008ea97cdc8acabde95e400eb2d36ad0e42b2824cb60ea40837aa8deb9ad2ea27016b4bb4611abe7983d7cddab"], 0xe16, 0x0) sendmsg$nl_route(r3, &(0x7f0000000ec0)={&(0x7f0000000080), 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)=@ipv6_newroute={0x1c, 0x18, 0x2, 0x70bd29, 0x25dfdbfb, {0xa, 0x0, 0x20, 0x1f, 0x7d, 0x0, 0xff, 0xc, 0x600}}, 0x1c}, 0x1, 0x0, 0x0, 0x20040084}, 0x4001) open$dir(&(0x7f0000000280)='./file0\x00', 0x0, 0x128) setxattr$trusted_overlay_upper(&(0x7f0000001700)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000380)={0x6, 0xfb, 0xa86, 0x4, 0x0, '\x00', "8dfa95f490b5c29ff9389f224c1d0f8d82b5401c68b18752f1f24810951641b2d28aa470a5fec7cc1cabfbdc679b6581b170cb2963e4d4421cf7cf61bf2e91106a5ccf86ced704dd5a91ce8fb6fa3bd4f0264986d9029c368058c1e293fdeab2ecadd3a1ccd738982be05e6527994f4d77691586962fb2ae58e80d061dbba03c9a595ffd4fb2788cd2a8e6147bf811fed93b0583e9ccd11df48aff0b5e0fc187392aa58728bbb313b8de8064e11cf658d4bb435e975574075faaae14529f47d687b1178c084e23c07574ca6d52155b5710231f80b96d6e3f99a05008ff65fc5a88242e8c12cf627442215a5eac9c07457af4980fb3cff8e999c94b6a95bb86457a9d71f139c054c26c88591fefa00524a080ffea5e29a99539b2beacc330b9c4c787e8adb5cf3e1dc30e877e2df587d44e9f2b204a99d914651fb183f816760ae3075916630905f52ddea2dad60a27da4650af5d05443215f78a826fd0599d12a4d9fabe4a3778ea20893b1afa01b78753cd758899b74aaad16b3f573eb2f39153b8c5cd0cbcd06274a462773e3f52bafe685084f9e482a3258cd3aedb1504cc0dcd567917600e564ff2d2fe8fb4afcd235db6db4fcda2b8f53798039f73dbd10b8c2f99697743a5b78a141f18a831aa794dd9430e2ab8b596e3d78e59d6763a86b0885e8f627002a5d77eac470fb685a4f7814b130fa4a7e5e66b3e6e3fae7bf31321c9f8858d8996c56391e41ed62fa28b4db74582f7578bc22266a64476654a23aa3878cc4e4b1c2d961f6e223498e0937572c7db8e6265063101cab017a65a7c77a503fec556060f8102caa95c5a23eebcdd3d1897f05f1328acae7446b5d5db454013c7e42c4d96accf8ddfe71fc7e5f56370d18a69dc699ad1303cb38a11f83d1a8660846755cd47a7f3a433a4011ee128b1e1ffec5a440621a6d044bd17ceee1f5cfec1dd35f41b89a816eaf5f25754307cb3968eae10d566fb79679c7af6ff82b28766cd99539dc09cefc0523a2112c5c81b269c8ec59131dbb9e5cb04d94b28f586b68b5d7df852866ad550768b34712a6080648ca5e3ddbb0996f0b0497ea907c6225d86664a4d5a659782373672b91e6c8ded3445dab6302bf55de0ba17560668426dcc562f757b019c878969a364a5e60be8eb6c3595846b7cbdbd0e1f88422a50d083bf65dd9dd2f5919bf38c2a74fce75f20517a17be51efd6f794e0f59e91da0478b833184db399e635d5c6a469bd5d1dde0c426fff46a4aea7af93ab32afef4d7864e7c7c6b81001293d1888b45f75e98707513fbd69ae16ac5b344532b7d62dcbfc1edc2bceab8a0ec62bf4638f13b968b764ece346288fceec159e68f49db618ea2ad067b301bb69ef7f983afd323738d9abdc729080130b00ee1e82997e9a41f03dd0712d73e334555e440d782adc17302bd3688b37e21dcc044cd139b7cf575ea372916ad6b94e6624cd77a97f18941e69eac13636a30e66cfdb31621145784864f25e61d66eabbafd2580bf1dd950a3e4884bf23c223711c833c715e8b1bf6a187da53bf021b53e5a3297e6d235b6effdd41c4b4de8a5bdbc84b002857e2483e35f3594809261454b257896e966c69b1fd95cc319e309e00e3f70b708794b742bb19234df85411c225b86c0115454a965b278dd5f6a7ea0e21c8679b57bf9090a1ce919c4d1056839725dcaa73640f3a9cc517284806653063fbb48bb614f1587f1cccb65f074c4508670f25e7a1fb3bb5b0c1a3d13b3a70a05f9be65880580809e80a5358132ed29a0ff8286d8de4812e4a0b5eb8bb12374ba43cf555fd033b9d4e95280293971fc81ff68c866df2cc49fecf90651b04de9d755dd77186b31de06d9828971c4202b98f757ffa00b0a7a3fab432dda48f6e3f2ac364a7a5749f56bf32142b2ad6c82f394477a7556a247d4863b2ba06b33e862f9ba43599c013d5739b3ce841e1776dbf03ef0b9c3fe3a138b2af1604c789b528dba03b5bdf6109adaf94aa24dad44b3257ca0f4e6800aaf1c0ef19c9461a56486d6909514b98603846d6ffb5d0acb57186dd9d6cd7420c86dd9f0bb66e55dd70438cf20ee740cf780ea58b9562df870fc18659a6d9185873870790c9f087082365f40d7de077b81131d1b6651cc2fbe656fa7ed8f56c03d082fbce1dc67325c57d5af51d5fd243eb34b3ff952dd17d84a5688be17341f9d1a12e14f164f1065769d1ee1500afd2b52eeb470412fe623d58815b0f1170d519659959471b23fae3175f1409148daeb6d1f27622fa63bf06ad61362aa831c5ef62a03607eb2b8542c4b17d1d3f915d93f5df579068f015f0c78d2d87805ebfe8e6f57ddeaeef2a73e0283680227f1987561999d1a4a9e1b11ab945458a17f5c8d161b82b416e00bc90d2d5f5efffeafea0c30a6dbef943d4a580c4785118da34fd15514b81a8e7b5a9eebfe59b0d3565ded6c5200b20bd56eed9f95bb0e4d68bb99ce629a646c69270492b00e984317bb17f6bb29c264f64347b4948044b9f35f72889a0733e9b5381beaa1f69a72aa57cc00c24916d98f26fe0cf0457ec975b037cca64d581dd32005b7d7d39f26eb688002561366d68057d4183e940b6509468f0268174b35e0e13a101a3071b58df7cbdbc7819b523e30b74ed088a32c7ba159abd986a4607ebfc036e396645705b076543dd27b33b7bcf5b2f7fe989902d346aea6c7ef67573c83903e09570bc48017e01bfe1686e9fe3da28e727d679ddca33ce193fd3c4a525c25eb9d4e0d727dd0c9c9ee3709755344828402a6d384ea16ad9bdac4518df78eb1a848c269c7571d56742c2ff67fba4a57aefc93c45f814e4eb8cb9c04989072a25c8ccca82862053c1c0fde1891e5c8f8783118485f25adb48a1dce26eacdd4ddc84d07473d61cf6ee6a4d28b022311f1b7151763e083488866a8a7edddc8f61ffb6451764a6008f022d346c819ec86a0256958265e5ce28da25f84e90cdf97abf746108d782661f5533547099a4f8928a071f0afbebcb4acb82eb3f8aa14df0823ceade1dfc7e052fdb79d7dabd5477f4d18b602721892c56a8de2e0a955dbd60201fbc4ebf088b6efd6ad133cdf5134825517a8a21e16ab52ce3dc4b75ff07e33d74d68d5bd04056c88cfeea72065bed06eb9ac039d8130477ca68b36c06a15567e178012e2e090b42bdc235e05ca662aae33c1f736aefb41621ed734813db359d6ee2c3ac01aec680369b7164325c6fbfe0b28363f7d88f132f0eae29f132757772fc7336c5554907ab10b7143da1b62d9dbaa960fb7e32700334ee6a00f0f4b68e86dc0cdf09a8919b37d5cca678cdb09b1ba31e32e6a8a873faff01e7e37aebdac6fe276539eb764c37b2c54942b2c3bff04ecebaffbfd871efd41b6392a1e3be49a078abd76f6ce08431ea920d04ea2972291169487a056d4719eb08c1f52ed3ea26af31ae9d9d16463387e6e1a6b0d66040a7af2f0ce3a0b8df477f06c64f30ba59f6dfade2cee217cf56fadc107d603c80a2e68dd8b11e84dad6857495435c6bf5d7af2bf02c3b05e472b736114ef171a5358908657a4923460e295097081baf8410e17c9fa58e908d67124cc25d73e8c09ddfdfc7f663fb40a72691164490b7ea506084777283b653d2622972afe4ab4b24919f12f54cb3e03fff483632543a202b4662b1056f6b20830f8bd0cdf2c48ee0f1ca966251d4c0ece6dc318a7b2da1c37204b7a699fd195b817f669c7060c958f2bddbb868aae4801325c7933833d65bc5a95a0cf"}, 0xa86, 0x0) sendmsg$nl_route(r3, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f40)=@ipv6_newnexthop={0x5c, 0x68, 0x8, 0x70bd2d, 0x25dfdbff, {0xa, 0x0, 0x2, 0x0, 0x22}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_ID={0x8}, @NHA_GROUP_TYPE={0x6}, @NHA_OIF={0x8}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP_TYPE={0x6}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @ILA_ATTR_CSUM_MODE={0x5, 0x7, 0x2}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008000}, 0x800) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x13ac}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f0000000300)) (async) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) (async) setregid(0x0, 0x0) (async) getpgid(0x0) (async) perf_event_open(&(0x7f0000000700)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2000}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) socket(0x10, 0x3, 0x0) (async) getsockopt$PNPIPE_INITSTATE(r3, 0x113, 0x4, &(0x7f0000001280), 0x0) (async) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000001240)={0x0, 0x0}, 0x10) (async) setxattr$system_posix_acl(&(0x7f0000000340)='./file0\x00', &(0x7f00000020c0)='system.posix_acl_default\x00', 0x0, 0x34, 0x0) (async) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000004000000003000000300000000f000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b00000000020000280200000284", 0x62, 0x400}, {&(0x7f0000010400)="02000000030000000400000030000f", 0xf, 0x1000}, {&(0x7f0000010500)="ffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0x1002, 0x2000}, {&(0x7f0000012600)="ed41000000100000dbf4655fdcf4655fdcf4655f000000000000040008", 0x1d, 0x4200}], 0x0, &(0x7f0000013a00)) (async) fstat(0xffffffffffffffff, &(0x7f0000002680)) (async) syz_mount_image$ext4(0x0, &(0x7f00000011c0)='./file0\x00', 0x0, 0x3, &(0x7f0000002600)=[{&(0x7f0000001200)="9453f5ea5b1f6f469a3f90472ffa966fbbcbfb024fd070fc8c0c513f7ab7", 0x1e, 0x2}, {&(0x7f0000002140), 0x0, 0x7fffffff}, {0x0}], 0x1001000, &(0x7f0000002700)={[], [{@fowner_gt}, {@euid_lt}]}) (async) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f00000012c0)='./file0\x00', 0x180, 0x2, &(0x7f00000014c0)=[{&(0x7f0000001300)="54e8421b5bff9a833734f00317a63c4cd18909d835d6124ad91088c12d93276fcc8ac831241fa9ee59c59a3757fd016288733128979f66b7fb546516234e1691654383400dfbf4ff82b03c35b922a15925e6cc26d093d06933389294530018ffaa41e009a338ef2eac41fb0f6895ffed585ac497a3366245125b11d70ee1313ebb90bdc1f7ad11e7f3ca253c6a0ef3d99e78f508c1d65a76cbfbd023292bda997567c71535f84d64e190c10c05e7d95f24a789793e", 0xb5, 0x9}, {0x0, 0x0, 0xffffffffffffffff}], 0x104800, &(0x7f0000001640)={[{@mblk_io_submit}], [{@appraise}, {@smackfsfloor={'smackfsfloor', 0x3d, 'ext4\x00'}}, {@euid_lt={'euid<', r1}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}, {@appraise}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}, {@fsname={'fsname', 0x3d, 'euid'}}]}) (async) setxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), &(0x7f00000034c0)=ANY=[@ANYBLOB="00fb1600006c09ecfa2d815613e88c55159d7bde328b9314c8d1dc44832863a17d12ec2253589e73b5c026fe20b4f2bc4d6745fad01b0041044fe001ec106e50dfacc64cf2bcc833d311dba624b3230f03e9314c67d4fab8a9c195da879993bc0576be338045c6f7ebec34525327dee2513fcfc161aba086c36bcc7ff841837a13db49d1a6a292803b5f2607697305c8efff328aa4add29c3d5a9b355d529e9c19acc03ecbd5ac4f5c2bac6e7c8fb53753c2d1981083b782a10eec2776574195989a709fa4e083f8f3b87c5f6ddbef3dc977cbe84d2fbca58a518b051f76eab38a082aab990b8ac4d07549d1ec109f732478290e3cb60b154a1edd1a85544391bca7da8dcfcc205cf3038f42c0e8722eca37128b07d107d985f7250de5d54682f6244e739ec8f4ed8bf77a5a20d8ec27bc7286d9018ab8de38981aa87f0c6c0fd46f1f73763b743d3e1207289334562590fcf2ab2766850d052489841441e9574ce821cfbf7b1dfadd61b503aa7623a9c664360c5358bf102dfa0d3e552bf387fdc8dc873f4b59bddce9beb00e74a189de0258ff7276dba0757d3086a284359f9ce0195d08492edc817127ec99e7e33b74d7ec6b32dd4c9f882d9748dbc99b97d24114a39f2210cecafc36b91988a4bddf1d2b7c7e647dfa9f88da6549a26eb55c917479061e6674fc4224dd35e8924be5e61d114604a138069c02db7ea9033fa665fdb8950ee87935d76672072d8523f526e11fde80b5cba875672aa7b9dc6078caf3eb6d806bd4ff7f8198da138906007ce45099e0523184f8200f89629d3f1abefaa12afa59d7e0c0674dfeb60138d94c34a224e95eded0d1e34561386b945e3c7cc0ac3b2d77d0ddaa7911a01aed5b6159c411baed6533bce1ce76985017762aa996d79b82b29d514d28db106ffe5d1e561804f54ea7884d8b3d158510bdd08bb59955adee054130bedeaf9b2d26f21b7d0bce325933821c3cc973a2795c1421ec3b0b1957292c3bf43ff83f0ef102155ac2dc1a4c55f0ed70c9b3614b3896e021f117c3a80c2aae09092bcd3bc634017fffc154f8aa21394431b63c100f19298de204b27a77a00681a207506ad1eb03e97f81e9d1671d026186e0b551252eed4f7d12d0480616e7b17d16aea3418dba6ff29520404f77d67581eac956f80ae36a1e5e07a92c32e69d4dd676c5b63daa80c656fd222f4b406db28a399c14267f3dea94879aecad9cf13f3964c7ae5447afab8be34db87fa1e483fe09c628d231a8dbbb35096004fbb0cf5a6e13ab374f17d05249215ba4280a2c61732b187d698b66ec7314c21ec4c2c97c288d395104e2db29529f992da8b6cbe4d425b23b3304d457b75328a40b3936a6d5587c068a449501704f637c85fb046df24c4c462e09e1bfa5f7d3943b462da69c1ffc460a82aad0191ba77fa18aaa7ea9fdc168b9361e9ca16d56b36a6821b22764fda8000dc857db9ee5aa7e53202b35e7b3acb59f8151c3fd74063f132f51dceb0b3fb7920d5d2ffbc4847a65ab1d9f88088b2f28254f2695ba55deb705429db7d3167158676083e5df15c4318333f4870cbbdee2866259d8a1d84f7f141887f232230ff973c2fbfaa21933c0e7661b83a52e0a135820f20ef4725b025c4ef1f433a93d05a75a3ccee3748d02b14b3ebfad8b8a819bc97358abbe516725ea5b145612d7416b264b52e49301092301e7bceb75cec58e1657ca7076d721c76cfec1811394f7158f451c87e586dab0cff7eccea7af211b308422edb5caadd615dcf0a96b9d460dd60e4d802120795bb3b659ef88fca4d758be1f5dd83d7f3946accfefdde5c50551f586fe73ef33dcc42b84781e943b18e2ae05cb209ebe4b5f3a26eac806777b9c9e18ee617609c6909d1581eb60a9a9d1053c26738e8491795865bd090b2fe97948d1b6f49a0f6e4253add1fda4545c19dafb86e5966739d39ec57310a45d646f33c0f6a339d560c96aad2120738d0b430a011189cab1d795095c11609efda879614286cbe7ddec26a4e9ff17135c63af046800ca11dbd82711f4fc570b50d799eba2a4ec2b04f15e87703bd54fc1d5f3c137ff8185414387c995113225795072630f49125b5b1fd0322793b2bb6fb24b99a521829555341ee2a2241dbe80746452dfd715bff60f4a40f56e12f6043381ebd06b44e3eaf68340efaaf36ad7cd2af8574d068e09640d6b5f0a22e1ba1dbca51e2b0aac25dab11ca88a0262293d89321181501ba32b3dac866c19d2e836209472ad2aa8a4af62af995b8c6d0b79c3edadbbc7fd38033a761ace773f2acb8ae79f84205cbcc296a65055d10b6cab38b8c0a50539b6926ebb517228af26af276da8c635b769273db475ecd8b281ea3b3fcf858bef76ce761e11e84088c44ccf0e1b986483ed1f8ade7800716f7bbde795e37ec5fc950fcdae1eafda3991b231728c7bf36c3f1d7950ba934bcec383d0ed635033426ca85e0b6ec41b467d9943805881a414b8aa11c566d0d1b763caef197d19af8546a173dd8f2eae9f5a49e7bdfe9e287de4e16a5f96074553622a7fd3d0646d4e07ebdd402c6579b8f8ed25f468ce2427567563cfec729e1af74a62d92c03b1e45df4d29deb4f3a247e5ac1ab1fc74bfef2b8082d55f20a5fdfbe456e1493cda4035766bc9f215730456338e34b85f847377eaf0965f7b43c457bc011e61273543980ee1a1e6fea0c244e593d83e144c38416cc94a519799f2bc34d405b0a3d3f7df9c45236604d815c52f0776542141080ef27dcdc1af36f723e95a0c5103274f12f7237af76a4c5cb9498e21bc9142c3568ad93222e54389d01e6f16830b5c9cc09872671da06d8da068ed1ffed1be41902b1ba1cce6318eef7fb850624698101df4ffac57de42d1b13ce581a472b8a5e6db267dae639ff76f3348a61ebc92d6f4368da9a6c56062955ecb6d352e9af918eb473515f8bf2096b51353d7b2a804627a88a629f2e0ecd42e307faaf9807197cd775c1090dba98e2ada1833587410d3cf9fd9b68e80e9361aa16da5877b79a87985667938c2ffe6f5b8f30511301ab45ea0e1488d96e18583e590120df3cf0bf992feb9d96a421d2134aad816bbed4fde7eec2c25301beec61d64c57c0ed86b2e2efe0a95daec2ce57fb1f3f9e322d404d13ba6641aa535a1d3afd263425e66dee3687d5c38d80811170034d58872002cbbfa323fe064bde7ae7c46e8eb89ee71ef00abefc124a8d87c315465d578adc92b28f20c3a35c572765be05171d6ba756a18bbdc7fb36ec5feb02a8b2d6df43c0992b1cd117b420cbb2a765c1055557094ae894226de63a1a8afa43500706945657ef9a23376da5088c4cebaab7e18fe32b57ec0e5b345692d8bc5c6021aa34dfa88d5a66a370a867037fa0ac3fabb26b22779b9004e1bc4b3912357a7a47a67ea378c8c4bbe04b851d2363c45e55786a770e14d781b3a2d0b9bbdb4de2eed51c8d018988e5df45506e0b59a0320ad3ef9ff7ef17460b1ecb201cba6b53bb2ab63a559c497f06f313bb33028a232a7477cbc251e1395e8fa099fb0f0c46983aa66f24a2f432778da560c940d13acbe487e18c38c9187fea093d3505ca99f5dd6518b55cf45d5fcce9dab48caca06c9b5d82d96cfcde96cbca66fa5ecb2750df998613c36c3e9ffbb7f483e4c47beb0c782947be3f006bedbdcc9999cdf1ba1f2412d10f06fd74be142019cb423d23eaae5809aab6f29b85940087d1f2ce206391c27a52b28c3f6271a5a61477a74d34924d5bf5344ddd701f5b380a019708d921af8b5236fc5be7e5a025c908cc64f7370d58eb192346d255f06f58a04088d5bf9120997776b0c170139dc3d5fd7bf5ef9965764b91f399dd331cacdcd6b94be02c99f48b802e19b22dcb3294c3cb73c43dd2ab04dc0b35f28217c333dc372c20bcb6d1d85412cde8a1b9da4bfd05326a910cbb4715048bd753e134ffa537b3d349a4df3a8804e1c15595f5f2504bd7cd45c1120ab72bb7c7091a52bed9e0b9ae17e81a165039b406c88c2e84b1943f15215cd750edbfb06bbb41db6be57eb7cb1b4d45c48adee6d5823b27516bd8d9102fd0ce22508afc8229677723cd1ab59d3d79cc4d134ac3ea52069fef5d7677041d80424de8789f4d744d58ea57ea0dcebe692c0c1ace92ebc6c0f91057ef12230a43aec01c367572dfe475d10f61ba4f26a87c2387c94f5ea1db190f82d06b01177e2ff4abcd42992c70fde480315b9d7cf3cb1abb395b9d5dd3c8eb8888256e58c829f96c3d7952c5624a173c059767e427905216e6dc218854a1a42fd08e538bf7e287a47c07bd39d222bf6b1a95a0265a54f9e2ac826709782752ca38bc2545a7d002dd0f0049ae7a011223e20a9110ab3f73fa0ca575e94e588571dbb45475dfd94d01d798741cec3bae3ac35009c87b651035fb121637c905995754165e4475e8240a8705c047493df1c58bc52c811c74d636b513189068773776a976aae4df1529e5b1d1c73f3c0ffd18e0ed80ede33093d15811d4d6636337167da82d78d62a75bb608eeacb761424f51949000000008ea97cdc8acabde95e400eb2d36ad0e42b2824cb60ea40837aa8deb9ad2ea27016b4bb4611abe7983d7cddab"], 0xe16, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000ec0)={&(0x7f0000000080), 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)=@ipv6_newroute={0x1c, 0x18, 0x2, 0x70bd29, 0x25dfdbfb, {0xa, 0x0, 0x20, 0x1f, 0x7d, 0x0, 0xff, 0xc, 0x600}}, 0x1c}, 0x1, 0x0, 0x0, 0x20040084}, 0x4001) (async) open$dir(&(0x7f0000000280)='./file0\x00', 0x0, 0x128) (async) setxattr$trusted_overlay_upper(&(0x7f0000001700)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000380)={0x6, 0xfb, 0xa86, 0x4, 0x0, '\x00', "8dfa95f490b5c29ff9389f224c1d0f8d82b5401c68b18752f1f24810951641b2d28aa470a5fec7cc1cabfbdc679b6581b170cb2963e4d4421cf7cf61bf2e91106a5ccf86ced704dd5a91ce8fb6fa3bd4f0264986d9029c368058c1e293fdeab2ecadd3a1ccd738982be05e6527994f4d77691586962fb2ae58e80d061dbba03c9a595ffd4fb2788cd2a8e6147bf811fed93b0583e9ccd11df48aff0b5e0fc187392aa58728bbb313b8de8064e11cf658d4bb435e975574075faaae14529f47d687b1178c084e23c07574ca6d52155b5710231f80b96d6e3f99a05008ff65fc5a88242e8c12cf627442215a5eac9c07457af4980fb3cff8e999c94b6a95bb86457a9d71f139c054c26c88591fefa00524a080ffea5e29a99539b2beacc330b9c4c787e8adb5cf3e1dc30e877e2df587d44e9f2b204a99d914651fb183f816760ae3075916630905f52ddea2dad60a27da4650af5d05443215f78a826fd0599d12a4d9fabe4a3778ea20893b1afa01b78753cd758899b74aaad16b3f573eb2f39153b8c5cd0cbcd06274a462773e3f52bafe685084f9e482a3258cd3aedb1504cc0dcd567917600e564ff2d2fe8fb4afcd235db6db4fcda2b8f53798039f73dbd10b8c2f99697743a5b78a141f18a831aa794dd9430e2ab8b596e3d78e59d6763a86b0885e8f627002a5d77eac470fb685a4f7814b130fa4a7e5e66b3e6e3fae7bf31321c9f8858d8996c56391e41ed62fa28b4db74582f7578bc22266a64476654a23aa3878cc4e4b1c2d961f6e223498e0937572c7db8e6265063101cab017a65a7c77a503fec556060f8102caa95c5a23eebcdd3d1897f05f1328acae7446b5d5db454013c7e42c4d96accf8ddfe71fc7e5f56370d18a69dc699ad1303cb38a11f83d1a8660846755cd47a7f3a433a4011ee128b1e1ffec5a440621a6d044bd17ceee1f5cfec1dd35f41b89a816eaf5f25754307cb3968eae10d566fb79679c7af6ff82b28766cd99539dc09cefc0523a2112c5c81b269c8ec59131dbb9e5cb04d94b28f586b68b5d7df852866ad550768b34712a6080648ca5e3ddbb0996f0b0497ea907c6225d86664a4d5a659782373672b91e6c8ded3445dab6302bf55de0ba17560668426dcc562f757b019c878969a364a5e60be8eb6c3595846b7cbdbd0e1f88422a50d083bf65dd9dd2f5919bf38c2a74fce75f20517a17be51efd6f794e0f59e91da0478b833184db399e635d5c6a469bd5d1dde0c426fff46a4aea7af93ab32afef4d7864e7c7c6b81001293d1888b45f75e98707513fbd69ae16ac5b344532b7d62dcbfc1edc2bceab8a0ec62bf4638f13b968b764ece346288fceec159e68f49db618ea2ad067b301bb69ef7f983afd323738d9abdc729080130b00ee1e82997e9a41f03dd0712d73e334555e440d782adc17302bd3688b37e21dcc044cd139b7cf575ea372916ad6b94e6624cd77a97f18941e69eac13636a30e66cfdb31621145784864f25e61d66eabbafd2580bf1dd950a3e4884bf23c223711c833c715e8b1bf6a187da53bf021b53e5a3297e6d235b6effdd41c4b4de8a5bdbc84b002857e2483e35f3594809261454b257896e966c69b1fd95cc319e309e00e3f70b708794b742bb19234df85411c225b86c0115454a965b278dd5f6a7ea0e21c8679b57bf9090a1ce919c4d1056839725dcaa73640f3a9cc517284806653063fbb48bb614f1587f1cccb65f074c4508670f25e7a1fb3bb5b0c1a3d13b3a70a05f9be65880580809e80a5358132ed29a0ff8286d8de4812e4a0b5eb8bb12374ba43cf555fd033b9d4e95280293971fc81ff68c866df2cc49fecf90651b04de9d755dd77186b31de06d9828971c4202b98f757ffa00b0a7a3fab432dda48f6e3f2ac364a7a5749f56bf32142b2ad6c82f394477a7556a247d4863b2ba06b33e862f9ba43599c013d5739b3ce841e1776dbf03ef0b9c3fe3a138b2af1604c789b528dba03b5bdf6109adaf94aa24dad44b3257ca0f4e6800aaf1c0ef19c9461a56486d6909514b98603846d6ffb5d0acb57186dd9d6cd7420c86dd9f0bb66e55dd70438cf20ee740cf780ea58b9562df870fc18659a6d9185873870790c9f087082365f40d7de077b81131d1b6651cc2fbe656fa7ed8f56c03d082fbce1dc67325c57d5af51d5fd243eb34b3ff952dd17d84a5688be17341f9d1a12e14f164f1065769d1ee1500afd2b52eeb470412fe623d58815b0f1170d519659959471b23fae3175f1409148daeb6d1f27622fa63bf06ad61362aa831c5ef62a03607eb2b8542c4b17d1d3f915d93f5df579068f015f0c78d2d87805ebfe8e6f57ddeaeef2a73e0283680227f1987561999d1a4a9e1b11ab945458a17f5c8d161b82b416e00bc90d2d5f5efffeafea0c30a6dbef943d4a580c4785118da34fd15514b81a8e7b5a9eebfe59b0d3565ded6c5200b20bd56eed9f95bb0e4d68bb99ce629a646c69270492b00e984317bb17f6bb29c264f64347b4948044b9f35f72889a0733e9b5381beaa1f69a72aa57cc00c24916d98f26fe0cf0457ec975b037cca64d581dd32005b7d7d39f26eb688002561366d68057d4183e940b6509468f0268174b35e0e13a101a3071b58df7cbdbc7819b523e30b74ed088a32c7ba159abd986a4607ebfc036e396645705b076543dd27b33b7bcf5b2f7fe989902d346aea6c7ef67573c83903e09570bc48017e01bfe1686e9fe3da28e727d679ddca33ce193fd3c4a525c25eb9d4e0d727dd0c9c9ee3709755344828402a6d384ea16ad9bdac4518df78eb1a848c269c7571d56742c2ff67fba4a57aefc93c45f814e4eb8cb9c04989072a25c8ccca82862053c1c0fde1891e5c8f8783118485f25adb48a1dce26eacdd4ddc84d07473d61cf6ee6a4d28b022311f1b7151763e083488866a8a7edddc8f61ffb6451764a6008f022d346c819ec86a0256958265e5ce28da25f84e90cdf97abf746108d782661f5533547099a4f8928a071f0afbebcb4acb82eb3f8aa14df0823ceade1dfc7e052fdb79d7dabd5477f4d18b602721892c56a8de2e0a955dbd60201fbc4ebf088b6efd6ad133cdf5134825517a8a21e16ab52ce3dc4b75ff07e33d74d68d5bd04056c88cfeea72065bed06eb9ac039d8130477ca68b36c06a15567e178012e2e090b42bdc235e05ca662aae33c1f736aefb41621ed734813db359d6ee2c3ac01aec680369b7164325c6fbfe0b28363f7d88f132f0eae29f132757772fc7336c5554907ab10b7143da1b62d9dbaa960fb7e32700334ee6a00f0f4b68e86dc0cdf09a8919b37d5cca678cdb09b1ba31e32e6a8a873faff01e7e37aebdac6fe276539eb764c37b2c54942b2c3bff04ecebaffbfd871efd41b6392a1e3be49a078abd76f6ce08431ea920d04ea2972291169487a056d4719eb08c1f52ed3ea26af31ae9d9d16463387e6e1a6b0d66040a7af2f0ce3a0b8df477f06c64f30ba59f6dfade2cee217cf56fadc107d603c80a2e68dd8b11e84dad6857495435c6bf5d7af2bf02c3b05e472b736114ef171a5358908657a4923460e295097081baf8410e17c9fa58e908d67124cc25d73e8c09ddfdfc7f663fb40a72691164490b7ea506084777283b653d2622972afe4ab4b24919f12f54cb3e03fff483632543a202b4662b1056f6b20830f8bd0cdf2c48ee0f1ca966251d4c0ece6dc318a7b2da1c37204b7a699fd195b817f669c7060c958f2bddbb868aae4801325c7933833d65bc5a95a0cf"}, 0xa86, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f40)=@ipv6_newnexthop={0x5c, 0x68, 0x8, 0x70bd2d, 0x25dfdbff, {0xa, 0x0, 0x2, 0x0, 0x22}, [@NHA_ID={0x8, 0x1, 0x2}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_ID={0x8}, @NHA_GROUP_TYPE={0x6}, @NHA_OIF={0x8}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}, @NHA_GROUP_TYPE={0x6}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @ILA_ATTR_CSUM_MODE={0x5, 0x7, 0x2}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008000}, 0x800) (async) [ 350.210700] erofs: read_super, device -> /dev/loop2 [ 350.217986] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 350.239429] erofs: FAULT_INJECTION was not selected [ 350.244606] erofs: root inode @ nid 36 20:43:01 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x7, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:01 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, 0x0) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 350.324825] erofs: mounted on /dev/loop2 with opts: noacl. [ 350.333745] 9pnet: Could not find request transport: xen 20:43:01 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x39b, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 350.473755] erofs: unmounted for /dev/loop2 20:43:01 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 350.536193] EXT4-fs: failed to create workqueue [ 350.551123] EXT4-fs (loop5): mount failed [ 350.575294] overlayfs: missing 'lowerdir' [ 350.591056] 9pnet: Could not find request transport: xen [ 350.630218] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue 20:43:02 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, 0x0) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 350.641000] erofs: read_super, device -> /dev/loop0 [ 350.656899] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 350.688625] erofs: read_super, device -> /dev/loop2 [ 350.702787] erofs: FAULT_INJECTION was not selected [ 350.715166] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 350.733194] erofs: root inode @ nid 0 20:43:02 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 1) 20:43:02 executing program 5: perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x39, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x22, 0xa, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x200002, 0x0) openat$cgroup_devices(r3, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) openat$cgroup_netprio_ifpriomap(r3, &(0x7f0000000680), 0x2, 0x0) sendmsg$kcm(r2, 0x0, 0x10) perf_event_open(&(0x7f0000000580)={0x5, 0x80, 0x3, 0x20, 0x0, 0x7, 0x0, 0xffff, 0x40800, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x7, 0x1, @perf_config_ext={0x1ff, 0x3f}, 0x2229, 0x8000000000000001, 0x0, 0x1, 0x9, 0x8, 0x4, 0x0, 0x0, 0x0, 0x8000000000000000}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x8) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x7a05, 0x1700) r5 = perf_event_open$cgroup(&(0x7f0000000500)={0x0, 0x80, 0x40, 0x2, 0x5, 0x20, 0x0, 0x9, 0x2000, 0x4, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x10000, 0x4, @perf_bp={&(0x7f00000001c0)}, 0x0, 0x401, 0x80000000, 0x6, 0x4438000000000, 0x9, 0x3, 0x0, 0x1, 0x0, 0x683f}, r4, 0xf, 0xffffffffffffffff, 0x7) perf_event_open$cgroup(&(0x7f0000000100)={0x2, 0x80, 0xae, 0x0, 0x9, 0x8, 0x0, 0x8001, 0x10202, 0x2, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext={0x6, 0x4}, 0x800, 0x1, 0x7fffffff, 0x6, 0xb1, 0x5, 0x40, 0x0, 0x2, 0x0, 0x101}, r4, 0xf, r5, 0x7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000700)=@nfc_llcp={0x27, 0x0, 0x2, 0x1, 0x27, 0x3, "fe843d8171a1473dc2cc39d7a28a0ea9119b3fed20d7174dc77541aeeb070b6e2ce245bc903593a55e3f9ac12244aa34ccf98f75c865c46b2f57719c5e5fa8", 0x12}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000780)="9d7cd934aa867b25d428ae0bd51786902ef585246926195163e0ee8102a057250fe93ae2229ea5290d4597ad5a46b40df611d1f4976e7c6ef1442431d5a7e6b9011563ad1d0febf8d6", 0x49}, {&(0x7f0000000800)="c505229efc9d4e4b0c6ef51662a8985eaf57fdec342ca94a1d4db25e1f176d50a1567c09d158802307dfc144ede031b36b9de0460658871a8d7de9a2fe083435327b61a1dc71b44219b5616737fd6d96ae1e9e6b75db66dc6c434bcce23e7897a825d5fcb6fb9ad4354fb284cc061d627b0215cb0d6cfb79bb414bb3ae39e1ebb65c139dc8291f566fcf689dbe8c1636133ac0d4bbf8dd30a3fbd73c0b2065ea8ab4f8cd453136d7ec96892c93", 0xad}, {&(0x7f00000008c0)="3d02e4934feeabb956fabfc1d9ecef0ce19d8070f033468d7c9e4cb65a26ae364262f6b601901ec9dcb0d6e921524521cde7b96e2f079c4009b74d20451c806cf94b84bc16", 0x45}, {&(0x7f0000000940)="31f17ac3f49a4258476464fecab766882cc4df9ee0cf38bb33a18652448fbb0779ecca86ee4dc644194aa13d3f1bc5b826e159be6dcd630ef7f9c3f711f1", 0x3e}, {&(0x7f0000000980)="8f68e6568a3fc9e74841ee3de96eeaeb63bf980fa3fa6c1783f57428d5cee3ab0356042de661d3c13db4ed3dfc81dce04f76bcd715fb3ca7bee6f76311111343fa87f293be2174", 0x47}], 0x5}, 0x4004040) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r6, 0x40086602, &(0x7f0000000180)) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00'}) write$cgroup_int(r4, &(0x7f0000000200), 0x23000) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000600)=0x800) recvmsg(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000280)=""/116, 0xffffffffffffffa5}], 0x1, &(0x7f0000000300)=""/216, 0xd8}, 0x40) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40082404, 0x0) [ 350.737345] erofs: bogus i_mode (0) @ nid 0 [ 350.745276] erofs: FAULT_INJECTION was not selected [ 350.756478] erofs: root inode @ nid 36 [ 350.766530] erofs: mounted on /dev/loop2 with opts: noacl. [ 350.886375] overlayfs: missing 'lowerdir' 20:43:02 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, 0x0) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 350.913756] 9pnet: Could not find request transport: xen 20:43:02 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x8, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:02 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x39c, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 351.113962] erofs: unmounted for /dev/loop2 20:43:02 executing program 5: perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x39, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) socketpair(0x22, 0xa, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x200002, 0x0) openat$cgroup_devices(r3, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) (async) openat$cgroup_netprio_ifpriomap(r3, &(0x7f0000000680), 0x2, 0x0) (async) sendmsg$kcm(r2, 0x0, 0x10) (async) perf_event_open(&(0x7f0000000580)={0x5, 0x80, 0x3, 0x20, 0x0, 0x7, 0x0, 0xffff, 0x40800, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x7, 0x1, @perf_config_ext={0x1ff, 0x3f}, 0x2229, 0x8000000000000001, 0x0, 0x1, 0x9, 0x8, 0x4, 0x0, 0x0, 0x0, 0x8000000000000000}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x8) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x7a05, 0x1700) r5 = perf_event_open$cgroup(&(0x7f0000000500)={0x0, 0x80, 0x40, 0x2, 0x5, 0x20, 0x0, 0x9, 0x2000, 0x4, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x10000, 0x4, @perf_bp={&(0x7f00000001c0)}, 0x0, 0x401, 0x80000000, 0x6, 0x4438000000000, 0x9, 0x3, 0x0, 0x1, 0x0, 0x683f}, r4, 0xf, 0xffffffffffffffff, 0x7) perf_event_open$cgroup(&(0x7f0000000100)={0x2, 0x80, 0xae, 0x0, 0x9, 0x8, 0x0, 0x8001, 0x10202, 0x2, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext={0x6, 0x4}, 0x800, 0x1, 0x7fffffff, 0x6, 0xb1, 0x5, 0x40, 0x0, 0x2, 0x0, 0x101}, r4, 0xf, r5, 0x7) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000700)=@nfc_llcp={0x27, 0x0, 0x2, 0x1, 0x27, 0x3, "fe843d8171a1473dc2cc39d7a28a0ea9119b3fed20d7174dc77541aeeb070b6e2ce245bc903593a55e3f9ac12244aa34ccf98f75c865c46b2f57719c5e5fa8", 0x12}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000780)="9d7cd934aa867b25d428ae0bd51786902ef585246926195163e0ee8102a057250fe93ae2229ea5290d4597ad5a46b40df611d1f4976e7c6ef1442431d5a7e6b9011563ad1d0febf8d6", 0x49}, {&(0x7f0000000800)="c505229efc9d4e4b0c6ef51662a8985eaf57fdec342ca94a1d4db25e1f176d50a1567c09d158802307dfc144ede031b36b9de0460658871a8d7de9a2fe083435327b61a1dc71b44219b5616737fd6d96ae1e9e6b75db66dc6c434bcce23e7897a825d5fcb6fb9ad4354fb284cc061d627b0215cb0d6cfb79bb414bb3ae39e1ebb65c139dc8291f566fcf689dbe8c1636133ac0d4bbf8dd30a3fbd73c0b2065ea8ab4f8cd453136d7ec96892c93", 0xad}, {&(0x7f00000008c0)="3d02e4934feeabb956fabfc1d9ecef0ce19d8070f033468d7c9e4cb65a26ae364262f6b601901ec9dcb0d6e921524521cde7b96e2f079c4009b74d20451c806cf94b84bc16", 0x45}, {&(0x7f0000000940)="31f17ac3f49a4258476464fecab766882cc4df9ee0cf38bb33a18652448fbb0779ecca86ee4dc644194aa13d3f1bc5b826e159be6dcd630ef7f9c3f711f1", 0x3e}, {&(0x7f0000000980)="8f68e6568a3fc9e74841ee3de96eeaeb63bf980fa3fa6c1783f57428d5cee3ab0356042de661d3c13db4ed3dfc81dce04f76bcd715fb3ca7bee6f76311111343fa87f293be2174", 0x47}], 0x5}, 0x4004040) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r6, 0x40086602, &(0x7f0000000180)) (async) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00'}) write$cgroup_int(r4, &(0x7f0000000200), 0x23000) (async) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000600)=0x800) recvmsg(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000280)=""/116, 0xffffffffffffffa5}], 0x1, &(0x7f0000000300)=""/216, 0xd8}, 0x40) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40082404, 0x0) [ 351.165540] erofs: read_super, device -> /dev/loop0 [ 351.176191] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 351.197574] FAULT_INJECTION: forcing a failure. [ 351.197574] name failslab, interval 1, probability 0, space 0, times 0 [ 351.208975] erofs: FAULT_INJECTION was not selected [ 351.231515] erofs: root inode @ nid 0 [ 351.235409] erofs: bogus i_mode (0) @ nid 0 [ 351.244460] CPU: 1 PID: 22335 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 351.252355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 351.261708] Call Trace: [ 351.264304] dump_stack+0x1fc/0x2ef [ 351.267944] should_fail.cold+0xa/0xf [ 351.271757] ? setup_fault_attr+0x200/0x200 [ 351.276124] ? lock_acquire+0x170/0x3c0 [ 351.280115] __should_failslab+0x115/0x180 [ 351.284387] should_failslab+0x5/0x10 [ 351.288194] __kmalloc+0x2ab/0x3c0 [ 351.291738] ? __se_sys_memfd_create+0xf8/0x440 [ 351.296412] __se_sys_memfd_create+0xf8/0x440 [ 351.300911] ? memfd_file_seals_ptr+0x150/0x150 [ 351.305588] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 351.310955] ? trace_hardirqs_off_caller+0x6e/0x210 [ 351.315965] ? do_syscall_64+0x21/0x620 [ 351.319929] do_syscall_64+0xf9/0x620 [ 351.323757] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 351.328934] RIP: 0033:0x7f9c3f20e279 [ 351.332636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 351.351540] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 351.359252] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20e279 [ 351.366506] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f9c3f267424 [ 351.373762] RBP: 0000000000000003 R08: 0000000000001000 R09: 00007f9c3db831d0 20:43:02 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 2) [ 351.381015] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000008100000 [ 351.388282] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 20:43:02 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x15, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:02 executing program 5: perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x39, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) (async) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) socketpair(0x22, 0xa, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x200002, 0x0) openat$cgroup_devices(r3, &(0x7f0000000080)='devices.deny\x00', 0x2, 0x0) (async) openat$cgroup_netprio_ifpriomap(r3, &(0x7f0000000680), 0x2, 0x0) (async) sendmsg$kcm(r2, 0x0, 0x10) (async) perf_event_open(&(0x7f0000000580)={0x5, 0x80, 0x3, 0x20, 0x0, 0x7, 0x0, 0xffff, 0x40800, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x7, 0x1, @perf_config_ext={0x1ff, 0x3f}, 0x2229, 0x8000000000000001, 0x0, 0x1, 0x9, 0x8, 0x4, 0x0, 0x0, 0x0, 0x8000000000000000}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x8) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x7a05, 0x1700) r5 = perf_event_open$cgroup(&(0x7f0000000500)={0x0, 0x80, 0x40, 0x2, 0x5, 0x20, 0x0, 0x9, 0x2000, 0x4, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x10000, 0x4, @perf_bp={&(0x7f00000001c0)}, 0x0, 0x401, 0x80000000, 0x6, 0x4438000000000, 0x9, 0x3, 0x0, 0x1, 0x0, 0x683f}, r4, 0xf, 0xffffffffffffffff, 0x7) perf_event_open$cgroup(&(0x7f0000000100)={0x2, 0x80, 0xae, 0x0, 0x9, 0x8, 0x0, 0x8001, 0x10202, 0x2, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext={0x6, 0x4}, 0x800, 0x1, 0x7fffffff, 0x6, 0xb1, 0x5, 0x40, 0x0, 0x2, 0x0, 0x101}, r4, 0xf, r5, 0x7) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000700)=@nfc_llcp={0x27, 0x0, 0x2, 0x1, 0x27, 0x3, "fe843d8171a1473dc2cc39d7a28a0ea9119b3fed20d7174dc77541aeeb070b6e2ce245bc903593a55e3f9ac12244aa34ccf98f75c865c46b2f57719c5e5fa8", 0x12}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000780)="9d7cd934aa867b25d428ae0bd51786902ef585246926195163e0ee8102a057250fe93ae2229ea5290d4597ad5a46b40df611d1f4976e7c6ef1442431d5a7e6b9011563ad1d0febf8d6", 0x49}, {&(0x7f0000000800)="c505229efc9d4e4b0c6ef51662a8985eaf57fdec342ca94a1d4db25e1f176d50a1567c09d158802307dfc144ede031b36b9de0460658871a8d7de9a2fe083435327b61a1dc71b44219b5616737fd6d96ae1e9e6b75db66dc6c434bcce23e7897a825d5fcb6fb9ad4354fb284cc061d627b0215cb0d6cfb79bb414bb3ae39e1ebb65c139dc8291f566fcf689dbe8c1636133ac0d4bbf8dd30a3fbd73c0b2065ea8ab4f8cd453136d7ec96892c93", 0xad}, {&(0x7f00000008c0)="3d02e4934feeabb956fabfc1d9ecef0ce19d8070f033468d7c9e4cb65a26ae364262f6b601901ec9dcb0d6e921524521cde7b96e2f079c4009b74d20451c806cf94b84bc16", 0x45}, {&(0x7f0000000940)="31f17ac3f49a4258476464fecab766882cc4df9ee0cf38bb33a18652448fbb0779ecca86ee4dc644194aa13d3f1bc5b826e159be6dcd630ef7f9c3f711f1", 0x3e}, {&(0x7f0000000980)="8f68e6568a3fc9e74841ee3de96eeaeb63bf980fa3fa6c1783f57428d5cee3ab0356042de661d3c13db4ed3dfc81dce04f76bcd715fb3ca7bee6f76311111343fa87f293be2174", 0x47}], 0x5}, 0x4004040) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r6, 0x40086602, &(0x7f0000000180)) (async) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00'}) (async) write$cgroup_int(r4, &(0x7f0000000200), 0x23000) (async) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000600)=0x800) (async) recvmsg(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000280)=""/116, 0xffffffffffffffa5}], 0x1, &(0x7f0000000300)=""/216, 0xd8}, 0x40) (async) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40082404, 0x0) [ 351.451970] erofs: read_super, device -> /dev/loop2 [ 351.457020] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 351.467241] overlayfs: missing 'lowerdir' 20:43:02 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 351.500298] erofs: FAULT_INJECTION was not selected [ 351.517051] 9pnet: Could not find request transport: xen [ 351.523902] erofs: root inode @ nid 36 [ 351.527886] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:02 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[]) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 351.556269] FAULT_INJECTION: forcing a failure. [ 351.556269] name failslab, interval 1, probability 0, space 0, times 0 [ 351.582610] CPU: 1 PID: 22352 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 351.587557] erofs: read_super, device -> /dev/loop0 [ 351.590549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 351.590562] Call Trace: [ 351.590585] dump_stack+0x1fc/0x2ef [ 351.590605] should_fail.cold+0xa/0xf [ 351.590622] ? setup_fault_attr+0x200/0x200 [ 351.590640] ? lock_acquire+0x170/0x3c0 [ 351.603580] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 351.604998] __should_failslab+0x115/0x180 [ 351.605018] should_failslab+0x5/0x10 [ 351.605031] kmem_cache_alloc+0x277/0x370 [ 351.605051] ? shmem_destroy_callback+0xb0/0xb0 [ 351.614369] erofs: FAULT_INJECTION was not selected [ 351.615022] shmem_alloc_inode+0x18/0x40 [ 351.615038] ? shmem_destroy_callback+0xb0/0xb0 [ 351.615051] alloc_inode+0x5d/0x180 [ 351.615068] new_inode+0x1d/0xf0 [ 351.637000] erofs: root inode @ nid 0 [ 351.638481] shmem_get_inode+0x96/0x8d0 [ 351.638504] __shmem_file_setup.part.0+0x7a/0x2b0 [ 351.638523] shmem_file_setup+0x61/0x90 [ 351.638537] __se_sys_memfd_create+0x26b/0x440 [ 351.638550] ? memfd_file_seals_ptr+0x150/0x150 [ 351.638568] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 351.645496] erofs: bogus i_mode (0) @ nid 0 20:43:03 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x39d, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:03 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 3) [ 351.647451] ? trace_hardirqs_off_caller+0x6e/0x210 [ 351.647468] ? do_syscall_64+0x21/0x620 [ 351.647486] do_syscall_64+0xf9/0x620 [ 351.647504] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 351.647515] RIP: 0033:0x7f9c3f20e279 [ 351.647529] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 351.647536] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f 20:43:03 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, 0x0) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 351.647548] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20e279 [ 351.647555] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f9c3f267424 [ 351.647563] RBP: 0000000000000003 R08: 0000000000001000 R09: 00007f9c3db831d0 [ 351.647571] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000008100000 [ 351.647579] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 [ 351.700000] erofs: unmounted for /dev/loop2 20:43:03 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x16, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 351.927824] overlayfs: missing 'lowerdir' [ 351.967441] 9pnet: Could not find request transport: xen [ 351.983430] FAULT_INJECTION: forcing a failure. [ 351.983430] name failslab, interval 1, probability 0, space 0, times 0 [ 351.996692] erofs: read_super, device -> /dev/loop2 [ 352.017121] erofs: read_super, device -> /dev/loop0 20:43:03 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[]) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 352.040976] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 352.051825] CPU: 1 PID: 22386 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 352.054901] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 352.059715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 352.059722] Call Trace: [ 352.059744] dump_stack+0x1fc/0x2ef [ 352.059765] should_fail.cold+0xa/0xf [ 352.059784] ? setup_fault_attr+0x200/0x200 [ 352.059799] ? lock_acquire+0x170/0x3c0 [ 352.059817] __should_failslab+0x115/0x180 [ 352.059834] should_failslab+0x5/0x10 [ 352.059848] kmem_cache_alloc+0x277/0x370 [ 352.059864] __d_alloc+0x2b/0xa10 [ 352.059883] d_alloc_pseudo+0x19/0x70 [ 352.059899] alloc_file_pseudo+0xc6/0x250 [ 352.059914] ? alloc_file+0x4d0/0x4d0 [ 352.059928] ? lockdep_annotate_inode_mutex_key+0x43/0x130 [ 352.059944] ? shmem_get_inode+0x44c/0x8d0 [ 352.059965] __shmem_file_setup.part.0+0x102/0x2b0 [ 352.059984] shmem_file_setup+0x61/0x90 [ 352.060006] __se_sys_memfd_create+0x26b/0x440 [ 352.060021] ? memfd_file_seals_ptr+0x150/0x150 [ 352.060038] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 352.060054] ? trace_hardirqs_off_caller+0x6e/0x210 [ 352.060069] ? do_syscall_64+0x21/0x620 [ 352.060084] do_syscall_64+0xf9/0x620 [ 352.060101] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 352.060115] RIP: 0033:0x7f9c3f20e279 [ 352.104116] erofs: FAULT_INJECTION was not selected [ 352.106963] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 352.106972] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 352.106993] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20e279 [ 352.107003] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f9c3f267424 [ 352.107012] RBP: 0000000000000003 R08: 0000000000001000 R09: 00007f9c3db831d0 [ 352.107020] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000008100000 [ 352.107028] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 [ 352.139002] erofs: FAULT_INJECTION was not selected [ 352.256447] overlayfs: missing 'lowerdir' [ 352.297621] 9pnet: Could not find request transport: xen [ 352.333736] overlayfs: missing 'lowerdir' 20:43:03 executing program 5: r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000040), &(0x7f00000000c0)=0xc) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000300)=[{&(0x7f0000000080)="20000000000100000c000025ce0000000f000000010000000300000000000000002000000020000220000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x9}], 0x0, &(0x7f0000013800)) 20:43:03 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[]) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 352.353609] 9pnet: Could not find request transport: xen [ 352.367939] erofs: root inode @ nid 36 [ 352.383018] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:03 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x39e, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:03 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 4) [ 352.459543] erofs: unmounted for /dev/loop2 20:43:03 executing program 5: r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000040), &(0x7f00000000c0)=0xc) (async, rerun: 32) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000300)=[{&(0x7f0000000080)="20000000000100000c000025ce0000000f000000010000000300000000000000002000000020000220000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x9}], 0x0, &(0x7f0000013800)) (rerun: 32) [ 352.495402] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 352.529484] FAULT_INJECTION: forcing a failure. [ 352.529484] name failslab, interval 1, probability 0, space 0, times 0 [ 352.567494] erofs: read_super, device -> /dev/loop2 [ 352.596687] overlayfs: missing 'lowerdir' [ 352.606806] CPU: 1 PID: 22410 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 352.614705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 352.624058] Call Trace: [ 352.626655] dump_stack+0x1fc/0x2ef [ 352.630293] should_fail.cold+0xa/0xf [ 352.634100] ? setup_fault_attr+0x200/0x200 [ 352.638427] ? lock_acquire+0x170/0x3c0 [ 352.639607] 9pnet: Could not find request transport: xen [ 352.642405] __should_failslab+0x115/0x180 [ 352.642424] should_failslab+0x5/0x10 [ 352.642442] kmem_cache_alloc+0x277/0x370 [ 352.660042] __alloc_file+0x21/0x340 [ 352.660456] erofs: root inode @ nid 0 [ 352.663755] alloc_empty_file+0x6d/0x170 [ 352.663774] alloc_file+0x5e/0x4d0 [ 352.663794] alloc_file_pseudo+0x165/0x250 [ 352.674270] erofs: bogus i_mode (0) @ nid 0 [ 352.675176] ? alloc_file+0x4d0/0x4d0 [ 352.675195] ? lockdep_annotate_inode_mutex_key+0x43/0x130 [ 352.693114] ? shmem_get_inode+0x44c/0x8d0 [ 352.697360] __shmem_file_setup.part.0+0x102/0x2b0 [ 352.702298] shmem_file_setup+0x61/0x90 [ 352.706272] __se_sys_memfd_create+0x26b/0x440 [ 352.710859] ? memfd_file_seals_ptr+0x150/0x150 [ 352.715534] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 352.720928] ? trace_hardirqs_off_caller+0x6e/0x210 [ 352.725942] ? do_syscall_64+0x21/0x620 [ 352.729940] do_syscall_64+0xf9/0x620 [ 352.733744] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 352.738928] RIP: 0033:0x7f9c3f20e279 [ 352.742642] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 352.761560] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 352.769273] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20e279 [ 352.776565] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f9c3f267424 [ 352.783835] RBP: 0000000000000003 R08: 0000000000001000 R09: 00007f9c3db831d0 [ 352.791193] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000008100000 [ 352.798463] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 [ 352.816923] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:04 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:04 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x17, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:04 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:04 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 5) [ 352.855246] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 352.866098] erofs: FAULT_INJECTION was not selected [ 352.885502] erofs: root inode @ nid 36 [ 352.892763] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:04 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x39f, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 352.949999] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 352.957292] erofs: unmounted for /dev/loop2 [ 352.957620] FAULT_INJECTION: forcing a failure. [ 352.957620] name failslab, interval 1, probability 0, space 0, times 0 [ 352.982252] CPU: 0 PID: 22435 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 352.990145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 352.999495] Call Trace: [ 353.002089] dump_stack+0x1fc/0x2ef [ 353.005727] should_fail.cold+0xa/0xf [ 353.009542] ? setup_fault_attr+0x200/0x200 [ 353.013869] ? lock_acquire+0x170/0x3c0 [ 353.017856] __should_failslab+0x115/0x180 [ 353.022097] should_failslab+0x5/0x10 [ 353.025901] kmem_cache_alloc_trace+0x284/0x380 [ 353.030583] apparmor_file_alloc_security+0x394/0xad0 [ 353.035782] ? apparmor_file_receive+0x160/0x160 [ 353.040548] ? __alloc_file+0x21/0x340 [ 353.044447] security_file_alloc+0x40/0x90 [ 353.048691] __alloc_file+0xd8/0x340 [ 353.052412] alloc_empty_file+0x6d/0x170 [ 353.056479] alloc_file+0x5e/0x4d0 [ 353.060030] alloc_file_pseudo+0x165/0x250 [ 353.064272] ? alloc_file+0x4d0/0x4d0 [ 353.068079] ? lockdep_annotate_inode_mutex_key+0x43/0x130 [ 353.073708] ? shmem_get_inode+0x44c/0x8d0 [ 353.077952] __shmem_file_setup.part.0+0x102/0x2b0 [ 353.082891] shmem_file_setup+0x61/0x90 [ 353.086873] __se_sys_memfd_create+0x26b/0x440 [ 353.091461] ? memfd_file_seals_ptr+0x150/0x150 [ 353.096135] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 353.101513] ? trace_hardirqs_off_caller+0x6e/0x210 [ 353.106536] ? do_syscall_64+0x21/0x620 [ 353.110520] do_syscall_64+0xf9/0x620 [ 353.114327] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 353.119530] RIP: 0033:0x7f9c3f20e279 [ 353.123243] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 353.141714] overlayfs: missing 'lowerdir' [ 353.142140] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 353.142154] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20e279 [ 353.142166] RDX: 0000000000002000 RSI: 0000000000000000 RDI: 00007f9c3f267424 [ 353.168524] RBP: 0000000000000003 R08: 0000000000001000 R09: 00007f9c3db831d0 [ 353.173116] 9pnet: Could not find request transport: xen [ 353.175790] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000008100000 20:43:04 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 6) 20:43:04 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 353.175799] R13: 0000000020000100 R14: 0000000000002000 R15: 0000000020000080 [ 353.259954] erofs: read_super, device -> /dev/loop0 [ 353.265796] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 353.275629] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 353.306070] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 353.318563] erofs: FAULT_INJECTION was not selected [ 353.323792] erofs: root inode @ nid 0 [ 353.330081] FAULT_INJECTION: forcing a failure. [ 353.330081] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 353.338500] erofs: bogus i_mode (0) @ nid 0 [ 353.349730] CPU: 0 PID: 22457 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 353.357620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 353.367056] Call Trace: [ 353.369649] dump_stack+0x1fc/0x2ef [ 353.373283] should_fail.cold+0xa/0xf [ 353.377084] ? lock_acquire+0x170/0x3c0 [ 353.381058] ? setup_fault_attr+0x200/0x200 [ 353.385393] __alloc_pages_nodemask+0x239/0x2890 [ 353.390156] ? mark_held_locks+0xf0/0xf0 [ 353.394230] ? set_next_entity+0xb52/0x1dc0 [ 353.398563] ? __lock_acquire+0x6de/0x3ff0 [ 353.402804] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 353.407651] ? __lock_acquire+0x6de/0x3ff0 [ 353.411891] ? lock_acquire+0x170/0x3c0 [ 353.415864] ? finish_task_switch+0x118/0x760 [ 353.420360] ? mark_held_locks+0xf0/0xf0 [ 353.424426] ? unwind_next_frame+0xeee/0x1400 [ 353.428936] ? mark_held_locks+0xf0/0xf0 [ 353.433020] ? deref_stack_reg+0x134/0x1d0 [ 353.437249] ? get_reg+0x176/0x1f0 [ 353.440793] ? __read_once_size_nocheck.constprop.0+0x10/0x10 [ 353.446680] alloc_pages_vma+0xf2/0x780 [ 353.450661] shmem_alloc_page+0x11c/0x1f0 [ 353.454809] ? shmem_swapin+0x220/0x220 [ 353.458801] ? percpu_counter_add_batch+0x126/0x180 [ 353.463848] ? __vm_enough_memory+0x316/0x650 [ 353.468351] shmem_alloc_and_acct_page+0x15a/0x850 [ 353.473287] shmem_getpage_gfp+0x4e9/0x37f0 [ 353.477625] ? shmem_alloc_and_acct_page+0x850/0x850 [ 353.482734] ? mark_held_locks+0xa6/0xf0 [ 353.486793] ? ktime_get_coarse_real_ts64+0x1c7/0x290 [ 353.491981] ? iov_iter_fault_in_readable+0x1fc/0x3f0 [ 353.497174] shmem_write_begin+0xff/0x1e0 [ 353.501353] generic_perform_write+0x1f8/0x4d0 [ 353.505943] ? filemap_page_mkwrite+0x2f0/0x2f0 [ 353.510618] ? current_time+0x1c0/0x1c0 [ 353.514610] ? lock_acquire+0x170/0x3c0 [ 353.518856] __generic_file_write_iter+0x24b/0x610 [ 353.523794] generic_file_write_iter+0x3f8/0x730 [ 353.528557] __vfs_write+0x51b/0x770 [ 353.532275] ? kernel_read+0x110/0x110 [ 353.536175] ? check_preemption_disabled+0x41/0x280 [ 353.541203] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 353.546229] vfs_write+0x1f3/0x540 [ 353.549778] __x64_sys_pwrite64+0x1f7/0x250 [ 353.554103] ? ksys_pwrite64+0x1a0/0x1a0 [ 353.558168] ? trace_hardirqs_off_caller+0x6e/0x210 [ 353.563184] ? do_syscall_64+0x21/0x620 [ 353.567160] do_syscall_64+0xf9/0x620 [ 353.570968] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 353.576157] RIP: 0033:0x7f9c3f1c1247 [ 353.579871] Code: 08 89 3c 24 48 89 4c 24 18 e8 e5 f8 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 48 8b 74 24 08 8b 3c 24 b8 12 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 04 24 e8 15 f9 ff ff 48 8b [ 353.598813] RSP: 002b:00007f9c3db82f00 EFLAGS: 00000293 ORIG_RAX: 0000000000000012 [ 353.606529] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f1c1247 [ 353.613801] RDX: 000000000000000f RSI: 0000000020010000 RDI: 0000000000000004 [ 353.621074] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 353.628344] R10: 0000000000000400 R11: 0000000000000293 R12: 0000000000000004 [ 353.635616] R13: 0000000000000004 R14: 0000000020000140 R15: 0000000000000000 [ 353.642440] overlayfs: missing 'lowerdir' 20:43:05 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 353.664492] 9pnet: Could not find request transport: xen 20:43:05 executing program 5: r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000040), &(0x7f00000000c0)=0xc) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000300)=[{&(0x7f0000000080)="20000000000100000c000025ce0000000f000000010000000300000000000000002000000020000220000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x9}], 0x0, &(0x7f0000013800)) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000040), &(0x7f00000000c0)=0xc) (async) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000300)=[{&(0x7f0000000080)="20000000000100000c000025ce0000000f000000010000000300000000000000002000000020000220000000d7f4655fd7f4655f0100ffff53ef", 0x3a, 0x9}], 0x0, &(0x7f0000013800)) (async) 20:43:05 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x300, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 353.738480] erofs: read_super, device -> /dev/loop4 [ 353.738519] erofs: read_super, device -> /dev/loop2 [ 353.743546] erofs: options -> noacl,acl, [ 353.762732] erofs: cannot find valid erofs superblock [ 353.791307] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 353.807926] erofs: FAULT_INJECTION was not selected [ 353.825409] erofs: root inode @ nid 36 20:43:05 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 7) 20:43:05 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3a0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 353.841723] erofs: mounted on /dev/loop2 with opts: noacl. [ 353.852949] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 353.895952] erofs: unmounted for /dev/loop2 [ 353.903437] FAULT_INJECTION: forcing a failure. [ 353.903437] name failslab, interval 1, probability 0, space 0, times 0 [ 353.917241] erofs: read_super, device -> /dev/loop0 [ 353.922531] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 353.931171] CPU: 0 PID: 22478 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 353.939060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 353.939695] overlayfs: missing 'lowerdir' [ 353.948411] Call Trace: [ 353.948433] dump_stack+0x1fc/0x2ef [ 353.948454] should_fail.cold+0xa/0xf [ 353.948472] ? setup_fault_attr+0x200/0x200 [ 353.948488] ? lock_acquire+0x170/0x3c0 [ 353.948508] __should_failslab+0x115/0x180 [ 353.948526] should_failslab+0x5/0x10 [ 353.948540] kmem_cache_alloc+0x277/0x370 [ 353.948561] getname_flags+0xce/0x590 [ 353.948579] do_sys_open+0x26c/0x520 [ 353.948592] ? filp_open+0x70/0x70 [ 353.948611] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 353.948628] ? trace_hardirqs_off_caller+0x6e/0x210 [ 353.948643] ? do_syscall_64+0x21/0x620 [ 353.948659] do_syscall_64+0xf9/0x620 [ 353.948676] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 353.948688] RIP: 0033:0x7f9c3f1c1194 [ 353.948700] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 353.948711] RSP: 002b:00007f9c3db82eb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 353.986234] 9pnet: Could not find request transport: xen [ 353.986983] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f1c1194 [ 353.986992] RDX: 0000000000000002 RSI: 00007f9c3db82fe0 RDI: 00000000ffffff9c [ 353.987004] RBP: 00007f9c3db82fe0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 354.074948] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 354.082214] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 20:43:05 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:05 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=.']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:05 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 8) [ 354.094494] erofs: FAULT_INJECTION was not selected [ 354.101715] erofs: root inode @ nid 0 [ 354.119950] erofs: bogus i_mode (0) @ nid 0 [ 354.130515] EXT4-fs (loop5): VFS: Can't find ext4 filesystem [ 354.229788] FAULT_INJECTION: forcing a failure. [ 354.229788] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 354.241642] CPU: 0 PID: 22501 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 354.242872] erofs: read_super, device -> /dev/loop2 [ 354.249520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 354.249526] Call Trace: [ 354.249549] dump_stack+0x1fc/0x2ef [ 354.249569] should_fail.cold+0xa/0xf [ 354.249587] ? setup_fault_attr+0x200/0x200 [ 354.249604] ? do_writepages+0x290/0x290 [ 354.249618] ? unlock_page+0x13d/0x230 [ 354.249637] __alloc_pages_nodemask+0x239/0x2890 [ 354.249655] ? lock_downgrade+0x720/0x720 [ 354.277001] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 354.278272] ? check_preemption_disabled+0x41/0x280 [ 354.278294] ? __lock_acquire+0x6de/0x3ff0 [ 354.278324] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 354.278342] ? lock_downgrade+0x720/0x720 [ 354.278355] ? lock_acquire+0x170/0x3c0 [ 354.278378] ? up_write+0x18/0x150 20:43:05 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x500, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:05 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[]) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 354.278390] ? generic_file_write_iter+0x381/0x730 [ 354.278403] ? iov_iter_init+0xb8/0x1d0 [ 354.278422] cache_grow_begin+0xa4/0x8a0 [ 354.339295] overlayfs: overlapping lowerdir path [ 354.340845] ? setup_fault_attr+0x200/0x200 [ 354.340862] ? lock_acquire+0x170/0x3c0 [ 354.340882] cache_alloc_refill+0x273/0x340 [ 354.340902] kmem_cache_alloc+0x346/0x370 [ 354.340921] getname_flags+0xce/0x590 [ 354.340937] do_sys_open+0x26c/0x520 [ 354.349399] erofs: FAULT_INJECTION was not selected [ 354.349983] ? filp_open+0x70/0x70 [ 354.378373] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 354.380297] erofs: root inode @ nid 36 [ 354.383737] ? trace_hardirqs_off_caller+0x6e/0x210 [ 354.383754] ? do_syscall_64+0x21/0x620 [ 354.383772] do_syscall_64+0xf9/0x620 [ 354.383790] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 354.383803] RIP: 0033:0x7f9c3f1c1194 [ 354.409289] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 354.424309] erofs: mounted on /dev/loop2 with opts: noacl. [ 354.428191] RSP: 002b:00007f9c3db82eb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 354.428206] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f1c1194 [ 354.428215] RDX: 0000000000000002 RSI: 00007f9c3db82fe0 RDI: 00000000ffffff9c [ 354.428223] RBP: 00007f9c3db82fe0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 354.428231] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 354.428239] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 354.435498] overlayfs: missing 'lowerdir' [ 354.463676] 9pnet: Could not find request transport: xen [ 354.503332] erofs: read_super, device -> /dev/loop0 20:43:05 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3a1, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 354.526586] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 354.542895] erofs: unmounted for /dev/loop2 [ 354.548920] erofs: read_super, device -> /dev/loop4 [ 354.554220] erofs: options -> noacl,acl, [ 354.566802] erofs: root inode @ nid 36 [ 354.571267] erofs: FAULT_INJECTION was not selected [ 354.616010] erofs: root inode @ nid 0 [ 354.630666] erofs: mounted on /dev/loop4 with opts: noacl. [ 354.652740] overlayfs: missing 'lowerdir' [ 354.654576] erofs: bogus i_mode (0) @ nid 0 20:43:06 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=.']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:06 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 9) 20:43:06 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x600, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 354.676937] erofs: read_super, device -> /dev/loop2 [ 354.688125] 9pnet: Could not find request transport: xen [ 354.704390] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 354.718510] erofs: unmounted for /dev/loop4 20:43:06 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=.']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 354.754403] erofs: FAULT_INJECTION was not selected [ 354.786366] erofs: root inode @ nid 36 [ 354.823856] FAULT_INJECTION: forcing a failure. [ 354.823856] name failslab, interval 1, probability 0, space 0, times 0 [ 354.831112] erofs: mounted on /dev/loop2 with opts: noacl. [ 354.850158] erofs: read_super, device -> /dev/loop0 [ 354.879805] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 354.882341] CPU: 0 PID: 22534 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 354.894802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 354.904153] Call Trace: [ 354.906749] dump_stack+0x1fc/0x2ef [ 354.910387] should_fail.cold+0xa/0xf [ 354.914199] ? setup_fault_attr+0x200/0x200 [ 354.918530] ? lock_acquire+0x170/0x3c0 [ 354.922516] __should_failslab+0x115/0x180 20:43:06 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3a2, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 354.926759] should_failslab+0x5/0x10 [ 354.930568] kmem_cache_alloc+0x277/0x370 [ 354.934727] __alloc_file+0x21/0x340 [ 354.938450] alloc_empty_file+0x6d/0x170 [ 354.942519] path_openat+0xe9/0x2df0 [ 354.946240] ? __lock_acquire+0x6de/0x3ff0 [ 354.950493] ? path_lookupat+0x8d0/0x8d0 [ 354.953726] overlayfs: missing 'lowerdir' [ 354.954565] ? mark_held_locks+0xf0/0xf0 [ 354.954589] do_filp_open+0x18c/0x3f0 [ 354.954602] ? may_open_dev+0xf0/0xf0 [ 354.954617] ? __alloc_fd+0x28d/0x570 [ 354.954635] ? lock_downgrade+0x720/0x720 [ 354.978311] ? lock_acquire+0x170/0x3c0 [ 354.978835] erofs: FAULT_INJECTION was not selected [ 354.982286] ? __alloc_fd+0x34/0x570 [ 354.982307] ? do_raw_spin_unlock+0x171/0x230 [ 354.982321] ? _raw_spin_unlock+0x29/0x40 [ 354.982337] ? __alloc_fd+0x28d/0x570 [ 354.987401] erofs: root inode @ nid 0 [ 354.991040] do_sys_open+0x3b3/0x520 [ 354.991055] ? filp_open+0x70/0x70 [ 354.991074] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 354.991090] ? trace_hardirqs_off_caller+0x6e/0x210 [ 354.991105] ? do_syscall_64+0x21/0x620 [ 354.991120] do_syscall_64+0xf9/0x620 [ 354.991138] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 355.000542] 9pnet: Could not find request transport: xen [ 355.003520] RIP: 0033:0x7f9c3f1c1194 [ 355.003535] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 355.003543] RSP: 002b:00007f9c3db82eb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 20:43:06 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=.']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 355.003556] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f1c1194 [ 355.003569] RDX: 0000000000000002 RSI: 00007f9c3db82fe0 RDI: 00000000ffffff9c [ 355.030130] erofs: bogus i_mode (0) @ nid 0 [ 355.032657] RBP: 00007f9c3db82fe0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 355.032666] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 355.032675] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 355.075938] overlayfs: missing 'lowerdir' [ 355.081458] erofs: unmounted for /dev/loop2 [ 355.158233] 9pnet: Could not find request transport: xen [ 355.244566] overlayfs: missing 'lowerdir' [ 355.276315] 9pnet: Could not find request transport: xen [ 355.401707] erofs: read_super, device -> /dev/loop2 [ 355.422307] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 355.443947] erofs: FAULT_INJECTION was not selected [ 355.454708] erofs: root inode @ nid 36 [ 355.467156] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:06 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:06 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[]) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:06 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lower']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:06 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3a3, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:06 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x700, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:06 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 10) [ 355.511592] erofs: unmounted for /dev/loop2 [ 355.556151] FAULT_INJECTION: forcing a failure. [ 355.556151] name failslab, interval 1, probability 0, space 0, times 0 [ 355.581208] erofs: read_super, device -> /dev/loop0 [ 355.586248] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 355.620870] erofs: read_super, device -> /dev/loop2 [ 355.636443] CPU: 0 PID: 22562 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 355.644348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 355.653701] Call Trace: [ 355.656336] dump_stack+0x1fc/0x2ef [ 355.659983] should_fail.cold+0xa/0xf [ 355.663816] ? setup_fault_attr+0x200/0x200 [ 355.668153] ? lock_acquire+0x170/0x3c0 [ 355.672142] __should_failslab+0x115/0x180 [ 355.676391] should_failslab+0x5/0x10 [ 355.680206] kmem_cache_alloc_trace+0x284/0x380 [ 355.684893] apparmor_file_alloc_security+0x394/0xad0 [ 355.690099] ? apparmor_file_receive+0x160/0x160 [ 355.694871] ? __alloc_file+0x21/0x340 [ 355.698774] security_file_alloc+0x40/0x90 [ 355.703018] __alloc_file+0xd8/0x340 [ 355.706755] alloc_empty_file+0x6d/0x170 [ 355.710830] path_openat+0xe9/0x2df0 [ 355.714569] ? __lock_acquire+0x6de/0x3ff0 [ 355.718816] ? path_lookupat+0x8d0/0x8d0 [ 355.722885] ? mark_held_locks+0xf0/0xf0 [ 355.726961] do_filp_open+0x18c/0x3f0 [ 355.730765] ? may_open_dev+0xf0/0xf0 [ 355.734573] ? __alloc_fd+0x28d/0x570 [ 355.738384] ? lock_downgrade+0x720/0x720 [ 355.742541] ? lock_acquire+0x170/0x3c0 [ 355.746519] ? __alloc_fd+0x34/0x570 [ 355.750254] ? do_raw_spin_unlock+0x171/0x230 [ 355.754764] ? _raw_spin_unlock+0x29/0x40 [ 355.758916] ? __alloc_fd+0x28d/0x570 [ 355.762739] do_sys_open+0x3b3/0x520 [ 355.766455] ? filp_open+0x70/0x70 [ 355.770004] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 355.775374] ? trace_hardirqs_off_caller+0x6e/0x210 [ 355.780393] ? do_syscall_64+0x21/0x620 [ 355.784376] do_syscall_64+0xf9/0x620 [ 355.788186] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 355.793376] RIP: 0033:0x7f9c3f1c1194 [ 355.797097] Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44 [ 355.816024] RSP: 002b:00007f9c3db82eb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 355.823733] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f1c1194 [ 355.826297] overlayfs: missing 'lowerdir' [ 355.830999] RDX: 0000000000000002 RSI: 00007f9c3db82fe0 RDI: 00000000ffffff9c [ 355.831008] RBP: 00007f9c3db82fe0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 355.831015] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 20:43:07 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1500, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 355.831022] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 355.852640] erofs: FAULT_INJECTION was not selected [ 355.852648] erofs: root inode @ nid 0 [ 355.852739] erofs: bogus i_mode (0) @ nid 0 [ 355.880862] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:07 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 11) [ 355.917454] overlayfs: unrecognized mount option "lower" or missing value 20:43:07 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[]) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 355.959957] 9pnet: Could not find request transport: xen [ 355.972509] erofs: FAULT_INJECTION was not selected [ 355.975980] 9pnet: Could not find request transport: xen [ 355.991367] FAULT_INJECTION: forcing a failure. [ 355.991367] name failslab, interval 1, probability 0, space 0, times 0 [ 356.002308] erofs: root inode @ nid 36 20:43:07 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lower']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 356.032376] erofs: mounted on /dev/loop2 with opts: noacl. [ 356.034826] CPU: 1 PID: 22582 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 356.045885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 356.055236] Call Trace: [ 356.057824] dump_stack+0x1fc/0x2ef [ 356.061460] should_fail.cold+0xa/0xf [ 356.065267] ? setup_fault_attr+0x200/0x200 [ 356.069615] ? lock_acquire+0x170/0x3c0 [ 356.073597] __should_failslab+0x115/0x180 [ 356.077832] should_failslab+0x5/0x10 [ 356.081627] kmem_cache_alloc+0x277/0x370 [ 356.085782] __kernfs_new_node+0xd2/0x680 [ 356.089932] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 356.094780] ? _raw_spin_unlock_irq+0x5a/0x80 [ 356.099278] ? __cpu_to_node+0x7b/0xa0 [ 356.103172] ? mark_held_locks+0xf0/0xf0 [ 356.107231] ? io_schedule_timeout+0x140/0x140 [ 356.111814] ? enqueue_entity+0xf86/0x3850 [ 356.116050] ? set_user_nice.part.0+0x3b9/0xab0 [ 356.120723] kernfs_create_dir_ns+0x9e/0x230 [ 356.125132] internal_create_group+0x1c1/0xb20 [ 356.129719] ? sysfs_remove_link_from_group+0x70/0x70 [ 356.134908] ? lock_downgrade+0x720/0x720 [ 356.139070] lo_ioctl+0xf7c/0x20e0 [ 356.142615] ? loop_set_status64+0x110/0x110 [ 356.147023] blkdev_ioctl+0x5cb/0x1a80 [ 356.150912] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 356.156274] ? blkpg_ioctl+0x9d0/0x9d0 [ 356.160163] ? mark_held_locks+0xf0/0xf0 [ 356.164225] ? mark_held_locks+0xf0/0xf0 [ 356.168292] ? debug_check_no_obj_freed+0x201/0x490 [ 356.173316] ? lock_downgrade+0x720/0x720 [ 356.177466] block_ioctl+0xe9/0x130 [ 356.181089] ? blkdev_fallocate+0x3f0/0x3f0 [ 356.185416] do_vfs_ioctl+0xcdb/0x12e0 [ 356.189308] ? lock_downgrade+0x720/0x720 [ 356.193457] ? check_preemption_disabled+0x41/0x280 [ 356.198474] ? ioctl_preallocate+0x200/0x200 [ 356.202881] ? __fget+0x356/0x510 [ 356.206334] ? do_dup2+0x450/0x450 [ 356.209873] ? do_sys_open+0x2bf/0x520 [ 356.213765] ksys_ioctl+0x9b/0xc0 [ 356.217240] __x64_sys_ioctl+0x6f/0xb0 [ 356.221127] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 356.225710] do_syscall_64+0xf9/0x620 [ 356.229520] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 356.234706] RIP: 0033:0x7f9c3f20e037 [ 356.238424] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 356.257322] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 356.265032] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 356.272305] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 356.279587] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 356.286852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 356.294116] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 20:43:07 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3a4, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 356.338323] erofs: read_super, device -> /dev/loop4 [ 356.338727] erofs: read_super, device -> /dev/loop0 [ 356.346410] erofs: options -> noacl,acl, [ 356.353960] erofs: root inode @ nid 36 [ 356.356892] erofs: unmounted for /dev/loop2 [ 356.361911] erofs: mounted on /dev/loop4 with opts: noacl. [ 356.385443] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:07 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 12) [ 356.443667] erofs: unmounted for /dev/loop4 [ 356.466316] erofs: FAULT_INJECTION was not selected 20:43:07 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 356.489865] overlayfs: missing 'lowerdir' [ 356.491552] erofs: root inode @ nid 0 [ 356.505807] erofs: read_super, device -> /dev/loop2 [ 356.519084] erofs: bogus i_mode (0) @ nid 0 [ 356.526173] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:07 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1600, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 356.550225] 9pnet: Could not find request transport: xen [ 356.578032] overlayfs: unrecognized mount option "lower" or missing value [ 356.578552] FAULT_INJECTION: forcing a failure. [ 356.578552] name failslab, interval 1, probability 0, space 0, times 0 20:43:08 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x5, @mcast2, 0x20}, 0x1c) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0xc0c0583b, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f00000000c0)="1445630f6b038e0e2d765edfea6e3932", 0x10) r3 = openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000280)={0x0, 0x80, 0xfc, 0x7, 0x0, 0x5, 0x0, 0x2, 0x82021, 0x2, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x10240, 0x9310, 0x0, 0x5, 0x0, 0x4, 0x40}, r2, 0x0, 0xffffffffffffffff, 0x1) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0xc018937a, &(0x7f0000000100)=ANY=[@ANYBLOB="01ecfba95862edba77c24aff", @ANYRES32, @ANYBLOB="00800000000000002e2f66696c653100"]) r4 = open(&(0x7f0000000040)='./file0\x00', 0x161042, 0x0) ftruncate(r4, 0x200002) sendfile(r0, r4, 0x0, 0x80001d00c0d0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000080)={0xfffe, "057abe"}, 0x6) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) 20:43:08 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lower']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 356.607418] erofs: FAULT_INJECTION was not selected [ 356.612219] 9pnet: Could not find request transport: xen [ 356.637131] CPU: 0 PID: 22603 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 356.643959] erofs: root inode @ nid 36 [ 356.645033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 356.645039] Call Trace: [ 356.645062] dump_stack+0x1fc/0x2ef [ 356.645081] should_fail.cold+0xa/0xf [ 356.658568] erofs: mounted on /dev/loop2 with opts: noacl. [ 356.660885] ? setup_fault_attr+0x200/0x200 [ 356.660902] ? lock_acquire+0x170/0x3c0 [ 356.660922] __should_failslab+0x115/0x180 [ 356.686492] should_failslab+0x5/0x10 [ 356.690292] kmem_cache_alloc+0x277/0x370 [ 356.694441] __kernfs_new_node+0xd2/0x680 [ 356.698577] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 356.703319] ? kernfs_activate+0x2c/0x1d0 [ 356.707465] ? lock_downgrade+0x720/0x720 [ 356.711625] ? kernfs_add_one+0x51/0x4c0 [ 356.715688] ? mutex_trylock+0x1a0/0x1a0 [ 356.719757] ? __mutex_unlock_slowpath+0xea/0x610 [ 356.724609] kernfs_new_node+0x92/0x120 [ 356.728595] __kernfs_create_file+0x51/0x340 [ 356.733009] sysfs_add_file_mode_ns+0x226/0x540 [ 356.737686] internal_create_group+0x355/0xb20 [ 356.742278] ? sysfs_remove_link_from_group+0x70/0x70 [ 356.747473] ? lock_downgrade+0x720/0x720 [ 356.751637] lo_ioctl+0xf7c/0x20e0 [ 356.755187] ? loop_set_status64+0x110/0x110 [ 356.759596] blkdev_ioctl+0x5cb/0x1a80 [ 356.763493] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 356.768860] ? blkpg_ioctl+0x9d0/0x9d0 [ 356.772749] ? mark_held_locks+0xf0/0xf0 [ 356.776817] ? mark_held_locks+0xf0/0xf0 [ 356.780882] ? debug_check_no_obj_freed+0x201/0x490 [ 356.785902] ? lock_downgrade+0x720/0x720 [ 356.790053] block_ioctl+0xe9/0x130 [ 356.793677] ? blkdev_fallocate+0x3f0/0x3f0 [ 356.798000] do_vfs_ioctl+0xcdb/0x12e0 [ 356.801908] ? lock_downgrade+0x720/0x720 [ 356.806056] ? check_preemption_disabled+0x41/0x280 [ 356.811072] ? ioctl_preallocate+0x200/0x200 [ 356.815483] ? __fget+0x356/0x510 [ 356.818940] ? do_dup2+0x450/0x450 [ 356.822481] ? do_sys_open+0x2bf/0x520 [ 356.826388] ksys_ioctl+0x9b/0xc0 [ 356.829843] __x64_sys_ioctl+0x6f/0xb0 [ 356.833731] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 356.838320] do_syscall_64+0xf9/0x620 [ 356.842127] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 356.847317] RIP: 0033:0x7f9c3f20e037 [ 356.851053] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 356.870038] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 356.877745] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 356.885010] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 356.892275] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 356.899543] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 356.906808] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 20:43:08 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x500, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 356.961314] erofs: read_super, device -> /dev/loop4 [ 356.973621] erofs: unmounted for /dev/loop2 [ 356.992242] erofs: options -> noacl,acl, 20:43:08 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x5, @mcast2, 0x20}, 0x1c) (async) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) (async) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0xc0c0583b, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) (async) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) (async) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f00000000c0)="1445630f6b038e0e2d765edfea6e3932", 0x10) (async) r3 = openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000280)={0x0, 0x80, 0xfc, 0x7, 0x0, 0x5, 0x0, 0x2, 0x82021, 0x2, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x10240, 0x9310, 0x0, 0x5, 0x0, 0x4, 0x40}, r2, 0x0, 0xffffffffffffffff, 0x1) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0xc018937a, &(0x7f0000000100)=ANY=[@ANYBLOB="01ecfba95862edba77c24aff", @ANYRES32, @ANYBLOB="00800000000000002e2f66696c653100"]) (async) r4 = open(&(0x7f0000000040)='./file0\x00', 0x161042, 0x0) ftruncate(r4, 0x200002) (async) sendfile(r0, r4, 0x0, 0x80001d00c0d0) (async) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000080)={0xfffe, "057abe"}, 0x6) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) [ 357.013445] erofs: root inode @ nid 36 [ 357.032469] erofs: read_super, device -> /dev/loop0 [ 357.046829] erofs: mounted on /dev/loop4 with opts: noacl. 20:43:08 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 13) [ 357.078172] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 357.108776] erofs: unmounted for /dev/loop4 [ 357.115359] erofs: read_super, device -> /dev/loop2 [ 357.146135] erofs: FAULT_INJECTION was not selected 20:43:08 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x5, @mcast2, 0x20}, 0x1c) (async) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0, 0x0) (async) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x4) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0xc0c0583b, 0x0) (async) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) (async) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f00000000c0)="1445630f6b038e0e2d765edfea6e3932", 0x10) (async) r3 = openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000280)={0x0, 0x80, 0xfc, 0x7, 0x0, 0x5, 0x0, 0x2, 0x82021, 0x2, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x10240, 0x9310, 0x0, 0x5, 0x0, 0x4, 0x40}, r2, 0x0, 0xffffffffffffffff, 0x1) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0xc018937a, &(0x7f0000000100)=ANY=[@ANYBLOB="01ecfba95862edba77c24aff", @ANYRES32, @ANYBLOB="00800000000000002e2f66696c653100"]) r4 = open(&(0x7f0000000040)='./file0\x00', 0x161042, 0x0) ftruncate(r4, 0x200002) (async) sendfile(r0, r4, 0x0, 0x80001d00c0d0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000080)={0xfffe, "057abe"}, 0x6) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) (async) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) [ 357.168115] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 357.206575] erofs: root inode @ nid 0 [ 357.216110] overlayfs: unrecognized mount option "lower" or missing value [ 357.226791] FAULT_INJECTION: forcing a failure. [ 357.226791] name failslab, interval 1, probability 0, space 0, times 0 [ 357.231339] erofs: bogus i_mode (0) @ nid 0 [ 357.244890] erofs: FAULT_INJECTION was not selected [ 357.252088] CPU: 1 PID: 22636 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 357.256480] 9pnet: Could not find request transport: xen [ 357.259974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 357.259980] Call Trace: [ 357.260002] dump_stack+0x1fc/0x2ef [ 357.260022] should_fail.cold+0xa/0xf [ 357.260041] ? setup_fault_attr+0x200/0x200 [ 357.260058] ? lock_acquire+0x170/0x3c0 [ 357.260079] __should_failslab+0x115/0x180 [ 357.260097] should_failslab+0x5/0x10 [ 357.260110] kmem_cache_alloc+0x277/0x370 [ 357.260128] __kernfs_new_node+0xd2/0x680 [ 357.260143] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 357.260159] ? kernfs_activate+0x2c/0x1d0 [ 357.277084] erofs: root inode @ nid 36 [ 357.277603] ? lock_downgrade+0x720/0x720 [ 357.277621] ? kernfs_add_one+0x51/0x4c0 [ 357.277637] ? mutex_trylock+0x1a0/0x1a0 [ 357.277655] ? __mutex_unlock_slowpath+0xea/0x610 [ 357.277673] kernfs_new_node+0x92/0x120 [ 357.343378] __kernfs_create_file+0x51/0x340 [ 357.347823] sysfs_add_file_mode_ns+0x226/0x540 [ 357.352498] internal_create_group+0x355/0xb20 [ 357.357091] ? sysfs_remove_link_from_group+0x70/0x70 [ 357.362281] ? lock_downgrade+0x720/0x720 [ 357.366444] lo_ioctl+0xf7c/0x20e0 [ 357.369991] ? loop_set_status64+0x110/0x110 [ 357.374399] blkdev_ioctl+0x5cb/0x1a80 [ 357.378319] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 357.383697] ? blkpg_ioctl+0x9d0/0x9d0 [ 357.387593] ? mark_held_locks+0xf0/0xf0 [ 357.391658] ? mark_held_locks+0xf0/0xf0 [ 357.395724] ? debug_check_no_obj_freed+0x201/0x490 [ 357.400744] ? lock_downgrade+0x720/0x720 [ 357.404893] block_ioctl+0xe9/0x130 [ 357.408515] ? blkdev_fallocate+0x3f0/0x3f0 [ 357.412836] do_vfs_ioctl+0xcdb/0x12e0 [ 357.416728] ? lock_downgrade+0x720/0x720 [ 357.420876] ? check_preemption_disabled+0x41/0x280 [ 357.425890] ? ioctl_preallocate+0x200/0x200 [ 357.430304] ? __fget+0x356/0x510 [ 357.433762] ? do_dup2+0x450/0x450 [ 357.437301] ? do_sys_open+0x2bf/0x520 [ 357.441194] ksys_ioctl+0x9b/0xc0 [ 357.444764] __x64_sys_ioctl+0x6f/0xb0 [ 357.448654] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 357.453239] do_syscall_64+0xf9/0x620 [ 357.457056] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 357.462249] RIP: 0033:0x7f9c3f20e037 [ 357.465962] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 357.484862] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 357.492583] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 357.499847] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 357.507113] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 20:43:08 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:08 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lower']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:08 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x0, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 357.514384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 357.521649] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 357.541658] erofs: read_super, device -> /dev/loop4 [ 357.547019] erofs: options -> noacl,acl, [ 357.548044] erofs: mounted on /dev/loop2 with opts: noacl. [ 357.556757] erofs: root inode @ nid 36 [ 357.561730] erofs: mounted on /dev/loop4 with opts: noacl. 20:43:09 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x600, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:09 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 14) 20:43:09 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1700, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 357.634384] erofs: unmounted for /dev/loop2 [ 357.638848] erofs: unmounted for /dev/loop4 [ 357.863604] 9pnet: Could not find request transport: xen [ 357.870636] FAULT_INJECTION: forcing a failure. [ 357.870636] name failslab, interval 1, probability 0, space 0, times 0 [ 357.882408] CPU: 0 PID: 22665 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 357.890293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 357.899642] Call Trace: [ 357.902234] dump_stack+0x1fc/0x2ef [ 357.905867] should_fail.cold+0xa/0xf [ 357.909674] ? setup_fault_attr+0x200/0x200 [ 357.913999] ? lock_acquire+0x170/0x3c0 [ 357.917977] __should_failslab+0x115/0x180 [ 357.922239] should_failslab+0x5/0x10 [ 357.926038] kmem_cache_alloc+0x277/0x370 [ 357.930192] __kernfs_new_node+0xd2/0x680 [ 357.934342] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 357.939101] ? __mutex_unlock_slowpath+0xea/0x610 [ 357.943950] ? wait_for_completion_io+0x10/0x10 [ 357.948628] ? kernfs_next_descendant_post+0x19c/0x290 [ 357.951968] 9pnet: Could not find request transport: xen [ 357.953910] kernfs_new_node+0x92/0x120 [ 357.953931] __kernfs_create_file+0x51/0x340 [ 357.953950] sysfs_add_file_mode_ns+0x226/0x540 [ 357.972427] internal_create_group+0x355/0xb20 [ 357.977042] ? sysfs_remove_link_from_group+0x70/0x70 [ 357.982242] ? lock_downgrade+0x720/0x720 [ 357.986404] lo_ioctl+0xf7c/0x20e0 [ 357.989953] ? loop_set_status64+0x110/0x110 [ 357.994368] blkdev_ioctl+0x5cb/0x1a80 [ 357.998262] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 358.003627] ? blkpg_ioctl+0x9d0/0x9d0 [ 358.007518] ? mark_held_locks+0xf0/0xf0 [ 358.011579] ? debug_check_no_obj_freed+0x201/0x490 [ 358.016626] ? lock_downgrade+0x720/0x720 [ 358.020781] block_ioctl+0xe9/0x130 [ 358.024404] ? blkdev_fallocate+0x3f0/0x3f0 [ 358.028727] do_vfs_ioctl+0xcdb/0x12e0 [ 358.032629] ? lock_downgrade+0x720/0x720 [ 358.036783] ? check_preemption_disabled+0x41/0x280 [ 358.041804] ? ioctl_preallocate+0x200/0x200 [ 358.046218] ? __fget+0x356/0x510 [ 358.049675] ? do_dup2+0x450/0x450 [ 358.053226] ? do_sys_open+0x2bf/0x520 [ 358.057125] ksys_ioctl+0x9b/0xc0 [ 358.060582] __x64_sys_ioctl+0x6f/0xb0 [ 358.064479] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 358.069071] do_syscall_64+0xf9/0x620 [ 358.072887] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 358.078085] RIP: 0033:0x7f9c3f20e037 [ 358.081800] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 358.100704] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 20:43:09 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lower']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:09 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 358.108444] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 358.115712] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 358.122981] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 358.130254] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 358.137524] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 358.164124] erofs: read_super, device -> /dev/loop0 [ 358.168201] erofs: read_super, device -> /dev/loop2 [ 358.173796] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 358.174288] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 358.199913] erofs: read_super, device -> /dev/loop4 [ 358.214312] erofs: FAULT_INJECTION was not selected [ 358.226460] erofs: options -> noacl,acl, [ 358.245317] erofs: root inode @ nid 36 [ 358.251288] erofs: root inode @ nid 0 [ 358.253768] erofs: FAULT_INJECTION was not selected [ 358.272672] erofs: mounted on /dev/loop4 with opts: noacl. [ 358.286855] erofs: bogus i_mode (0) @ nid 0 [ 358.299882] erofs: root inode @ nid 36 20:43:09 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 15) [ 358.332962] erofs: mounted on /dev/loop2 with opts: noacl. [ 358.370408] overlayfs: unrecognized mount option "lower" or missing value 20:43:09 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 358.411343] erofs: unmounted for /dev/loop4 20:43:09 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x700, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 358.433953] 9pnet: Could not find request transport: xen [ 358.443287] erofs: unmounted for /dev/loop2 [ 358.459210] 9pnet: Could not find request transport: xen 20:43:09 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lower']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:09 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 358.531912] erofs: read_super, device -> /dev/loop0 [ 358.551099] erofs: read_super, device -> /dev/loop2 [ 358.556159] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 358.564955] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 358.565240] erofs: FAULT_INJECTION was not selected [ 358.574805] FAULT_INJECTION: forcing a failure. [ 358.574805] name failslab, interval 1, probability 0, space 0, times 0 [ 358.579635] erofs: root inode @ nid 36 [ 358.593685] erofs: mounted on /dev/loop2 with opts: noacl. [ 358.600668] CPU: 1 PID: 22694 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 358.608563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 358.617917] Call Trace: [ 358.620512] dump_stack+0x1fc/0x2ef [ 358.624148] should_fail.cold+0xa/0xf [ 358.627951] ? setup_fault_attr+0x200/0x200 [ 358.632279] ? lock_acquire+0x170/0x3c0 [ 358.636261] __should_failslab+0x115/0x180 [ 358.640502] should_failslab+0x5/0x10 [ 358.644301] kmem_cache_alloc+0x277/0x370 [ 358.648453] __kernfs_new_node+0xd2/0x680 [ 358.652605] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 358.657367] ? __mutex_unlock_slowpath+0xea/0x610 [ 358.662220] ? wait_for_completion_io+0x10/0x10 [ 358.666893] ? kernfs_next_descendant_post+0x19c/0x290 [ 358.672271] kernfs_new_node+0x92/0x120 [ 358.676255] __kernfs_create_file+0x51/0x340 [ 358.680673] sysfs_add_file_mode_ns+0x226/0x540 [ 358.685354] internal_create_group+0x355/0xb20 [ 358.685517] overlayfs: unrecognized mount option "lower" or missing value [ 358.689945] ? sysfs_remove_link_from_group+0x70/0x70 [ 358.689961] ? lock_downgrade+0x720/0x720 [ 358.690010] lo_ioctl+0xf7c/0x20e0 [ 358.690028] ? loop_set_status64+0x110/0x110 [ 358.690044] blkdev_ioctl+0x5cb/0x1a80 [ 358.718061] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 358.723551] ? blkpg_ioctl+0x9d0/0x9d0 [ 358.727440] ? mark_held_locks+0xf0/0xf0 [ 358.731506] ? mark_held_locks+0xf0/0xf0 [ 358.733082] 9pnet: Could not find request transport: xen [ 358.735573] ? debug_check_no_obj_freed+0x201/0x490 [ 358.735598] ? lock_downgrade+0x720/0x720 [ 358.735615] block_ioctl+0xe9/0x130 [ 358.735631] ? blkdev_fallocate+0x3f0/0x3f0 [ 358.758128] do_vfs_ioctl+0xcdb/0x12e0 [ 358.762023] ? lock_downgrade+0x720/0x720 [ 358.766165] ? check_preemption_disabled+0x41/0x280 [ 358.769406] erofs: FAULT_INJECTION was not selected [ 358.771173] ? ioctl_preallocate+0x200/0x200 20:43:10 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:10 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 358.771194] ? __fget+0x356/0x510 [ 358.771212] ? do_dup2+0x450/0x450 [ 358.771227] ? do_sys_open+0x2bf/0x520 [ 358.771245] ksys_ioctl+0x9b/0xc0 [ 358.776240] erofs: root inode @ nid 0 [ 358.780636] __x64_sys_ioctl+0x6f/0xb0 [ 358.780650] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 358.780665] do_syscall_64+0xf9/0x620 [ 358.780686] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 358.789218] erofs: bogus i_mode (0) @ nid 0 [ 358.791500] RIP: 0033:0x7f9c3f20e037 [ 358.791515] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 358.791524] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 358.791538] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 358.791547] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 358.791555] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 358.791568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 20:43:10 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x900, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 358.879751] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 20:43:10 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3f00, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 358.922813] erofs: unmounted for /dev/loop2 [ 358.941819] erofs: read_super, device -> /dev/loop4 [ 358.946851] erofs: options -> noacl,acl, [ 358.979651] erofs: root inode @ nid 36 [ 359.012501] erofs: mounted on /dev/loop4 with opts: noacl. [ 359.021702] erofs: read_super, device -> /dev/loop2 [ 359.026727] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 359.128350] erofs: FAULT_INJECTION was not selected 20:43:10 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 16) [ 359.150150] 9pnet: Could not find request transport: xen [ 359.155846] erofs: unmounted for /dev/loop4 [ 359.157768] erofs: read_super, device -> /dev/loop0 [ 359.185934] erofs: root inode @ nid 36 [ 359.190686] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:10 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:10 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./fil']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 359.206990] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 359.229535] erofs: unmounted for /dev/loop2 [ 359.234616] erofs: FAULT_INJECTION was not selected [ 359.242196] erofs: root inode @ nid 0 [ 359.248683] erofs: bogus i_mode (0) @ nid 0 20:43:10 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xedc0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 359.302249] FAULT_INJECTION: forcing a failure. [ 359.302249] name failslab, interval 1, probability 0, space 0, times 0 [ 359.323164] 9pnet: Could not find request transport: xen [ 359.370580] CPU: 1 PID: 22731 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 359.378480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 359.387857] Call Trace: [ 359.390453] dump_stack+0x1fc/0x2ef [ 359.394088] should_fail.cold+0xa/0xf [ 359.397891] ? setup_fault_attr+0x200/0x200 [ 359.402216] ? lock_acquire+0x170/0x3c0 [ 359.406199] __should_failslab+0x115/0x180 [ 359.410435] should_failslab+0x5/0x10 [ 359.414238] kmem_cache_alloc+0x277/0x370 [ 359.418389] __kernfs_new_node+0xd2/0x680 [ 359.422544] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 359.427311] ? __mutex_unlock_slowpath+0xea/0x610 [ 359.432163] ? wait_for_completion_io+0x10/0x10 [ 359.436833] ? kernfs_next_descendant_post+0x19c/0x290 [ 359.442122] kernfs_new_node+0x92/0x120 [ 359.446103] __kernfs_create_file+0x51/0x340 [ 359.450523] sysfs_add_file_mode_ns+0x226/0x540 [ 359.455202] internal_create_group+0x355/0xb20 [ 359.459790] ? sysfs_remove_link_from_group+0x70/0x70 [ 359.464979] ? lock_downgrade+0x720/0x720 [ 359.469142] lo_ioctl+0xf7c/0x20e0 [ 359.472699] ? loop_set_status64+0x110/0x110 [ 359.477137] blkdev_ioctl+0x5cb/0x1a80 [ 359.481026] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 359.486388] ? blkpg_ioctl+0x9d0/0x9d0 [ 359.490326] ? mark_held_locks+0xf0/0xf0 [ 359.494389] ? mark_held_locks+0xf0/0xf0 [ 359.498453] ? debug_check_no_obj_freed+0x201/0x490 [ 359.503478] ? lock_downgrade+0x720/0x720 [ 359.507629] block_ioctl+0xe9/0x130 [ 359.511253] ? blkdev_fallocate+0x3f0/0x3f0 [ 359.515573] do_vfs_ioctl+0xcdb/0x12e0 [ 359.519463] ? lock_downgrade+0x720/0x720 [ 359.523610] ? check_preemption_disabled+0x41/0x280 [ 359.528624] ? ioctl_preallocate+0x200/0x200 [ 359.533039] ? __fget+0x356/0x510 [ 359.536494] ? do_dup2+0x450/0x450 [ 359.540043] ? do_sys_open+0x2bf/0x520 [ 359.543941] ksys_ioctl+0x9b/0xc0 [ 359.547396] __x64_sys_ioctl+0x6f/0xb0 [ 359.551285] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 359.555863] do_syscall_64+0xf9/0x620 [ 359.559667] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 359.564869] RIP: 0033:0x7f9c3f20e037 [ 359.568584] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 359.587483] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 359.595193] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 359.602459] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 359.609727] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 20:43:11 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 359.616995] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 359.624417] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 359.658572] erofs: read_super, device -> /dev/loop2 [ 359.684249] erofs: read_super, device -> /dev/loop4 [ 359.690371] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 359.702041] erofs: read_super, device -> /dev/loop0 [ 359.707079] erofs: options -> noacl,acl, [ 359.707476] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 359.720635] erofs: FAULT_INJECTION was not selected [ 359.726138] erofs: root inode @ nid 0 [ 359.730458] erofs: root inode @ nid 36 20:43:11 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 359.735682] erofs: FAULT_INJECTION was not selected [ 359.752905] erofs: mounted on /dev/loop4 with opts: noacl. [ 359.754415] erofs: bogus i_mode (0) @ nid 0 [ 359.764273] erofs: root inode @ nid 36 20:43:11 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 17) [ 359.789757] erofs: mounted on /dev/loop2 with opts: noacl. [ 359.817541] erofs: unmounted for /dev/loop4 20:43:11 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x40000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:11 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2300, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 359.921550] erofs: unmounted for /dev/loop2 [ 359.934777] overlayfs: failed to resolve './fil': -2 [ 359.940269] 9pnet: Could not find request transport: xen [ 359.965840] 9pnet: Could not find request transport: xen 20:43:11 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./fil']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 360.009307] FAULT_INJECTION: forcing a failure. [ 360.009307] name failslab, interval 1, probability 0, space 0, times 0 [ 360.039950] CPU: 0 PID: 22764 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 360.047856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 360.057210] Call Trace: [ 360.059810] dump_stack+0x1fc/0x2ef [ 360.063444] should_fail.cold+0xa/0xf [ 360.067251] ? setup_fault_attr+0x200/0x200 [ 360.071578] ? lock_acquire+0x170/0x3c0 [ 360.075562] __should_failslab+0x115/0x180 [ 360.079807] should_failslab+0x5/0x10 [ 360.083608] kmem_cache_alloc+0x277/0x370 [ 360.087758] __kernfs_new_node+0xd2/0x680 [ 360.092158] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 360.096923] ? __mutex_unlock_slowpath+0xea/0x610 [ 360.101773] ? wait_for_completion_io+0x10/0x10 [ 360.106452] ? kernfs_next_descendant_post+0x19c/0x290 [ 360.111736] kernfs_new_node+0x92/0x120 [ 360.115720] __kernfs_create_file+0x51/0x340 [ 360.120135] sysfs_add_file_mode_ns+0x226/0x540 [ 360.124811] internal_create_group+0x355/0xb20 [ 360.129408] ? sysfs_remove_link_from_group+0x70/0x70 [ 360.134605] ? lock_downgrade+0x720/0x720 [ 360.138772] lo_ioctl+0xf7c/0x20e0 [ 360.142327] ? loop_set_status64+0x110/0x110 [ 360.146744] blkdev_ioctl+0x5cb/0x1a80 [ 360.150635] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 360.156021] ? blkpg_ioctl+0x9d0/0x9d0 20:43:11 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./fil']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 360.159919] ? mark_held_locks+0xf0/0xf0 [ 360.163982] ? mark_held_locks+0xf0/0xf0 [ 360.168053] ? debug_check_no_obj_freed+0x201/0x490 [ 360.173078] ? lock_downgrade+0x720/0x720 [ 360.177228] block_ioctl+0xe9/0x130 [ 360.180854] ? blkdev_fallocate+0x3f0/0x3f0 [ 360.185177] do_vfs_ioctl+0xcdb/0x12e0 [ 360.189068] ? lock_downgrade+0x720/0x720 [ 360.193223] ? check_preemption_disabled+0x41/0x280 [ 360.198241] ? ioctl_preallocate+0x200/0x200 [ 360.202656] ? __fget+0x356/0x510 [ 360.206115] ? do_dup2+0x450/0x450 [ 360.209657] ? do_sys_open+0x2bf/0x520 [ 360.213556] ksys_ioctl+0x9b/0xc0 [ 360.217012] __x64_sys_ioctl+0x6f/0xb0 [ 360.220903] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 360.225488] do_syscall_64+0xf9/0x620 [ 360.229296] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 360.234484] RIP: 0033:0x7f9c3f20e037 [ 360.238197] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 360.257097] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 360.264813] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 360.272097] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 360.279365] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 360.286632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 360.293898] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 360.328642] erofs: read_super, device -> /dev/loop0 [ 360.338201] erofs: read_super, device -> /dev/loop2 [ 360.340150] erofs: read_super, device -> /dev/loop4 [ 360.345066] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 360.382414] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 360.400495] erofs: FAULT_INJECTION was not selected [ 360.420773] erofs: options -> noacl,acl, [ 360.436391] erofs: root inode @ nid 36 [ 360.443050] erofs: FAULT_INJECTION was not selected [ 360.454160] erofs: root inode @ nid 36 [ 360.472081] erofs: mounted on /dev/loop2 with opts: noacl. [ 360.476209] erofs: mounted on /dev/loop4 with opts: noacl. 20:43:11 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2689, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 360.526444] erofs: root inode @ nid 0 [ 360.553381] erofs: unmounted for /dev/loop2 [ 360.562390] erofs: bogus i_mode (0) @ nid 0 20:43:12 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 18) [ 360.595237] 9pnet: Could not find request transport: xen [ 360.624780] erofs: unmounted for /dev/loop4 20:43:12 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1fffff, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 360.655043] overlayfs: failed to resolve './fil': -2 20:43:12 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./fil']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 360.726447] erofs: read_super, device -> /dev/loop2 [ 360.758236] overlayfs: failed to resolve './fil': -2 [ 360.781207] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 360.798229] FAULT_INJECTION: forcing a failure. [ 360.798229] name failslab, interval 1, probability 0, space 0, times 0 [ 360.810179] 9pnet: Could not find request transport: xen [ 360.823766] erofs: FAULT_INJECTION was not selected [ 360.834738] CPU: 0 PID: 22796 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 360.842629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 360.843232] erofs: root inode @ nid 36 [ 360.851980] Call Trace: [ 360.852002] dump_stack+0x1fc/0x2ef [ 360.852020] should_fail.cold+0xa/0xf [ 360.852036] ? setup_fault_attr+0x200/0x200 [ 360.852051] ? lock_acquire+0x170/0x3c0 [ 360.852070] __should_failslab+0x115/0x180 [ 360.852086] should_failslab+0x5/0x10 [ 360.852098] kmem_cache_alloc+0x277/0x370 [ 360.852114] __kernfs_new_node+0xd2/0x680 [ 360.852132] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 360.861811] erofs: mounted on /dev/loop2 with opts: noacl. [ 360.862199] ? __mutex_unlock_slowpath+0xea/0x610 [ 360.905678] ? wait_for_completion_io+0x10/0x10 [ 360.910353] ? kernfs_next_descendant_post+0x19c/0x290 [ 360.915636] kernfs_new_node+0x92/0x120 [ 360.919621] __kernfs_create_file+0x51/0x340 [ 360.924039] sysfs_add_file_mode_ns+0x226/0x540 [ 360.928718] internal_create_group+0x355/0xb20 [ 360.933311] ? sysfs_remove_link_from_group+0x70/0x70 [ 360.938509] ? lock_downgrade+0x720/0x720 [ 360.942673] lo_ioctl+0xf7c/0x20e0 [ 360.946224] ? loop_set_status64+0x110/0x110 [ 360.950636] blkdev_ioctl+0x5cb/0x1a80 [ 360.954528] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 360.959896] ? blkpg_ioctl+0x9d0/0x9d0 [ 360.963785] ? mark_held_locks+0xf0/0xf0 [ 360.967851] ? mark_held_locks+0xf0/0xf0 [ 360.971927] ? debug_check_no_obj_freed+0x201/0x490 [ 360.976956] ? lock_downgrade+0x720/0x720 [ 360.981108] block_ioctl+0xe9/0x130 [ 360.984734] ? blkdev_fallocate+0x3f0/0x3f0 [ 360.989064] do_vfs_ioctl+0xcdb/0x12e0 [ 360.992960] ? lock_downgrade+0x720/0x720 [ 360.997112] ? check_preemption_disabled+0x41/0x280 [ 361.002131] ? ioctl_preallocate+0x200/0x200 [ 361.006545] ? __fget+0x356/0x510 [ 361.010004] ? do_dup2+0x450/0x450 [ 361.013548] ? do_sys_open+0x2bf/0x520 [ 361.017449] ksys_ioctl+0x9b/0xc0 [ 361.020910] __x64_sys_ioctl+0x6f/0xb0 [ 361.024798] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 361.029382] do_syscall_64+0xf9/0x620 [ 361.033190] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 361.038385] RIP: 0033:0x7f9c3f20e037 [ 361.042098] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 361.061001] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 361.068708] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 361.075974] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 20:43:12 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./fil']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 361.083239] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 361.090509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 361.097782] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 361.121468] overlayfs: failed to resolve './fil': -2 20:43:12 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 361.141902] 9pnet: Could not find request transport: xen [ 361.148192] erofs: read_super, device -> /dev/loop4 [ 361.162854] erofs: read_super, device -> /dev/loop0 [ 361.166981] erofs: options -> noacl,acl, [ 361.193479] erofs: root inode @ nid 36 [ 361.211321] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 361.216635] erofs: mounted on /dev/loop4 with opts: noacl. [ 361.229067] erofs: unmounted for /dev/loop2 [ 361.257597] erofs: FAULT_INJECTION was not selected [ 361.264082] erofs: unmounted for /dev/loop4 [ 361.282720] erofs: root inode @ nid 0 [ 361.294823] erofs: bogus i_mode (0) @ nid 0 [ 361.369735] overlayfs: failed to resolve './fil': -2 [ 361.392935] 9pnet: Could not find request transport: xen [ 361.441444] overlayfs: failed to resolve './file': -2 [ 361.461865] 9pnet: Could not find request transport: xen 20:43:12 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:12 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x26a2, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:12 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 19) 20:43:12 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:12 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:12 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./fil']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 361.600742] erofs: read_super, device -> /dev/loop0 [ 361.606083] FAULT_INJECTION: forcing a failure. [ 361.606083] name failslab, interval 1, probability 0, space 0, times 0 [ 361.619090] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 361.626298] CPU: 1 PID: 22826 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 361.634178] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 361.643526] Call Trace: [ 361.646123] dump_stack+0x1fc/0x2ef [ 361.649772] should_fail.cold+0xa/0xf [ 361.653578] ? setup_fault_attr+0x200/0x200 [ 361.657905] ? lock_acquire+0x170/0x3c0 [ 361.661891] __should_failslab+0x115/0x180 [ 361.666139] should_failslab+0x5/0x10 [ 361.669952] kmem_cache_alloc+0x277/0x370 [ 361.674109] __kernfs_new_node+0xd2/0x680 [ 361.678267] ? kernfs_dop_revalidate+0x3a0/0x3a0 [ 361.683060] ? __mutex_unlock_slowpath+0xea/0x610 [ 361.687912] ? wait_for_completion_io+0x10/0x10 [ 361.692589] ? kernfs_next_descendant_post+0x19c/0x290 [ 361.697880] kernfs_new_node+0x92/0x120 [ 361.701872] __kernfs_create_file+0x51/0x340 [ 361.706295] sysfs_add_file_mode_ns+0x226/0x540 [ 361.710981] internal_create_group+0x355/0xb20 [ 361.715573] ? sysfs_remove_link_from_group+0x70/0x70 [ 361.720764] ? lock_downgrade+0x720/0x720 [ 361.724925] lo_ioctl+0xf7c/0x20e0 [ 361.728081] overlayfs: failed to resolve './file': -2 [ 361.728574] ? loop_set_status64+0x110/0x110 [ 361.728593] blkdev_ioctl+0x5cb/0x1a80 [ 361.728610] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 361.728626] ? blkpg_ioctl+0x9d0/0x9d0 [ 361.735144] 9pnet: Could not find request transport: xen [ 361.738199] ? mark_held_locks+0xf0/0xf0 [ 361.738217] ? mark_held_locks+0xf0/0xf0 [ 361.738236] ? debug_check_no_obj_freed+0x201/0x490 [ 361.738254] ? lock_downgrade+0x720/0x720 [ 361.738273] block_ioctl+0xe9/0x130 [ 361.775961] overlayfs: failed to resolve './fil': -2 [ 361.777680] ? blkdev_fallocate+0x3f0/0x3f0 [ 361.787079] do_vfs_ioctl+0xcdb/0x12e0 [ 361.790977] ? lock_downgrade+0x720/0x720 [ 361.795130] ? check_preemption_disabled+0x41/0x280 20:43:13 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 361.800152] ? ioctl_preallocate+0x200/0x200 [ 361.804570] ? __fget+0x356/0x510 [ 361.808030] ? do_dup2+0x450/0x450 [ 361.811575] ? do_sys_open+0x2bf/0x520 [ 361.815473] ksys_ioctl+0x9b/0xc0 [ 361.817690] 9pnet: Could not find request transport: xen [ 361.818929] __x64_sys_ioctl+0x6f/0xb0 [ 361.818947] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 361.818967] do_syscall_64+0xf9/0x620 [ 361.818990] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 361.841802] RIP: 0033:0x7f9c3f20e037 [ 361.845499] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 361.864396] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 361.872086] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 361.879334] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 361.886589] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 361.893849] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 20:43:13 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 361.901102] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 361.912237] erofs: FAULT_INJECTION was not selected [ 361.917739] erofs: root inode @ nid 0 [ 361.921979] erofs: bogus i_mode (0) @ nid 0 [ 361.940279] erofs: read_super, device -> /dev/loop4 [ 361.943384] erofs: read_super, device -> /dev/loop2 [ 361.953422] erofs: options -> noacl,acl, [ 361.975262] erofs: root inode @ nid 36 20:43:13 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 361.995818] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 361.999262] erofs: mounted on /dev/loop4 with opts: noacl. [ 362.012865] erofs: FAULT_INJECTION was not selected [ 362.019661] erofs: root inode @ nid 36 [ 362.023784] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:13 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3f00, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 362.052416] erofs: read_super, device -> /dev/loop0 20:43:13 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 20) [ 362.090568] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 362.101259] erofs: unmounted for /dev/loop2 [ 362.115131] erofs: unmounted for /dev/loop4 [ 362.134451] erofs: FAULT_INJECTION was not selected [ 362.164810] erofs: root inode @ nid 0 [ 362.185355] erofs: bogus i_mode (0) @ nid 0 20:43:13 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 362.242318] 9pnet: Could not find request transport: xen [ 362.265937] FAULT_INJECTION: forcing a failure. [ 362.265937] name failslab, interval 1, probability 0, space 0, times 0 [ 362.283279] overlayfs: failed to resolve './file': -2 [ 362.295670] CPU: 1 PID: 22860 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 362.303567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 362.312915] Call Trace: [ 362.315512] dump_stack+0x1fc/0x2ef [ 362.319150] should_fail.cold+0xa/0xf [ 362.322959] ? setup_fault_attr+0x200/0x200 [ 362.323237] overlayfs: failed to resolve './file': -2 [ 362.327297] ? lock_acquire+0x170/0x3c0 [ 362.327319] __should_failslab+0x115/0x180 [ 362.327337] should_failslab+0x5/0x10 [ 362.327351] kmem_cache_alloc_node+0x245/0x3b0 [ 362.327373] __alloc_skb+0x71/0x560 [ 362.327393] alloc_uevent_skb+0x7b/0x210 [ 362.327412] kobject_uevent_env+0xa90/0x1480 [ 362.354951] 9pnet: Could not find request transport: xen [ 362.356786] lo_ioctl+0xff9/0x20e0 [ 362.356812] ? loop_set_status64+0x110/0x110 [ 362.374609] blkdev_ioctl+0x5cb/0x1a80 [ 362.378504] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 362.383870] ? blkpg_ioctl+0x9d0/0x9d0 [ 362.387766] ? mark_held_locks+0xf0/0xf0 [ 362.391829] ? mark_held_locks+0xf0/0xf0 [ 362.395895] ? debug_check_no_obj_freed+0x201/0x490 [ 362.400923] ? lock_downgrade+0x720/0x720 [ 362.405074] block_ioctl+0xe9/0x130 [ 362.408698] ? blkdev_fallocate+0x3f0/0x3f0 [ 362.413021] do_vfs_ioctl+0xcdb/0x12e0 [ 362.416912] ? lock_downgrade+0x720/0x720 [ 362.421059] ? check_preemption_disabled+0x41/0x280 [ 362.426074] ? ioctl_preallocate+0x200/0x200 [ 362.430489] ? __fget+0x356/0x510 [ 362.433951] ? do_dup2+0x450/0x450 [ 362.437497] ? do_sys_open+0x2bf/0x520 [ 362.441392] ksys_ioctl+0x9b/0xc0 [ 362.444845] __x64_sys_ioctl+0x6f/0xb0 [ 362.448736] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 362.453314] do_syscall_64+0xf9/0x620 [ 362.457117] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 362.462304] RIP: 0033:0x7f9c3f20e037 [ 362.466016] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 362.484913] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 362.492621] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 362.499886] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 362.507154] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 362.514417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 362.521678] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 362.644597] erofs: read_super, device -> /dev/loop4 [ 362.650561] erofs: read_super, device -> /dev/loop2 [ 362.665021] erofs: options -> noacl,acl, [ 362.673334] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 362.690292] erofs: read_super, device -> /dev/loop0 [ 362.690844] erofs: root inode @ nid 36 [ 362.707673] erofs: FAULT_INJECTION was not selected [ 362.713663] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 362.721538] erofs: root inode @ nid 36 [ 362.725584] erofs: mounted on /dev/loop4 with opts: noacl. [ 362.732819] erofs: mounted on /dev/loop2 with opts: noacl. [ 362.739288] erofs: FAULT_INJECTION was not selected 20:43:14 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:14 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:14 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(0x0, &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:14 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 21) 20:43:14 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x6000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 362.744821] erofs: root inode @ nid 0 [ 362.757658] erofs: unmounted for /dev/loop4 [ 362.768510] erofs: bogus i_mode (0) @ nid 0 [ 362.775702] erofs: unmounted for /dev/loop2 [ 362.883020] FAULT_INJECTION: forcing a failure. [ 362.883020] name failslab, interval 1, probability 0, space 0, times 0 [ 362.919920] CPU: 1 PID: 22882 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 362.927821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 362.937252] Call Trace: [ 362.939856] dump_stack+0x1fc/0x2ef [ 362.943520] should_fail.cold+0xa/0xf [ 362.947332] ? setup_fault_attr+0x200/0x200 [ 362.951660] ? lock_acquire+0x170/0x3c0 [ 362.955650] __should_failslab+0x115/0x180 [ 362.959999] should_failslab+0x5/0x10 [ 362.963888] kmem_cache_alloc_node+0x245/0x3b0 [ 362.968483] __alloc_skb+0x71/0x560 [ 362.972127] alloc_uevent_skb+0x7b/0x210 [ 362.976199] kobject_uevent_env+0xa90/0x1480 [ 362.980630] lo_ioctl+0xff9/0x20e0 [ 362.984180] ? loop_set_status64+0x110/0x110 [ 362.988591] blkdev_ioctl+0x5cb/0x1a80 [ 362.992483] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 362.997847] ? blkpg_ioctl+0x9d0/0x9d0 [ 363.001741] ? mark_held_locks+0xf0/0xf0 [ 363.005805] ? mark_held_locks+0xf0/0xf0 [ 363.009873] ? debug_check_no_obj_freed+0x201/0x490 [ 363.014900] ? lock_downgrade+0x720/0x720 [ 363.019053] block_ioctl+0xe9/0x130 [ 363.022685] ? blkdev_fallocate+0x3f0/0x3f0 [ 363.027010] do_vfs_ioctl+0xcdb/0x12e0 [ 363.030905] ? lock_downgrade+0x720/0x720 [ 363.035057] ? check_preemption_disabled+0x41/0x280 [ 363.040078] ? ioctl_preallocate+0x200/0x200 [ 363.044492] ? __fget+0x356/0x510 [ 363.047949] ? do_dup2+0x450/0x450 [ 363.051493] ? do_sys_open+0x2bf/0x520 [ 363.055391] ksys_ioctl+0x9b/0xc0 [ 363.058851] __x64_sys_ioctl+0x6f/0xb0 [ 363.062742] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 363.067328] do_syscall_64+0xf9/0x620 [ 363.071136] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 363.076324] RIP: 0033:0x7f9c3f20e037 [ 363.080039] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 363.098938] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 363.106643] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 363.113915] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 363.121209] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 363.128476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 363.135745] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 363.138534] 9pnet: Could not find request transport: xen [ 363.192752] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 363.226393] 9pnet: Could not find request transport: xen 20:43:14 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:14 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(0x0, &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:14 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x4000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 363.397069] erofs: read_super, device -> /dev/loop4 [ 363.430499] erofs: options -> noacl,acl, [ 363.464628] erofs: root inode @ nid 36 [ 363.470604] erofs: read_super, device -> /dev/loop2 [ 363.505815] erofs: read_super, device -> /dev/loop0 [ 363.513563] erofs: mounted on /dev/loop4 with opts: noacl. [ 363.527519] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 363.554161] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:15 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 22) [ 363.583557] erofs: FAULT_INJECTION was not selected [ 363.615347] erofs: FAULT_INJECTION was not selected [ 363.616543] erofs: unmounted for /dev/loop4 [ 363.631710] erofs: root inode @ nid 36 [ 363.646325] erofs: root inode @ nid 0 [ 363.652704] erofs: mounted on /dev/loop2 with opts: noacl. [ 363.693282] 9pnet: Could not find request transport: xen [ 363.703780] erofs: bogus i_mode (0) @ nid 0 [ 363.704020] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 20:43:15 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x8303, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:15 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x5000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 363.756219] erofs: unmounted for /dev/loop2 [ 363.801631] overlayfs: failed to resolve './file': -2 [ 363.808729] FAULT_INJECTION: forcing a failure. [ 363.808729] name failslab, interval 1, probability 0, space 0, times 0 [ 363.827808] CPU: 0 PID: 22915 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 363.835700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 363.845050] Call Trace: [ 363.845149] 9pnet: Could not find request transport: xen [ 363.847643] dump_stack+0x1fc/0x2ef [ 363.847664] should_fail.cold+0xa/0xf [ 363.847683] ? setup_fault_attr+0x200/0x200 [ 363.847699] ? lock_acquire+0x170/0x3c0 [ 363.847720] __should_failslab+0x115/0x180 [ 363.847738] should_failslab+0x5/0x10 [ 363.847753] kmem_cache_alloc_node+0x245/0x3b0 [ 363.847774] __alloc_skb+0x71/0x560 [ 363.847797] alloc_uevent_skb+0x7b/0x210 [ 363.889131] kobject_uevent_env+0xa90/0x1480 [ 363.893556] lo_ioctl+0xff9/0x20e0 [ 363.897109] ? loop_set_status64+0x110/0x110 [ 363.901521] blkdev_ioctl+0x5cb/0x1a80 [ 363.905414] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 363.910778] ? blkpg_ioctl+0x9d0/0x9d0 [ 363.914675] ? mark_held_locks+0xf0/0xf0 [ 363.918741] ? mark_held_locks+0xf0/0xf0 [ 363.922807] ? debug_check_no_obj_freed+0x201/0x490 [ 363.927831] ? lock_downgrade+0x720/0x720 [ 363.931982] block_ioctl+0xe9/0x130 [ 363.935629] ? blkdev_fallocate+0x3f0/0x3f0 [ 363.939957] do_vfs_ioctl+0xcdb/0x12e0 [ 363.943852] ? lock_downgrade+0x720/0x720 [ 363.948032] ? check_preemption_disabled+0x41/0x280 [ 363.953059] ? ioctl_preallocate+0x200/0x200 [ 363.957474] ? __fget+0x356/0x510 [ 363.960952] ? do_dup2+0x450/0x450 [ 363.964521] ? do_sys_open+0x2bf/0x520 [ 363.968416] ksys_ioctl+0x9b/0xc0 [ 363.971872] __x64_sys_ioctl+0x6f/0xb0 [ 363.975759] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 363.980343] do_syscall_64+0xf9/0x620 [ 363.984170] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 363.989359] RIP: 0033:0x7f9c3f20e037 [ 363.993095] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 364.011990] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 364.019696] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 364.026962] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 364.034229] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 364.041503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 20:43:15 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(0x0, &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 364.048776] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 364.080493] erofs: read_super, device -> /dev/loop0 [ 364.085640] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 364.091878] erofs: read_super, device -> /dev/loop4 [ 364.106736] erofs: options -> noacl,acl, [ 364.115043] erofs: FAULT_INJECTION was not selected [ 364.123913] erofs: root inode @ nid 0 [ 364.131437] erofs: bogus i_mode (0) @ nid 0 [ 364.135927] erofs: root inode @ nid 36 [ 364.146118] erofs: mounted on /dev/loop4 with opts: noacl. [ 364.159372] erofs: read_super, device -> /dev/loop2 [ 364.207245] erofs: unmounted for /dev/loop4 [ 364.213384] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 364.230121] erofs: FAULT_INJECTION was not selected [ 364.235295] erofs: root inode @ nid 36 [ 364.245130] erofs: mounted on /dev/loop2 with opts: noacl. [ 364.292938] erofs: unmounted for /dev/loop2 20:43:15 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:15 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(0x0, &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:15 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x6000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:15 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 23) 20:43:15 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x8926, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 364.329054] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 364.397251] 9pnet: Could not find request transport: xen [ 364.478045] erofs: read_super, device -> /dev/loop0 [ 364.490128] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 364.500560] FAULT_INJECTION: forcing a failure. [ 364.500560] name failslab, interval 1, probability 0, space 0, times 0 [ 364.543938] CPU: 0 PID: 22950 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 364.551837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 364.561184] Call Trace: [ 364.563778] dump_stack+0x1fc/0x2ef [ 364.564934] erofs: FAULT_INJECTION was not selected [ 364.567411] should_fail.cold+0xa/0xf [ 364.567431] ? setup_fault_attr+0x200/0x200 [ 364.567447] ? lock_acquire+0x170/0x3c0 [ 364.567468] __should_failslab+0x115/0x180 [ 364.567487] should_failslab+0x5/0x10 [ 364.586915] erofs: root inode @ nid 0 [ 364.588763] kmem_cache_alloc_trace+0x284/0x380 [ 364.588778] ? wait_for_completion_io+0x10/0x10 [ 364.588795] ? kobj_ns_initial+0x90/0x90 [ 364.588811] call_usermodehelper_setup+0x84/0x300 [ 364.588830] kobject_uevent_env+0xe83/0x1480 [ 364.588857] lo_ioctl+0xff9/0x20e0 [ 364.588874] ? loop_set_status64+0x110/0x110 [ 364.588889] blkdev_ioctl+0x5cb/0x1a80 [ 364.597908] erofs: bogus i_mode (0) @ nid 0 [ 364.601116] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 364.601132] ? blkpg_ioctl+0x9d0/0x9d0 [ 364.601149] ? mark_held_locks+0xf0/0xf0 [ 364.601162] ? mark_held_locks+0xf0/0xf0 [ 364.601178] ? debug_check_no_obj_freed+0x201/0x490 [ 364.657503] ? lock_downgrade+0x720/0x720 [ 364.661660] block_ioctl+0xe9/0x130 [ 364.665291] ? blkdev_fallocate+0x3f0/0x3f0 [ 364.669620] do_vfs_ioctl+0xcdb/0x12e0 [ 364.673516] ? lock_downgrade+0x720/0x720 [ 364.677669] ? check_preemption_disabled+0x41/0x280 [ 364.682687] ? ioctl_preallocate+0x200/0x200 [ 364.687109] ? __fget+0x356/0x510 [ 364.690569] ? do_dup2+0x450/0x450 [ 364.694110] ? do_sys_open+0x2bf/0x520 [ 364.698008] ksys_ioctl+0x9b/0xc0 [ 364.701466] __x64_sys_ioctl+0x6f/0xb0 [ 364.705355] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 364.709936] do_syscall_64+0xf9/0x620 [ 364.713741] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 364.718932] RIP: 0033:0x7f9c3f20e037 [ 364.722649] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:43:16 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 364.741547] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 364.749258] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 364.756524] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 364.763794] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 364.764152] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 364.771059] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 364.771068] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 364.804070] 9pnet: Could not find request transport: xen [ 364.820960] erofs: read_super, device -> /dev/loop4 [ 364.826434] erofs: options -> noacl,acl, [ 364.846880] erofs: root inode @ nid 36 [ 364.854439] erofs: read_super, device -> /dev/loop2 [ 364.881665] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:16 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x7000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 364.900770] erofs: mounted on /dev/loop4 with opts: noacl. [ 364.927776] erofs: FAULT_INJECTION was not selected [ 364.964155] erofs: root inode @ nid 36 20:43:16 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 24) 20:43:16 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x9903, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 364.985110] erofs: mounted on /dev/loop2 with opts: noacl. [ 365.006753] erofs: unmounted for /dev/loop4 [ 365.013018] erofs: unmounted for /dev/loop2 [ 365.013742] erofs: read_super, device -> /dev/loop0 [ 365.026319] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:16 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(0x0, &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 365.036816] erofs: FAULT_INJECTION was not selected [ 365.045887] erofs: root inode @ nid 0 [ 365.051461] erofs: bogus i_mode (0) @ nid 0 20:43:16 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x8000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 365.137396] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 365.167270] 9pnet: Could not find request transport: xen [ 365.182728] FAULT_INJECTION: forcing a failure. [ 365.182728] name failslab, interval 1, probability 0, space 0, times 0 [ 365.239508] CPU: 1 PID: 22974 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 365.247413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 365.256763] Call Trace: [ 365.259358] dump_stack+0x1fc/0x2ef [ 365.262997] should_fail.cold+0xa/0xf [ 365.266806] ? setup_fault_attr+0x200/0x200 [ 365.271134] ? lock_acquire+0x170/0x3c0 [ 365.275117] __should_failslab+0x115/0x180 [ 365.279358] should_failslab+0x5/0x10 [ 365.283165] kmem_cache_alloc+0x277/0x370 [ 365.287317] skb_clone+0x151/0x3d0 [ 365.290868] netlink_broadcast_filtered+0x8e5/0xbc0 [ 365.295900] netlink_broadcast+0x35/0x40 [ 365.299970] kobject_uevent_env+0xa56/0x1480 [ 365.304396] lo_ioctl+0xff9/0x20e0 [ 365.307946] ? loop_set_status64+0x110/0x110 [ 365.312361] blkdev_ioctl+0x5cb/0x1a80 [ 365.316256] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 365.321621] ? blkpg_ioctl+0x9d0/0x9d0 [ 365.325517] ? mark_held_locks+0xf0/0xf0 [ 365.329585] ? mark_held_locks+0xf0/0xf0 [ 365.333656] ? debug_check_no_obj_freed+0x201/0x490 [ 365.338681] ? lock_downgrade+0x720/0x720 [ 365.342836] block_ioctl+0xe9/0x130 [ 365.346471] ? blkdev_fallocate+0x3f0/0x3f0 [ 365.350797] do_vfs_ioctl+0xcdb/0x12e0 [ 365.354694] ? lock_downgrade+0x720/0x720 [ 365.358849] ? check_preemption_disabled+0x41/0x280 [ 365.363867] ? ioctl_preallocate+0x200/0x200 [ 365.368284] ? __fget+0x356/0x510 [ 365.371743] ? do_dup2+0x450/0x450 [ 365.375288] ? do_sys_open+0x2bf/0x520 [ 365.379181] ksys_ioctl+0x9b/0xc0 [ 365.382637] __x64_sys_ioctl+0x6f/0xb0 [ 365.386531] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 365.389775] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 365.391108] do_syscall_64+0xf9/0x620 [ 365.391129] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 365.391141] RIP: 0033:0x7f9c3f20e037 [ 365.391156] Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 34 54 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 365.391163] RSP: 002b:00007f9c3db82f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 20:43:16 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 365.391177] RAX: ffffffffffffffda RBX: 00007f9c3f257a20 RCX: 00007f9c3f20e037 [ 365.391190] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 365.453561] 9pnet: Could not find request transport: xen [ 365.455122] RBP: 0000000000000005 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 365.455131] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 365.455140] R13: 0000000000000004 R14: 0000000020000188 R15: 0000000000000003 [ 365.464823] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 365.509274] erofs: read_super, device -> /dev/loop4 [ 365.514552] erofs: options -> noacl,acl, [ 365.521831] erofs: read_super, device -> /dev/loop0 [ 365.526861] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 365.534185] erofs: read_super, device -> /dev/loop2 [ 365.543099] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 365.556036] erofs: root inode @ nid 36 [ 365.563560] erofs: FAULT_INJECTION was not selected [ 365.570111] erofs: mounted on /dev/loop4 with opts: noacl. [ 365.577124] erofs: FAULT_INJECTION was not selected [ 365.588659] erofs: root inode @ nid 36 [ 365.592716] erofs: root inode @ nid 0 [ 365.602872] erofs: mounted on /dev/loop2 with opts: noacl. [ 365.609706] erofs: bogus i_mode (0) @ nid 0 [ 365.629466] erofs: unmounted for /dev/loop4 [ 365.716786] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 365.736003] erofs: unmounted for /dev/loop2 [ 365.746029] 9pnet: Could not find request transport: xen 20:43:17 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:17 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 25) 20:43:17 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x15000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:17 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:17 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x9a03, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:17 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 365.987017] erofs: read_super, device -> /dev/loop0 [ 365.990510] erofs: read_super, device -> /dev/loop2 [ 366.007226] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 366.023224] FAULT_INJECTION: forcing a failure. [ 366.023224] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 366.023360] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 366.035030] CPU: 0 PID: 23019 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 366.035040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 366.035045] Call Trace: [ 366.035067] dump_stack+0x1fc/0x2ef [ 366.035087] should_fail.cold+0xa/0xf [ 366.035107] ? setup_fault_attr+0x200/0x200 [ 366.035125] ? __mutex_unlock_slowpath+0xea/0x610 [ 366.035143] __alloc_pages_nodemask+0x239/0x2890 [ 366.035168] ? __lock_acquire+0x6de/0x3ff0 [ 366.035188] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 366.035203] ? blkdev_ioctl+0x11a/0x1a80 [ 366.096461] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 366.101837] ? blkpg_ioctl+0x9d0/0x9d0 [ 366.105747] ? debug_check_no_obj_freed+0x201/0x490 [ 366.110776] ? lock_downgrade+0x720/0x720 [ 366.114933] cache_grow_begin+0xa4/0x8a0 [ 366.119005] ? setup_fault_attr+0x200/0x200 [ 366.123332] ? lock_acquire+0x170/0x3c0 [ 366.127313] cache_alloc_refill+0x273/0x340 [ 366.131678] kmem_cache_alloc+0x346/0x370 [ 366.135834] getname_flags+0xce/0x590 [ 366.139640] do_mkdirat+0x8d/0x2d0 [ 366.143184] ? __ia32_sys_mknod+0x120/0x120 [ 366.147516] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 366.152883] ? trace_hardirqs_off_caller+0x6e/0x210 [ 366.157902] ? do_syscall_64+0x21/0x620 [ 366.161913] do_syscall_64+0xf9/0x620 [ 366.165728] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 366.170915] RIP: 0033:0x7f9c3f20d387 [ 366.172245] erofs: FAULT_INJECTION was not selected [ 366.174628] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 366.174637] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 366.174651] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20d387 [ 366.174659] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 366.174668] RBP: 00007f9c3db831d0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 366.174676] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 366.174684] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 366.176763] erofs: read_super, device -> /dev/loop4 [ 366.199265] 9pnet: Could not find request transport: xen [ 366.206704] erofs: options -> noacl,acl, [ 366.234644] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 366.243676] erofs: root inode @ nid 36 [ 366.272778] erofs: mounted on /dev/loop4 with opts: noacl. 20:43:17 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 26) [ 366.281149] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 366.306599] erofs: FAULT_INJECTION was not selected [ 366.312800] erofs: unmounted for /dev/loop4 [ 366.315474] erofs: root inode @ nid 36 [ 366.323485] erofs: root inode @ nid 0 [ 366.330893] erofs: mounted on /dev/loop2 with opts: noacl. [ 366.337811] erofs: bogus i_mode (0) @ nid 0 [ 366.341675] 9pnet: Could not find request transport: xen 20:43:17 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:17 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x9b03, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:17 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x16000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 366.421884] erofs: unmounted for /dev/loop2 [ 366.487432] FAULT_INJECTION: forcing a failure. [ 366.487432] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 366.499256] CPU: 0 PID: 23039 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 366.507137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 366.516488] Call Trace: [ 366.519078] dump_stack+0x1fc/0x2ef [ 366.522713] should_fail.cold+0xa/0xf [ 366.526525] ? setup_fault_attr+0x200/0x200 [ 366.530855] ? wake_up_q+0x93/0xe0 [ 366.534409] ? __mutex_unlock_slowpath+0x2be/0x610 [ 366.539348] __alloc_pages_nodemask+0x239/0x2890 [ 366.544119] ? __lock_acquire+0x6de/0x3ff0 [ 366.548365] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 366.553214] ? blkdev_ioctl+0x11a/0x1a80 [ 366.557281] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 366.562643] ? blkpg_ioctl+0x9d0/0x9d0 [ 366.566567] ? debug_check_no_obj_freed+0x201/0x490 [ 366.571591] ? lock_downgrade+0x720/0x720 [ 366.575752] cache_grow_begin+0xa4/0x8a0 [ 366.579819] ? setup_fault_attr+0x200/0x200 [ 366.584143] ? lock_acquire+0x170/0x3c0 [ 366.588125] cache_alloc_refill+0x273/0x340 [ 366.592461] kmem_cache_alloc+0x346/0x370 [ 366.596704] getname_flags+0xce/0x590 [ 366.600513] do_mkdirat+0x8d/0x2d0 [ 366.604055] ? __ia32_sys_mknod+0x120/0x120 [ 366.608399] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 366.613769] ? trace_hardirqs_off_caller+0x6e/0x210 [ 366.618790] ? do_syscall_64+0x21/0x620 [ 366.622771] do_syscall_64+0xf9/0x620 [ 366.626583] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 366.631775] RIP: 0033:0x7f9c3f20d387 20:43:18 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 366.635497] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 366.654406] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 366.662300] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20d387 [ 366.669571] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 366.676847] RBP: 00007f9c3db831d0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 366.684120] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 366.691393] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 366.724493] 9pnet: Could not find request transport: xen [ 366.736069] erofs: read_super, device -> /dev/loop0 [ 366.760211] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 366.785606] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 366.803339] erofs: FAULT_INJECTION was not selected 20:43:18 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 366.804872] erofs: read_super, device -> /dev/loop2 [ 366.821559] erofs: root inode @ nid 0 [ 366.828620] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 366.850327] erofs: bogus i_mode (0) @ nid 0 [ 366.896143] erofs: FAULT_INJECTION was not selected [ 366.946882] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 366.954590] erofs: root inode @ nid 36 [ 366.988552] 9pnet: Could not find request transport: xen [ 367.024996] erofs: mounted on /dev/loop2 with opts: noacl. [ 367.046448] erofs: read_super, device -> /dev/loop4 [ 367.051633] erofs: options -> noacl,acl, [ 367.059322] erofs: root inode @ nid 36 [ 367.072495] erofs: mounted on /dev/loop4 with opts: noacl. [ 367.088237] erofs: unmounted for /dev/loop2 [ 367.096698] 9pnet: Could not find request transport: xen [ 367.109121] erofs: unmounted for /dev/loop4 [ 367.112480] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 20:43:18 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:18 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x9c03, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:18 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x17000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:18 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 27) 20:43:18 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 367.321286] FAULT_INJECTION: forcing a failure. [ 367.321286] name failslab, interval 1, probability 0, space 0, times 0 [ 367.340404] CPU: 0 PID: 23075 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 367.348307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 367.357663] Call Trace: [ 367.360264] dump_stack+0x1fc/0x2ef [ 367.363904] should_fail.cold+0xa/0xf [ 367.367722] ? setup_fault_attr+0x200/0x200 [ 367.372053] ? lock_acquire+0x170/0x3c0 [ 367.376042] __should_failslab+0x115/0x180 [ 367.380290] should_failslab+0x5/0x10 [ 367.384096] kmem_cache_alloc+0x277/0x370 [ 367.388254] getname_flags+0xce/0x590 [ 367.392065] do_mkdirat+0x8d/0x2d0 [ 367.395614] ? __ia32_sys_mknod+0x120/0x120 [ 367.399943] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 367.405315] ? trace_hardirqs_off_caller+0x6e/0x210 [ 367.410335] ? do_syscall_64+0x21/0x620 [ 367.414331] do_syscall_64+0xf9/0x620 [ 367.418142] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 367.423333] RIP: 0033:0x7f9c3f20d387 [ 367.427051] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 367.445951] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 367.453661] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20d387 [ 367.460930] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 367.468202] RBP: 00007f9c3db831d0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 367.475474] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 367.480447] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 367.482738] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 367.502529] erofs: read_super, device -> /dev/loop2 [ 367.512940] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 367.526195] 9pnet: Could not find request transport: xen [ 367.545266] erofs: read_super, device -> /dev/loop0 [ 367.566394] erofs: FAULT_INJECTION was not selected 20:43:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 367.578759] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 367.586728] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 367.600381] erofs: root inode @ nid 36 [ 367.606951] 9pnet: Could not find request transport: xen [ 367.616029] erofs: FAULT_INJECTION was not selected 20:43:19 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 367.643014] erofs: mounted on /dev/loop2 with opts: noacl. [ 367.670852] erofs: root inode @ nid 0 [ 367.687248] erofs: bogus i_mode (0) @ nid 0 20:43:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:19 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x9d03, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:19 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 367.708204] erofs: unmounted for /dev/loop2 20:43:19 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 28) [ 367.835904] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 367.863785] erofs: read_super, device -> /dev/loop2 [ 367.867132] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 20:43:19 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x20000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 367.890094] 9pnet: Could not find request transport: xen [ 367.896777] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 367.904156] 9pnet: Could not find request transport: xen [ 367.935757] FAULT_INJECTION: forcing a failure. [ 367.935757] name failslab, interval 1, probability 0, space 0, times 0 [ 367.947938] erofs: FAULT_INJECTION was not selected [ 367.956801] CPU: 1 PID: 23126 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 367.964788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 367.965482] erofs: read_super, device -> /dev/loop0 [ 367.974134] Call Trace: [ 367.974156] dump_stack+0x1fc/0x2ef [ 367.974176] should_fail.cold+0xa/0xf [ 367.974192] ? setup_fault_attr+0x200/0x200 [ 367.974212] __should_failslab+0x115/0x180 [ 367.996171] erofs: root inode @ nid 36 [ 367.997732] should_failslab+0x5/0x10 [ 367.997747] kmem_cache_alloc+0x277/0x370 [ 367.997764] ? ext4_sync_fs+0x8d0/0x8d0 [ 367.997777] ext4_alloc_inode+0x1a/0x630 [ 367.997793] ? ext4_sync_fs+0x8d0/0x8d0 [ 368.013147] erofs: mounted on /dev/loop2 with opts: noacl. [ 368.013629] alloc_inode+0x5d/0x180 [ 368.030876] new_inode+0x1d/0xf0 [ 368.034258] __ext4_new_inode+0x400/0x5a20 [ 368.038509] ? putname+0xe1/0x120 [ 368.041966] ? do_mkdirat+0xa0/0x2d0 [ 368.045695] ? ext4_free_inode+0x1780/0x1780 [ 368.050114] ? debug_check_no_obj_freed+0x201/0x490 [ 368.054154] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 368.055133] ? __dquot_initialize+0x298/0xb70 [ 368.055153] ? lock_acquire+0x170/0x3c0 [ 368.055170] ? dquot_initialize_needed+0x290/0x290 [ 368.075610] ? trace_hardirqs_off+0x64/0x200 [ 368.080029] ? common_perm+0x4be/0x800 [ 368.084365] ext4_mkdir+0x396/0xe10 [ 368.085905] erofs: FAULT_INJECTION was not selected [ 368.088001] ? putname+0xe1/0x120 [ 368.088022] ? ext4_init_dot_dotdot+0x600/0x600 [ 368.088039] ? generic_permission+0x116/0x4d0 [ 368.088053] ? security_inode_permission+0xc5/0xf0 [ 368.088069] ? inode_permission.part.0+0x10c/0x450 [ 368.098860] erofs: root inode @ nid 0 [ 368.101158] vfs_mkdir+0x508/0x7a0 [ 368.101180] do_mkdirat+0x262/0x2d0 [ 368.109984] erofs: bogus i_mode (0) @ nid 0 [ 368.110571] ? __ia32_sys_mknod+0x120/0x120 [ 368.135020] ? trace_hardirqs_off_caller+0x6e/0x210 [ 368.140040] ? do_syscall_64+0x21/0x620 [ 368.144025] do_syscall_64+0xf9/0x620 [ 368.147829] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 368.153008] RIP: 0033:0x7f9c3f20d387 [ 368.156710] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 368.175596] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 20:43:19 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:19 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 368.183292] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20d387 [ 368.190548] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 368.197802] RBP: 00007f9c3db831d0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 368.205058] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 368.212315] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 20:43:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:19 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x9e03, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:19 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3f000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 368.233090] erofs: unmounted for /dev/loop2 [ 368.325283] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 368.349940] 9pnet: Could not find request transport: xen 20:43:19 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:20 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 29) [ 368.567287] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 368.603877] erofs: read_super, device -> /dev/loop2 [ 368.614181] 9pnet: Could not find request transport: xen [ 368.630161] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:20 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:20 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x9f03, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 368.673055] erofs: FAULT_INJECTION was not selected [ 368.692268] erofs: root inode @ nid 36 [ 368.701869] erofs: mounted on /dev/loop2 with opts: noacl. [ 368.746271] erofs: unmounted for /dev/loop2 [ 368.871426] erofs: read_super, device -> /dev/loop2 [ 368.876716] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 368.889728] FAULT_INJECTION: forcing a failure. [ 368.889728] name failslab, interval 1, probability 0, space 0, times 0 [ 368.901100] CPU: 0 PID: 23168 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 368.908049] erofs: read_super, device -> /dev/loop0 [ 368.909004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 368.914095] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 368.923379] Call Trace: [ 368.923401] dump_stack+0x1fc/0x2ef [ 368.923419] should_fail.cold+0xa/0xf [ 368.923437] ? setup_fault_attr+0x200/0x200 [ 368.923452] ? __es_tree_search.isra.0+0x1af/0x210 [ 368.923472] __should_failslab+0x115/0x180 [ 368.923488] should_failslab+0x5/0x10 [ 368.923504] kmem_cache_alloc+0x3f/0x370 [ 368.961829] __es_insert_extent+0x39b/0x13b0 [ 368.966246] ? lock_acquire+0x170/0x3c0 [ 368.970225] ? ext4_es_insert_extent+0x17e/0x5e0 [ 368.974995] ext4_es_insert_extent+0x22e/0x5e0 [ 368.979586] ? lock_downgrade+0x720/0x720 [ 368.983745] ? ext4_es_find_delayed_extent_range+0x9f0/0x9f0 [ 368.989559] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 368.994611] ? ext4_es_find_delayed_extent_range+0x7d9/0x9f0 [ 369.000421] ext4_ext_map_blocks+0x2129/0x7390 [ 369.005014] ? __lock_acquire+0x6de/0x3ff0 [ 369.009259] ? __lock_acquire+0x6de/0x3ff0 [ 369.013504] ? mark_held_locks+0xf0/0xf0 [ 369.017573] ? __ext4_handle_dirty_metadata+0x1e0/0x590 [ 369.022943] ? ext4_find_delalloc_cluster+0x1f0/0x1f0 [ 369.028143] ? mark_held_locks+0xf0/0xf0 [ 369.032237] ? ext4_mark_iloc_dirty+0x1b0d/0x2b30 [ 369.037106] ? ext4_es_lookup_extent+0x375/0xb60 [ 369.041875] ? check_preemption_disabled+0x41/0x280 [ 369.046901] ? lock_acquire+0x170/0x3c0 [ 369.050880] ? ext4_map_blocks+0x33e/0x1a50 [ 369.050899] erofs: FAULT_INJECTION was not selected [ 369.055224] ext4_map_blocks+0xd88/0x1a50 [ 369.055247] ? check_preemption_disabled+0x41/0x280 [ 369.055266] ? ext4_issue_zeroout+0x160/0x160 [ 369.055282] ? __brelse+0x84/0xa0 [ 369.055297] ? __ext4_new_inode+0x2eb/0x5a20 [ 369.055317] ext4_getblk+0xad/0x4f0 [ 369.055332] ? ext4_iomap_begin+0xe00/0xe00 [ 369.055348] ? ext4_free_inode+0x1780/0x1780 [ 369.055361] ? debug_check_no_obj_freed+0x201/0x490 [ 369.055374] ? __dquot_initialize+0x298/0xb70 [ 369.055392] ext4_bread+0x7c/0x210 [ 369.055407] ? ext4_getblk+0x4f0/0x4f0 [ 369.055421] ? dquot_initialize_needed+0x290/0x290 [ 369.055438] ? trace_hardirqs_off+0x64/0x200 [ 369.055455] ext4_append+0x155/0x370 [ 369.055475] ext4_mkdir+0x5bd/0xe10 [ 369.055497] ? ext4_init_dot_dotdot+0x600/0x600 [ 369.055514] ? generic_permission+0x116/0x4d0 [ 369.055533] ? inode_permission.part.0+0x10c/0x450 [ 369.055552] vfs_mkdir+0x508/0x7a0 [ 369.055568] do_mkdirat+0x262/0x2d0 [ 369.055583] ? __ia32_sys_mknod+0x120/0x120 [ 369.055600] ? trace_hardirqs_off_caller+0x6e/0x210 [ 369.055615] ? do_syscall_64+0x21/0x620 [ 369.055632] do_syscall_64+0xf9/0x620 20:43:20 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 369.055652] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 369.055663] RIP: 0033:0x7f9c3f20d387 [ 369.055677] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 369.055685] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 369.055699] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20d387 [ 369.055707] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 369.055715] RBP: 00007f9c3db831d0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 369.055730] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 369.055739] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 369.062470] erofs: read_super, device -> /dev/loop4 [ 369.099836] 9pnet: Could not find request transport: xen [ 369.106192] erofs: options -> noacl,acl, [ 369.127590] erofs: FAULT_INJECTION was not selected [ 369.142063] erofs: root inode @ nid 36 [ 369.176716] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 369.226924] erofs: root inode @ nid 36 [ 369.263715] erofs: root inode @ nid 0 [ 369.284821] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 369.296588] 9pnet: Could not find request transport: xen [ 369.313158] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:20 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 369.323476] erofs: mounted on /dev/loop4 with opts: noacl. [ 369.340745] erofs: bogus i_mode (0) @ nid 0 20:43:20 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xa003, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:20 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 369.399298] erofs: unmounted for /dev/loop2 20:43:20 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 30) [ 369.582976] erofs: unmounted for /dev/loop4 20:43:21 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x8cffffff, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 369.624275] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 369.646539] 9pnet: Could not find request transport: xen [ 369.673685] erofs: read_super, device -> /dev/loop2 20:43:21 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 369.695507] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 369.732877] erofs: FAULT_INJECTION was not selected [ 369.758134] FAULT_INJECTION: forcing a failure. [ 369.758134] name failslab, interval 1, probability 0, space 0, times 0 [ 369.764643] erofs: root inode @ nid 36 [ 369.770151] CPU: 1 PID: 23209 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 369.778796] erofs: read_super, device -> /dev/loop0 [ 369.781256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 369.781262] Call Trace: [ 369.781280] dump_stack+0x1fc/0x2ef [ 369.781299] should_fail.cold+0xa/0xf [ 369.789275] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 369.795644] ? setup_fault_attr+0x200/0x200 [ 369.795667] __should_failslab+0x115/0x180 [ 369.795685] should_failslab+0x5/0x10 [ 369.795706] kmem_cache_alloc+0x277/0x370 [ 369.800084] 9pnet: Could not find request transport: xen [ 369.801889] ? ext4_sync_fs+0x8d0/0x8d0 [ 369.801907] ext4_alloc_inode+0x1a/0x630 [ 369.821303] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 369.824430] ? ext4_sync_fs+0x8d0/0x8d0 [ 369.824445] alloc_inode+0x5d/0x180 [ 369.824460] new_inode+0x1d/0xf0 [ 369.836686] erofs: mounted on /dev/loop2 with opts: noacl. [ 369.837812] __ext4_new_inode+0x400/0x5a20 [ 369.837834] ? putname+0xe1/0x120 [ 369.837845] ? do_mkdirat+0xa0/0x2d0 [ 369.837867] ? ext4_free_inode+0x1780/0x1780 [ 369.858411] erofs: FAULT_INJECTION was not selected [ 369.860512] ? debug_check_no_obj_freed+0x201/0x490 [ 369.860527] ? __dquot_initialize+0x298/0xb70 [ 369.860546] ? lock_acquire+0x170/0x3c0 [ 369.884919] erofs: root inode @ nid 0 [ 369.885243] ? dquot_initialize_needed+0x290/0x290 [ 369.885262] ? trace_hardirqs_off+0x64/0x200 [ 369.916799] ? common_perm+0x4be/0x800 [ 369.920704] ext4_mkdir+0x396/0xe10 [ 369.924341] ? putname+0xe1/0x120 [ 369.927804] ? ext4_init_dot_dotdot+0x600/0x600 [ 369.929423] erofs: bogus i_mode (0) @ nid 0 [ 369.932471] ? generic_permission+0x116/0x4d0 [ 369.932490] ? security_inode_permission+0xc5/0xf0 [ 369.946200] ? inode_permission.part.0+0x10c/0x450 [ 369.951146] vfs_mkdir+0x508/0x7a0 [ 369.954694] do_mkdirat+0x262/0x2d0 [ 369.958330] ? __ia32_sys_mknod+0x120/0x120 [ 369.962663] ? trace_hardirqs_off_caller+0x6e/0x210 [ 369.967692] ? do_syscall_64+0x21/0x620 [ 369.971680] do_syscall_64+0xf9/0x620 [ 369.975494] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 369.980689] RIP: 0033:0x7f9c3f20d387 [ 369.980812] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 369.984398] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 369.984406] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 369.984419] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20d387 [ 369.984431] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 370.011427] 9pnet: Could not find request transport: xen [ 370.013522] RBP: 00007f9c3db831d0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 370.013530] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 20:43:21 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xa103, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:21 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:21 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xc0ed0000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:21 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 370.013539] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 370.059013] erofs: unmounted for /dev/loop2 20:43:21 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:21 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 31) [ 370.215827] erofs: read_super, device -> /dev/loop0 [ 370.224177] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 370.240074] erofs: read_super, device -> /dev/loop2 [ 370.245109] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 370.273848] erofs: FAULT_INJECTION was not selected [ 370.286242] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 370.318331] FAULT_INJECTION: forcing a failure. [ 370.318331] name failslab, interval 1, probability 0, space 0, times 0 [ 370.339661] 9pnet: Could not find request transport: xen [ 370.351895] erofs: root inode @ nid 0 [ 370.388949] erofs: FAULT_INJECTION was not selected [ 370.394463] erofs: bogus i_mode (0) @ nid 0 [ 370.405377] CPU: 0 PID: 23242 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 370.413264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 370.422613] Call Trace: [ 370.425209] dump_stack+0x1fc/0x2ef [ 370.428838] should_fail.cold+0xa/0xf [ 370.432659] ? setup_fault_attr+0x200/0x200 [ 370.437090] ? lock_downgrade+0x720/0x720 [ 370.441245] ? check_preemption_disabled+0x41/0x280 [ 370.446267] __should_failslab+0x115/0x180 [ 370.450507] should_failslab+0x5/0x10 [ 370.454307] kmem_cache_alloc+0x277/0x370 [ 370.458462] ext4_mb_new_blocks+0x60a/0x4370 [ 370.462878] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 370.467892] ? ext4_cache_extents+0x68/0x2d0 [ 370.472298] ? ext4_find_extent+0x9bb/0xc70 [ 370.476623] ? ext4_discard_preallocations+0xfb0/0xfb0 [ 370.481896] ? ext4_ext_search_right+0x2c7/0xb60 [ 370.486656] ? ext4_inode_to_goal_block+0x2d2/0x3e0 [ 370.491677] ext4_ext_map_blocks+0x2aa2/0x7390 [ 370.496272] ? __lock_acquire+0x6de/0x3ff0 [ 370.500512] ? mark_held_locks+0xf0/0xf0 [ 370.504588] ? __ext4_handle_dirty_metadata+0x1e0/0x590 [ 370.509950] ? ext4_find_delalloc_cluster+0x1f0/0x1f0 [ 370.515149] ? mark_held_locks+0xf0/0xf0 [ 370.519218] ? ext4_mark_iloc_dirty+0x1b0d/0x2b30 [ 370.524072] ? ext4_es_lookup_extent+0x375/0xb60 [ 370.528832] ? ext4_map_blocks+0x59f/0x1a50 [ 370.533174] ext4_map_blocks+0x7a2/0x1a50 [ 370.537333] ? check_preemption_disabled+0x41/0x280 [ 370.542359] ? ext4_issue_zeroout+0x160/0x160 [ 370.546860] ? __brelse+0x84/0xa0 [ 370.550346] ? __ext4_new_inode+0x2eb/0x5a20 [ 370.554775] ext4_getblk+0xad/0x4f0 [ 370.558411] ? ext4_iomap_begin+0xe00/0xe00 [ 370.562744] ? ext4_free_inode+0x1780/0x1780 [ 370.567160] ? __dquot_initialize+0x298/0xb70 [ 370.571666] ext4_bread+0x7c/0x210 [ 370.574795] erofs: root inode @ nid 36 [ 370.575233] ? ext4_getblk+0x4f0/0x4f0 [ 370.581809] erofs: mounted on /dev/loop2 with opts: noacl. [ 370.582985] ? dquot_initialize_needed+0x290/0x290 [ 370.593507] ? rcu_nmi_exit+0xb3/0x180 [ 370.597404] ext4_append+0x155/0x370 [ 370.601129] ext4_mkdir+0x5bd/0xe10 [ 370.604772] ? ext4_init_dot_dotdot+0x600/0x600 [ 370.609449] ? generic_permission+0x116/0x4d0 [ 370.613956] ? inode_permission.part.0+0x10c/0x450 [ 370.618894] vfs_mkdir+0x508/0x7a0 [ 370.622443] do_mkdirat+0x262/0x2d0 [ 370.626081] ? __ia32_sys_mknod+0x120/0x120 [ 370.630412] ? trace_hardirqs_off_caller+0x6e/0x210 [ 370.635436] ? do_syscall_64+0x21/0x620 [ 370.639420] do_syscall_64+0xf9/0x620 [ 370.643239] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 370.648432] RIP: 0033:0x7f9c3f20d387 [ 370.652150] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 370.671055] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 370.678761] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20d387 20:43:22 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 370.686018] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 370.693277] RBP: 00007f9c3db831d0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 370.700539] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 370.707810] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 20:43:22 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xf6ffffff, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:22 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xa203, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 370.749830] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 370.765149] erofs: unmounted for /dev/loop2 [ 370.774505] 9pnet: Could not find request transport: xen 20:43:22 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:22 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 32) [ 370.898941] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 370.933969] FAULT_INJECTION: forcing a failure. [ 370.933969] name failslab, interval 1, probability 0, space 0, times 0 [ 370.945423] CPU: 0 PID: 23265 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 370.953306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 370.962348] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 370.962651] Call Trace: [ 370.962671] dump_stack+0x1fc/0x2ef [ 370.962689] should_fail.cold+0xa/0xf [ 370.982884] ? setup_fault_attr+0x200/0x200 [ 370.987218] ? __es_tree_search.isra.0+0x1af/0x210 [ 370.992161] __should_failslab+0x115/0x180 [ 370.996409] should_failslab+0x5/0x10 [ 371.000216] kmem_cache_alloc+0x3f/0x370 [ 371.004282] __es_insert_extent+0x39b/0x13b0 [ 371.008736] ? lock_acquire+0x170/0x3c0 [ 371.012716] ? ext4_es_insert_extent+0x17e/0x5e0 [ 371.014518] 9pnet: Could not find request transport: xen [ 371.017480] ext4_es_insert_extent+0x22e/0x5e0 [ 371.017499] ? lock_downgrade+0x720/0x720 [ 371.017514] ? ext4_es_find_delayed_extent_range+0x9f0/0x9f0 [ 371.017534] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 371.017548] ? ext4_es_find_delayed_extent_range+0x7d9/0x9f0 [ 371.017565] ext4_ext_map_blocks+0x2129/0x7390 [ 371.052858] ? __lock_acquire+0x6de/0x3ff0 [ 371.057103] ? __lock_acquire+0x6de/0x3ff0 [ 371.061347] ? mark_held_locks+0xf0/0xf0 [ 371.065412] ? __ext4_handle_dirty_metadata+0x1e0/0x590 [ 371.070780] ? ext4_find_delalloc_cluster+0x1f0/0x1f0 [ 371.075978] ? mark_held_locks+0xf0/0xf0 [ 371.080046] ? ext4_mark_iloc_dirty+0x1b0d/0x2b30 [ 371.084897] ? ext4_es_lookup_extent+0x375/0xb60 [ 371.089663] ? check_preemption_disabled+0x41/0x280 [ 371.094688] ? lock_acquire+0x170/0x3c0 [ 371.098667] ? ext4_map_blocks+0x33e/0x1a50 [ 371.103004] ext4_map_blocks+0xd88/0x1a50 [ 371.107164] ? check_preemption_disabled+0x41/0x280 [ 371.112197] ? ext4_issue_zeroout+0x160/0x160 [ 371.116698] ? __brelse+0x84/0xa0 [ 371.120157] ? __ext4_new_inode+0x2eb/0x5a20 [ 371.124580] ext4_getblk+0xad/0x4f0 [ 371.128218] ? ext4_iomap_begin+0xe00/0xe00 [ 371.132546] ? ext4_free_inode+0x1780/0x1780 [ 371.136956] ? debug_check_no_obj_freed+0x201/0x490 [ 371.141973] ? __dquot_initialize+0x298/0xb70 20:43:22 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 371.145445] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 371.146471] ext4_bread+0x7c/0x210 [ 371.146487] ? ext4_getblk+0x4f0/0x4f0 [ 371.146504] ? dquot_initialize_needed+0x290/0x290 [ 371.146521] ? trace_hardirqs_off+0x64/0x200 [ 371.146539] ext4_append+0x155/0x370 [ 371.146558] ext4_mkdir+0x5bd/0xe10 [ 371.146581] ? ext4_init_dot_dotdot+0x600/0x600 [ 371.162906] 9pnet: Could not find request transport: xen [ 371.164212] ? generic_permission+0x116/0x4d0 [ 371.164233] ? inode_permission.part.0+0x10c/0x450 [ 371.164252] vfs_mkdir+0x508/0x7a0 [ 371.164268] do_mkdirat+0x262/0x2d0 [ 371.164284] ? __ia32_sys_mknod+0x120/0x120 [ 371.185204] erofs: read_super, device -> /dev/loop0 [ 371.185771] ? trace_hardirqs_off_caller+0x6e/0x210 [ 371.200450] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 371.200599] ? do_syscall_64+0x21/0x620 [ 371.223213] erofs: FAULT_INJECTION was not selected [ 371.229134] do_syscall_64+0xf9/0x620 [ 371.229157] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 371.229170] RIP: 0033:0x7f9c3f20d387 [ 371.229189] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 371.229197] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 371.229209] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20d387 [ 371.229218] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c [ 371.229225] RBP: 00007f9c3db831d0 R08: 0000000000000000 R09: 00007f9c3db831d0 20:43:22 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:22 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 371.229233] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 371.229240] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 371.265227] erofs: read_super, device -> /dev/loop4 [ 371.326687] erofs: read_super, device -> /dev/loop2 [ 371.332906] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 371.357474] erofs: FAULT_INJECTION was not selected [ 371.371395] erofs: root inode @ nid 36 [ 371.387518] erofs: mounted on /dev/loop2 with opts: noacl. [ 371.398346] erofs: root inode @ nid 0 [ 371.406976] erofs: bogus i_mode (0) @ nid 0 [ 371.417297] erofs: options -> noacl,acl, [ 371.422964] erofs: root inode @ nid 36 [ 371.508353] erofs: mounted on /dev/loop4 with opts: noacl. [ 371.564807] 9pnet: Could not find request transport: xen [ 371.582832] 9pnet: Could not find request transport: xen [ 371.597496] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 371.608450] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 20:43:23 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:23 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xffff1f00, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:23 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:23 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 33) 20:43:23 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xa226, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 371.760680] erofs: unmounted for /dev/loop2 [ 371.765145] erofs: unmounted for /dev/loop4 [ 371.835124] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 371.844535] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 371.851347] erofs: read_super, device -> /dev/loop0 [ 371.873322] 9pnet: Could not find request transport: xen [ 371.886052] FAULT_INJECTION: forcing a failure. [ 371.886052] name failslab, interval 1, probability 0, space 0, times 0 [ 371.897592] CPU: 1 PID: 23307 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 371.905507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 371.911958] 9pnet: Could not find request transport: xen [ 371.914853] Call Trace: [ 371.914873] dump_stack+0x1fc/0x2ef [ 371.914894] should_fail.cold+0xa/0xf [ 371.914912] ? setup_fault_attr+0x200/0x200 [ 371.914932] ? lock_downgrade+0x720/0x720 [ 371.923563] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 371.926557] __should_failslab+0x115/0x180 [ 371.926575] should_failslab+0x5/0x10 [ 371.926587] __kmalloc+0x2ab/0x3c0 [ 371.926603] ? ext4_find_extent+0x9bb/0xc70 [ 371.961754] ext4_find_extent+0x9bb/0xc70 [ 371.965919] ext4_ext_map_blocks+0x1c0/0x7390 [ 371.970427] ? __lock_acquire+0x6de/0x3ff0 [ 371.974672] ? mark_held_locks+0xf0/0xf0 [ 371.978739] ? __ext4_handle_dirty_metadata+0x1e0/0x590 [ 371.984107] ? ext4_find_delalloc_cluster+0x1f0/0x1f0 [ 371.989300] ? mark_held_locks+0xf0/0xf0 [ 371.993371] ? ext4_mark_iloc_dirty+0x1b0d/0x2b30 [ 371.998222] ? ext4_es_lookup_extent+0x375/0xb60 [ 372.002998] ? ext4_map_blocks+0x59f/0x1a50 [ 372.007328] ? lock_acquire+0x170/0x3c0 [ 372.011306] ? ext4_map_blocks+0x740/0x1a50 [ 372.015674] ext4_map_blocks+0x7a2/0x1a50 [ 372.019923] ? check_preemption_disabled+0x41/0x280 [ 372.024959] ? ext4_issue_zeroout+0x160/0x160 [ 372.029458] ? __brelse+0x84/0xa0 [ 372.032927] ? __ext4_new_inode+0x2eb/0x5a20 [ 372.037352] ext4_getblk+0xad/0x4f0 [ 372.040990] ? ext4_iomap_begin+0xe00/0xe00 [ 372.045320] ? ext4_free_inode+0x1780/0x1780 [ 372.049734] ? debug_check_no_obj_freed+0x201/0x490 [ 372.054753] ? __dquot_initialize+0x298/0xb70 [ 372.059255] ext4_bread+0x7c/0x210 [ 372.062803] ? ext4_getblk+0x4f0/0x4f0 [ 372.066697] ? dquot_initialize_needed+0x290/0x290 [ 372.071633] ? trace_hardirqs_off+0x64/0x200 [ 372.076049] ext4_append+0x155/0x370 [ 372.079774] ext4_mkdir+0x5bd/0xe10 [ 372.083416] ? ext4_init_dot_dotdot+0x600/0x600 [ 372.088101] ? generic_permission+0x116/0x4d0 [ 372.092609] ? inode_permission.part.0+0x10c/0x450 [ 372.095339] erofs: FAULT_INJECTION was not selected [ 372.097543] vfs_mkdir+0x508/0x7a0 [ 372.097561] do_mkdirat+0x262/0x2d0 [ 372.097576] ? __ia32_sys_mknod+0x120/0x120 [ 372.097594] ? trace_hardirqs_off_caller+0x6e/0x210 [ 372.097611] ? do_syscall_64+0x21/0x620 [ 372.107438] erofs: root inode @ nid 0 [ 372.109747] do_syscall_64+0xf9/0x620 [ 372.109768] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 372.109778] RIP: 0033:0x7f9c3f20d387 [ 372.109793] Code: 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 02 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 372.124340] erofs: bogus i_mode (0) @ nid 0 [ 372.126828] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000213 ORIG_RAX: 0000000000000102 [ 372.126842] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20d387 [ 372.126851] RDX: 00000000000001ff RSI: 0000000020000100 RDI: 00000000ffffff9c 20:43:23 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:23 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 372.126860] RBP: 00007f9c3db831d0 R08: 0000000000000000 R09: 00007f9c3db831d0 [ 372.126867] R10: 0000000000000000 R11: 0000000000000213 R12: 0000000020000000 [ 372.126879] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 20:43:23 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 34) 20:43:23 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:23 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xffffff8c, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 372.240633] erofs: read_super, device -> /dev/loop2 [ 372.255469] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 372.274143] erofs: FAULT_INJECTION was not selected 20:43:23 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xa303, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 372.287908] erofs: root inode @ nid 36 [ 372.302493] erofs: mounted on /dev/loop2 with opts: noacl. [ 372.314821] FAULT_INJECTION: forcing a failure. [ 372.314821] name failslab, interval 1, probability 0, space 0, times 0 [ 372.326188] erofs: unmounted for /dev/loop2 [ 372.343099] CPU: 0 PID: 23321 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 372.350994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 372.360346] Call Trace: [ 372.362943] dump_stack+0x1fc/0x2ef [ 372.366573] should_fail.cold+0xa/0xf [ 372.370374] ? setup_fault_attr+0x200/0x200 [ 372.374695] ? lock_acquire+0x170/0x3c0 [ 372.378675] __should_failslab+0x115/0x180 [ 372.382910] should_failslab+0x5/0x10 [ 372.386710] __kmalloc_track_caller+0x2a6/0x3c0 [ 372.391378] ? strndup_user+0x70/0x120 [ 372.395264] ? _copy_from_user+0xd2/0x130 [ 372.399415] memdup_user+0x22/0xb0 [ 372.402960] strndup_user+0x70/0x120 [ 372.406676] ksys_mount+0x6f/0x130 [ 372.410216] __x64_sys_mount+0xba/0x150 [ 372.414194] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 372.418775] do_syscall_64+0xf9/0x620 [ 372.422581] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 372.427768] RIP: 0033:0x7f9c3f20f7aa [ 372.431486] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 372.450389] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 372.458096] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 372.465360] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 372.472624] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 372.479887] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 372.487170] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 372.621084] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 372.625624] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 372.645951] 9pnet: Could not find request transport: xen 20:43:24 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:24 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 35) [ 372.687773] 9pnet: Could not find request transport: xen [ 372.744379] erofs: read_super, device -> /dev/loop0 [ 372.753900] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 372.779456] erofs: read_super, device -> /dev/loop2 [ 372.792942] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 372.799828] erofs: FAULT_INJECTION was not selected [ 372.801091] FAULT_INJECTION: forcing a failure. [ 372.801091] name failslab, interval 1, probability 0, space 0, times 0 [ 372.834188] CPU: 0 PID: 23349 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 372.842083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 372.851438] Call Trace: [ 372.854037] dump_stack+0x1fc/0x2ef [ 372.857675] should_fail.cold+0xa/0xf [ 372.861489] ? setup_fault_attr+0x200/0x200 [ 372.865820] ? lock_acquire+0x170/0x3c0 [ 372.868831] erofs: root inode @ nid 0 [ 372.869804] __should_failslab+0x115/0x180 [ 372.869822] should_failslab+0x5/0x10 [ 372.869839] __kmalloc_track_caller+0x2a6/0x3c0 [ 372.886285] ? strndup_user+0x70/0x120 [ 372.890183] ? _copy_from_user+0xd2/0x130 [ 372.894339] memdup_user+0x22/0xb0 [ 372.897895] strndup_user+0x70/0x120 [ 372.901621] ksys_mount+0x6f/0x130 [ 372.905170] __x64_sys_mount+0xba/0x150 [ 372.909152] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 372.911751] erofs: bogus i_mode (0) @ nid 0 [ 372.913737] do_syscall_64+0xf9/0x620 [ 372.913759] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 372.913770] RIP: 0033:0x7f9c3f20f7aa [ 372.913785] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 372.949635] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 372.957344] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 372.964644] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 372.971914] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 372.972550] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. 20:43:24 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 372.979176] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 372.979186] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 372.979739] erofs: FAULT_INJECTION was not selected [ 373.022211] 9pnet: Could not find request transport: xen 20:43:24 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xfffffff6, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:24 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 36) [ 373.053143] erofs: root inode @ nid 36 [ 373.066379] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:24 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:24 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 373.142250] FAULT_INJECTION: forcing a failure. [ 373.142250] name failslab, interval 1, probability 0, space 0, times 0 [ 373.156246] CPU: 1 PID: 23361 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 373.164137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 373.173488] Call Trace: [ 373.176086] dump_stack+0x1fc/0x2ef [ 373.179729] should_fail.cold+0xa/0xf [ 373.183538] ? setup_fault_attr+0x200/0x200 [ 373.187869] ? lock_acquire+0x170/0x3c0 [ 373.191862] __should_failslab+0x115/0x180 [ 373.196106] should_failslab+0x5/0x10 [ 373.199914] kmem_cache_alloc_trace+0x284/0x380 [ 373.204590] ? _copy_from_user+0xd2/0x130 [ 373.208749] copy_mount_options+0x59/0x380 [ 373.212997] ksys_mount+0x9b/0x130 [ 373.216543] __x64_sys_mount+0xba/0x150 [ 373.220527] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 373.225113] do_syscall_64+0xf9/0x620 [ 373.228922] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 373.234112] RIP: 0033:0x7f9c3f20f7aa [ 373.237829] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 373.239921] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 373.256734] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 373.256748] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 373.256755] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 20:43:24 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xa403, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:24 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 373.256764] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 373.256773] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 373.256781] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 373.320102] erofs: unmounted for /dev/loop2 20:43:24 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 37) [ 373.345170] erofs: read_super, device -> /dev/loop0 [ 373.346249] 9pnet: Could not find request transport: xen [ 373.372148] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 373.407766] erofs: FAULT_INJECTION was not selected 20:43:24 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 373.431372] erofs: root inode @ nid 0 [ 373.441757] FAULT_INJECTION: forcing a failure. [ 373.441757] name failslab, interval 1, probability 0, space 0, times 0 [ 373.457780] erofs: read_super, device -> /dev/loop2 [ 373.467541] erofs: bogus i_mode (0) @ nid 0 [ 373.474506] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 373.484042] erofs: FAULT_INJECTION was not selected [ 373.491185] erofs: root inode @ nid 36 [ 373.498685] erofs: mounted on /dev/loop2 with opts: noacl. [ 373.504588] CPU: 0 PID: 23385 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 373.512472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 373.521829] Call Trace: [ 373.524423] dump_stack+0x1fc/0x2ef [ 373.528061] should_fail.cold+0xa/0xf [ 373.531877] ? setup_fault_attr+0x200/0x200 [ 373.536211] ? lock_acquire+0x170/0x3c0 [ 373.540195] __should_failslab+0x115/0x180 [ 373.544437] should_failslab+0x5/0x10 [ 373.548242] kmem_cache_alloc+0x277/0x370 [ 373.552400] getname_flags+0xce/0x590 [ 373.555703] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 373.566411] user_path_at_empty+0x2a/0x50 [ 373.566429] do_mount+0x147/0x2f50 [ 373.566447] ? cmp_ex_sort+0xc0/0xc0 [ 373.566465] ? __do_page_fault+0x180/0xd60 [ 373.566482] ? copy_mount_string+0x40/0x40 [ 373.566504] ? memset+0x20/0x40 [ 373.566519] ? copy_mount_options+0x26f/0x380 [ 373.566538] ksys_mount+0xcf/0x130 [ 373.566554] __x64_sys_mount+0xba/0x150 [ 373.566571] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 373.566585] do_syscall_64+0xf9/0x620 [ 373.566604] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 373.566616] RIP: 0033:0x7f9c3f20f7aa [ 373.566630] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 373.566638] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 373.566653] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 373.566661] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 373.566669] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 373.566677] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 373.566686] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 373.593955] 9pnet: Could not find request transport: xen 20:43:25 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:25 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xa900, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:25 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xedc000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:25 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 38) [ 373.769701] erofs: unmounted for /dev/loop2 [ 373.816547] FAULT_INJECTION: forcing a failure. [ 373.816547] name failslab, interval 1, probability 0, space 0, times 0 [ 373.836799] CPU: 1 PID: 23401 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 373.844691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 373.854042] Call Trace: [ 373.856636] dump_stack+0x1fc/0x2ef [ 373.860278] should_fail.cold+0xa/0xf [ 373.864089] ? setup_fault_attr+0x200/0x200 [ 373.868416] ? lock_acquire+0x170/0x3c0 [ 373.871540] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 373.872394] __should_failslab+0x115/0x180 [ 373.872412] should_failslab+0x5/0x10 [ 373.872426] kmem_cache_alloc+0x277/0x370 [ 373.872445] getname_flags+0xce/0x590 [ 373.898586] user_path_at_empty+0x2a/0x50 [ 373.902746] do_mount+0x147/0x2f50 [ 373.906294] ? cmp_ex_sort+0xc0/0xc0 [ 373.910016] ? __do_page_fault+0x180/0xd60 [ 373.911026] 9pnet: Could not find request transport: xen [ 373.914256] ? copy_mount_string+0x40/0x40 [ 373.914279] ? memset+0x20/0x40 [ 373.914295] ? copy_mount_options+0x26f/0x380 [ 373.931697] ksys_mount+0xcf/0x130 [ 373.935248] __x64_sys_mount+0xba/0x150 [ 373.939228] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 373.943813] do_syscall_64+0xf9/0x620 [ 373.947621] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 373.952809] RIP: 0033:0x7f9c3f20f7aa 20:43:25 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={0x0, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 373.956524] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 373.975515] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 373.983229] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 373.990506] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 373.990751] erofs: read_super, device -> /dev/loop0 [ 373.997772] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 373.997781] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 373.997788] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 374.029086] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 374.039469] erofs: FAULT_INJECTION was not selected [ 374.044495] erofs: root inode @ nid 0 [ 374.049074] erofs: bogus i_mode (0) @ nid 0 [ 374.054877] erofs: read_super, device -> /dev/loop2 20:43:25 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x4000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:25 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xedc0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 374.078431] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 374.099242] erofs: FAULT_INJECTION was not selected [ 374.104330] erofs: root inode @ nid 36 [ 374.118191] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:25 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:25 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 39) [ 374.157993] erofs: unmounted for /dev/loop2 [ 374.158816] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 374.213236] 9pnet: Could not find request transport: xen [ 374.246525] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 374.269576] erofs: read_super, device -> /dev/loop0 [ 374.297190] FAULT_INJECTION: forcing a failure. [ 374.297190] name failslab, interval 1, probability 0, space 0, times 0 [ 374.306143] 9pnet: Could not find request transport: xen [ 374.309204] CPU: 0 PID: 23435 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 374.321970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 374.322043] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 374.331315] Call Trace: [ 374.331338] dump_stack+0x1fc/0x2ef [ 374.331357] should_fail.cold+0xa/0xf [ 374.331375] ? setup_fault_attr+0x200/0x200 [ 374.331390] ? lock_acquire+0x170/0x3c0 [ 374.331411] __should_failslab+0x115/0x180 [ 374.331428] should_failslab+0x5/0x10 [ 374.331442] __kmalloc_track_caller+0x2a6/0x3c0 [ 374.331455] ? kstrdup_const+0x53/0x80 [ 374.331472] kstrdup+0x36/0x70 [ 374.376526] kstrdup_const+0x53/0x80 [ 374.380257] alloc_vfsmnt+0xb5/0x780 [ 374.383977] ? _raw_read_unlock+0x29/0x40 [ 374.388132] vfs_kern_mount.part.0+0x27/0x470 [ 374.392633] do_mount+0x115c/0x2f50 [ 374.396263] ? cmp_ex_sort+0xc0/0xc0 [ 374.399985] ? __do_page_fault+0x180/0xd60 [ 374.404230] ? copy_mount_string+0x40/0x40 [ 374.408475] ? memset+0x20/0x40 [ 374.411758] ? copy_mount_options+0x26f/0x380 [ 374.416262] ksys_mount+0xcf/0x130 [ 374.419809] __x64_sys_mount+0xba/0x150 [ 374.423795] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 374.428382] do_syscall_64+0xf9/0x620 [ 374.429840] erofs: FAULT_INJECTION was not selected [ 374.432185] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 374.432197] RIP: 0033:0x7f9c3f20f7aa [ 374.432209] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 374.432220] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 374.450680] erofs: root inode @ nid 0 [ 374.464992] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 374.465002] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 20:43:25 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:25 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 374.465011] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 374.465020] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 374.465028] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 374.517591] erofs: read_super, device -> /dev/loop2 [ 374.522645] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 374.534697] erofs: bogus i_mode (0) @ nid 0 [ 374.552778] erofs: FAULT_INJECTION was not selected [ 374.558211] erofs: root inode @ nid 36 [ 374.590546] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:26 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x100000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:26 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 40) 20:43:26 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xff0f, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 374.728968] FAULT_INJECTION: forcing a failure. [ 374.728968] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 374.743813] erofs: unmounted for /dev/loop2 [ 374.753594] erofs: read_super, device -> /dev/loop0 [ 374.767847] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 374.803153] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 374.809367] CPU: 0 PID: 23452 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 374.816718] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 374.821321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 374.821327] Call Trace: [ 374.821347] dump_stack+0x1fc/0x2ef [ 374.821367] should_fail.cold+0xa/0xf [ 374.821384] ? lock_acquire+0x170/0x3c0 [ 374.821399] ? setup_fault_attr+0x200/0x200 [ 374.821423] __alloc_pages_nodemask+0x239/0x2890 [ 374.821436] ? lock_acquire+0x170/0x3c0 [ 374.821455] ? pcpu_alloc+0x91f/0x1190 [ 374.842919] erofs: FAULT_INJECTION was not selected [ 374.843578] ? mark_held_locks+0xf0/0xf0 [ 374.864504] 9pnet: Could not find request transport: xen [ 374.867939] ? pcpu_alloc+0xe78/0x1190 [ 374.867964] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 374.867991] ? check_preemption_disabled+0x41/0x280 [ 374.868012] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 374.868026] ? pcpu_alloc+0xc9/0x1190 [ 374.868046] alloc_pages_current+0x193/0x2a0 [ 374.868061] ? __lockdep_init_map+0x100/0x5a0 [ 374.868078] get_zeroed_page+0x10/0x40 [ 374.868091] mount_fs+0x203/0x310 [ 374.868111] vfs_kern_mount.part.0+0x68/0x470 [ 374.868129] do_mount+0x115c/0x2f50 [ 374.868147] ? cmp_ex_sort+0xc0/0xc0 [ 374.868168] ? __do_page_fault+0x180/0xd60 [ 374.876724] erofs: root inode @ nid 0 [ 374.877071] ? copy_mount_string+0x40/0x40 [ 374.910012] erofs: bogus i_mode (0) @ nid 0 [ 374.913437] ? memset+0x20/0x40 [ 374.913454] ? copy_mount_options+0x26f/0x380 [ 374.913471] ksys_mount+0xcf/0x130 [ 374.936969] 9pnet: Could not find request transport: xen [ 374.937049] __x64_sys_mount+0xba/0x150 [ 374.937068] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 374.978953] do_syscall_64+0xf9/0x620 [ 374.982766] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 374.987952] RIP: 0033:0x7f9c3f20f7aa [ 374.991666] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 375.010563] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 375.018271] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 375.025542] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 375.032815] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 375.040083] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 375.047352] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 20:43:26 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:26 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:26 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x200000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:26 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:26 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 41) [ 375.150252] erofs: read_super, device -> /dev/loop2 [ 375.155392] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 375.190637] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 375.202777] erofs: read_super, device -> /dev/loop0 [ 375.202786] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 375.203205] erofs: FAULT_INJECTION was not selected [ 375.203211] erofs: root inode @ nid 0 [ 375.203390] erofs: bogus i_mode (0) @ nid 0 [ 375.221544] erofs: FAULT_INJECTION was not selected 20:43:26 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:26 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x300000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 375.223556] 9pnet: Could not find request transport: xen [ 375.226920] erofs: root inode @ nid 36 [ 375.252147] FAULT_INJECTION: forcing a failure. [ 375.252147] name failslab, interval 1, probability 0, space 0, times 0 [ 375.292004] CPU: 0 PID: 23481 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 375.299903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 375.309255] Call Trace: [ 375.311854] dump_stack+0x1fc/0x2ef [ 375.315489] should_fail.cold+0xa/0xf [ 375.319299] ? setup_fault_attr+0x200/0x200 [ 375.323643] ? lock_acquire+0x170/0x3c0 [ 375.327647] __should_failslab+0x115/0x180 [ 375.331894] should_failslab+0x5/0x10 [ 375.335713] kmem_cache_alloc+0x277/0x370 [ 375.339874] alloc_vfsmnt+0x23/0x780 [ 375.343594] ? _raw_read_unlock+0x29/0x40 [ 375.347746] vfs_kern_mount.part.0+0x27/0x470 [ 375.352251] do_mount+0x115c/0x2f50 [ 375.355888] ? cmp_ex_sort+0xc0/0xc0 [ 375.359070] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 375.359604] ? __do_page_fault+0x180/0xd60 [ 375.359623] ? copy_mount_string+0x40/0x40 [ 375.359646] ? memset+0x20/0x40 [ 375.359660] ? copy_mount_options+0x26f/0x380 [ 375.359677] ksys_mount+0xcf/0x130 [ 375.389609] __x64_sys_mount+0xba/0x150 [ 375.393594] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 375.398186] do_syscall_64+0xf9/0x620 [ 375.401996] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 375.407197] RIP: 0033:0x7f9c3f20f7aa [ 375.410912] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 375.424793] 9pnet: Could not find request transport: xen [ 375.429807] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 375.429823] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 375.429832] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 375.429841] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 375.429851] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 375.429860] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 375.438244] erofs: read_super, device -> /dev/loop0 [ 375.485527] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:26 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:26 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x400000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 375.493012] erofs: FAULT_INJECTION was not selected [ 375.498178] erofs: root inode @ nid 0 [ 375.502237] erofs: bogus i_mode (0) @ nid 0 [ 375.518912] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:27 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:27 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 42) [ 375.600787] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 375.619196] erofs: unmounted for /dev/loop2 [ 375.631564] 9pnet: Could not find request transport: xen 20:43:27 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 375.679618] erofs: read_super, device -> /dev/loop0 [ 375.684641] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 375.718832] FAULT_INJECTION: forcing a failure. [ 375.718832] name failslab, interval 1, probability 0, space 0, times 0 [ 375.731879] erofs: read_super, device -> /dev/loop2 [ 375.740306] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 375.759649] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 375.766072] erofs: FAULT_INJECTION was not selected [ 375.771072] erofs: FAULT_INJECTION was not selected [ 375.775748] CPU: 1 PID: 23507 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 375.784648] erofs: root inode @ nid 0 [ 375.788058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 375.788063] Call Trace: [ 375.788083] dump_stack+0x1fc/0x2ef [ 375.788104] should_fail.cold+0xa/0xf [ 375.788124] ? setup_fault_attr+0x200/0x200 [ 375.815521] ? lock_acquire+0x170/0x3c0 [ 375.815952] 9pnet: Could not find request transport: xen [ 375.819502] __should_failslab+0x115/0x180 [ 375.819520] should_failslab+0x5/0x10 [ 375.819534] __kmalloc+0x2ab/0x3c0 [ 375.819547] ? prealloc_shrinker+0x15d/0x340 [ 375.819566] prealloc_shrinker+0x15d/0x340 [ 375.845151] sget_userns+0x7b4/0xcd0 [ 375.848868] ? set_bdev_super+0x110/0x110 [ 375.853020] ? ns_test_super+0x50/0x50 [ 375.856914] ? set_bdev_super+0x110/0x110 [ 375.861067] ? ns_test_super+0x50/0x50 [ 375.864958] sget+0x102/0x140 [ 375.868071] mount_bdev+0xf8/0x3b0 [ 375.871612] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 375.876895] erofs_mount+0x8c/0xc0 [ 375.880440] ? erofs_kill_sb+0x20/0x20 [ 375.884333] ? alloc_pages_current+0x19b/0x2a0 [ 375.887591] erofs: bogus i_mode (0) @ nid 0 [ 375.888922] ? __lockdep_init_map+0x100/0x5a0 [ 375.897707] mount_fs+0xa3/0x310 [ 375.901083] vfs_kern_mount.part.0+0x68/0x470 [ 375.905587] do_mount+0x115c/0x2f50 [ 375.909195] erofs: root inode @ nid 36 [ 375.909220] ? cmp_ex_sort+0xc0/0xc0 [ 375.916781] ? __do_page_fault+0x180/0xd60 [ 375.921004] ? copy_mount_string+0x40/0x40 [ 375.925227] ? memset+0x20/0x40 [ 375.928489] ? copy_mount_options+0x26f/0x380 [ 375.932966] ksys_mount+0xcf/0x130 [ 375.936489] __x64_sys_mount+0xba/0x150 [ 375.940447] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 375.945031] do_syscall_64+0xf9/0x620 [ 375.948835] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 375.954025] RIP: 0033:0x7f9c3f20f7aa [ 375.957719] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 375.968661] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 375.976606] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 375.976620] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 375.976627] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 375.976640] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 375.996337] 9pnet: Could not find request transport: xen [ 376.001802] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 20:43:27 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) 20:43:27 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 376.001811] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 376.018393] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:27 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x100000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:27 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x500000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:27 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 43) 20:43:27 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 376.098469] erofs: unmounted for /dev/loop2 [ 376.172764] erofs: read_super, device -> /dev/loop2 [ 376.180094] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 376.191565] erofs: read_super, device -> /dev/loop0 [ 376.203624] FAULT_INJECTION: forcing a failure. [ 376.203624] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 376.215433] CPU: 1 PID: 23541 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 376.223312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 376.232665] Call Trace: [ 376.235261] dump_stack+0x1fc/0x2ef [ 376.238901] should_fail.cold+0xa/0xf [ 376.242713] ? setup_fault_attr+0x200/0x200 [ 376.247049] ? get_page_from_freelist+0x1d60/0x4170 [ 376.252077] __alloc_pages_nodemask+0x239/0x2890 [ 376.256844] ? get_page_from_freelist+0x1d60/0x4170 [ 376.261952] ? bad_range+0x260/0x3c0 [ 376.265676] ? __lock_acquire+0x6de/0x3ff0 [ 376.269918] ? preempt_count_add+0xaf/0x190 [ 376.274271] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 376.279142] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 376.283453] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 376.284514] cache_grow_begin+0xa4/0x8a0 [ 376.284532] ? setup_fault_attr+0x200/0x200 [ 376.284548] ? lock_acquire+0x170/0x3c0 [ 376.284565] cache_alloc_refill+0x273/0x340 [ 376.284583] kmem_cache_alloc+0x346/0x370 [ 376.315562] getname_kernel+0x4e/0x370 [ 376.318482] 9pnet: Could not find request transport: xen [ 376.319452] kern_path+0x1b/0x40 [ 376.319467] lookup_bdev+0xfc/0x220 [ 376.319480] ? bd_acquire+0x440/0x440 [ 376.319508] blkdev_get_by_path+0x1b/0xd0 [ 376.339823] mount_bdev+0x5b/0x3b0 [ 376.343366] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 376.348647] erofs_mount+0x8c/0xc0 [ 376.352191] ? erofs_kill_sb+0x20/0x20 [ 376.356092] ? alloc_pages_current+0x19b/0x2a0 [ 376.360680] ? __lockdep_init_map+0x100/0x5a0 [ 376.365179] mount_fs+0xa3/0x310 [ 376.368553] vfs_kern_mount.part.0+0x68/0x470 20:43:27 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 376.373072] do_mount+0x115c/0x2f50 [ 376.376707] ? cmp_ex_sort+0xc0/0xc0 [ 376.380429] ? __do_page_fault+0x180/0xd60 [ 376.384672] ? copy_mount_string+0x40/0x40 [ 376.388943] ? memset+0x20/0x40 [ 376.392229] ? copy_mount_options+0x26f/0x380 [ 376.396733] ksys_mount+0xcf/0x130 [ 376.400272] __x64_sys_mount+0xba/0x150 [ 376.404239] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 376.408812] do_syscall_64+0xf9/0x620 [ 376.412609] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 376.417782] RIP: 0033:0x7f9c3f20f7aa [ 376.421478] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 376.440449] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 376.448142] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 376.455397] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 376.462649] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 376.469901] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 376.477157] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 376.498932] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 376.510170] erofs: FAULT_INJECTION was not selected [ 376.513777] erofs: read_super, device -> /dev/loop4 [ 376.521524] erofs: options -> noacl,acl, [ 376.526013] erofs: root inode @ nid 36 [ 376.535988] erofs: FAULT_INJECTION was not selected [ 376.542174] erofs: root inode @ nid 0 [ 376.546104] erofs: mounted on /dev/loop4 with opts: noacl. [ 376.546438] erofs: root inode @ nid 36 20:43:27 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 44) 20:43:28 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:28 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x600000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 376.571642] erofs: bogus i_mode (0) @ nid 0 [ 376.574101] 9pnet: Could not find request transport: xen [ 376.592393] erofs: unmounted for /dev/loop4 [ 376.595681] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:28 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1fffff, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 376.669363] erofs: unmounted for /dev/loop2 [ 376.701479] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 376.713356] FAULT_INJECTION: forcing a failure. [ 376.713356] name failslab, interval 1, probability 0, space 0, times 0 [ 376.725057] CPU: 1 PID: 23561 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 376.732946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 376.733685] erofs: read_super, device -> /dev/loop0 [ 376.742291] Call Trace: [ 376.742312] dump_stack+0x1fc/0x2ef [ 376.742333] should_fail.cold+0xa/0xf [ 376.742351] ? setup_fault_attr+0x200/0x200 [ 376.742366] ? lock_acquire+0x170/0x3c0 [ 376.742385] __should_failslab+0x115/0x180 [ 376.742403] should_failslab+0x5/0x10 [ 376.773645] kmem_cache_alloc+0x277/0x370 [ 376.777806] getname_kernel+0x4e/0x370 [ 376.781701] kern_path+0x1b/0x40 [ 376.785073] lookup_bdev+0xfc/0x220 [ 376.788706] ? bd_acquire+0x440/0x440 [ 376.792522] blkdev_get_by_path+0x1b/0xd0 [ 376.796676] mount_bdev+0x5b/0x3b0 [ 376.800224] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 376.805509] erofs_mount+0x8c/0xc0 [ 376.809063] ? erofs_kill_sb+0x20/0x20 [ 376.812964] ? alloc_pages_current+0x19b/0x2a0 [ 376.817555] ? __lockdep_init_map+0x100/0x5a0 [ 376.822062] mount_fs+0xa3/0x310 [ 376.825443] vfs_kern_mount.part.0+0x68/0x470 [ 376.826261] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 376.829943] do_mount+0x115c/0x2f50 [ 376.829963] ? cmp_ex_sort+0xc0/0xc0 [ 376.829981] ? __do_page_fault+0x180/0xd60 [ 376.829998] ? copy_mount_string+0x40/0x40 [ 376.830019] ? memset+0x20/0x40 [ 376.830035] ? copy_mount_options+0x26f/0x380 [ 376.830056] ksys_mount+0xcf/0x130 [ 376.830072] __x64_sys_mount+0xba/0x150 [ 376.868154] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 376.869127] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 376.872741] do_syscall_64+0xf9/0x620 [ 376.872762] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 376.872774] RIP: 0033:0x7f9c3f20f7aa 20:43:28 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 376.872789] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 376.872797] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 376.872811] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 376.872818] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 376.872831] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 376.907366] 9pnet: Could not find request transport: xen [ 376.914609] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 376.914618] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 376.935150] 9pnet: Could not find request transport: xen [ 376.995613] erofs: FAULT_INJECTION was not selected 20:43:28 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 376.996014] erofs: read_super, device -> /dev/loop2 [ 377.015369] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 377.023046] erofs: FAULT_INJECTION was not selected [ 377.028289] erofs: root inode @ nid 36 [ 377.032373] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:28 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:28 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 45) 20:43:28 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x700000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 377.050775] erofs: root inode @ nid 0 [ 377.054643] erofs: bogus i_mode (0) @ nid 0 [ 377.055570] erofs: unmounted for /dev/loop2 20:43:28 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 377.154700] erofs: read_super, device -> /dev/loop0 [ 377.160486] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 377.168656] erofs: FAULT_INJECTION was not selected [ 377.173767] erofs: root inode @ nid 0 [ 377.179135] erofs: bogus i_mode (0) @ nid 0 [ 377.183112] FAULT_INJECTION: forcing a failure. [ 377.183112] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 377.195515] CPU: 1 PID: 23590 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 377.203395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 377.212748] Call Trace: [ 377.215342] dump_stack+0x1fc/0x2ef [ 377.218979] should_fail.cold+0xa/0xf [ 377.222788] ? setup_fault_attr+0x200/0x200 [ 377.227119] ? _raw_spin_unlock_irqrestore+0x79/0xe0 [ 377.232233] ? mark_held_locks+0xf0/0xf0 [ 377.236302] __alloc_pages_nodemask+0x239/0x2890 [ 377.241070] ? __lock_acquire+0x6de/0x3ff0 [ 377.245313] ? __lock_acquire+0x6de/0x3ff0 [ 377.249560] ? __lock_acquire+0x6de/0x3ff0 [ 377.253797] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 377.258647] ? mark_held_locks+0xf0/0xf0 [ 377.262717] ? mark_held_locks+0xf0/0xf0 [ 377.266779] ? lock_downgrade+0x720/0x720 [ 377.270227] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 377.270923] ? blkdev_get+0x4ce/0x940 [ 377.270944] ? _atomic_dec_and_lock+0x122/0x1d0 [ 377.270964] cache_grow_begin+0xa4/0x8a0 [ 377.270984] ? setup_fault_attr+0x200/0x200 [ 377.298001] ? lock_acquire+0x170/0x3c0 [ 377.301987] cache_alloc_refill+0x273/0x340 [ 377.306332] kmem_cache_alloc_trace+0x354/0x380 [ 377.311013] ? set_bdev_super+0x110/0x110 [ 377.315040] 9pnet: Could not find request transport: xen [ 377.315184] ? ns_test_super+0x50/0x50 [ 377.315203] sget_userns+0x122/0xcd0 [ 377.328216] ? set_bdev_super+0x110/0x110 [ 377.332373] ? ns_test_super+0x50/0x50 [ 377.336269] ? set_bdev_super+0x110/0x110 [ 377.340421] ? ns_test_super+0x50/0x50 [ 377.344312] sget+0x102/0x140 [ 377.347423] mount_bdev+0xf8/0x3b0 [ 377.350964] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 377.356246] erofs_mount+0x8c/0xc0 [ 377.359791] ? erofs_kill_sb+0x20/0x20 [ 377.363685] ? alloc_pages_current+0x19b/0x2a0 [ 377.368267] ? __lockdep_init_map+0x100/0x5a0 [ 377.372769] mount_fs+0xa3/0x310 [ 377.376166] vfs_kern_mount.part.0+0x68/0x470 [ 377.380672] do_mount+0x115c/0x2f50 [ 377.384309] ? cmp_ex_sort+0xc0/0xc0 [ 377.388037] ? __do_page_fault+0x180/0xd60 [ 377.392276] ? copy_mount_string+0x40/0x40 [ 377.396525] ? memset+0x20/0x40 [ 377.399812] ? copy_mount_options+0x26f/0x380 20:43:28 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 377.404319] ksys_mount+0xcf/0x130 [ 377.407865] __x64_sys_mount+0xba/0x150 [ 377.411845] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 377.416419] do_syscall_64+0xf9/0x620 [ 377.420221] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 377.425398] RIP: 0033:0x7f9c3f20f7aa [ 377.429092] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 377.448094] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 377.455809] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 377.463081] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 377.470335] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 377.477594] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 377.484848] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 377.512687] erofs: read_super, device -> /dev/loop4 [ 377.518134] erofs: options -> noacl,acl, [ 377.521813] erofs: read_super, device -> /dev/loop2 [ 377.533968] erofs: root inode @ nid 36 [ 377.536471] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 377.554842] overlayfs: failed to resolve './file1': -2 20:43:28 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x800000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:28 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 46) [ 377.561513] erofs: mounted on /dev/loop4 with opts: noacl. [ 377.607617] erofs: unmounted for /dev/loop4 [ 377.614712] 9pnet: Could not find request transport: xen [ 377.616560] erofs: FAULT_INJECTION was not selected [ 377.632690] erofs: root inode @ nid 36 20:43:29 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 377.667581] erofs: mounted on /dev/loop2 with opts: noacl. [ 377.703918] erofs: read_super, device -> /dev/loop0 [ 377.726200] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 377.736439] FAULT_INJECTION: forcing a failure. [ 377.736439] name failslab, interval 1, probability 0, space 0, times 0 [ 377.749485] CPU: 0 PID: 23620 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 377.757377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 377.766726] Call Trace: [ 377.769323] dump_stack+0x1fc/0x2ef [ 377.772964] should_fail.cold+0xa/0xf 20:43:29 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 377.776775] ? setup_fault_attr+0x200/0x200 [ 377.781108] ? lock_acquire+0x170/0x3c0 [ 377.785095] __should_failslab+0x115/0x180 [ 377.787012] erofs: FAULT_INJECTION was not selected [ 377.789331] should_failslab+0x5/0x10 [ 377.789346] kmem_cache_alloc_trace+0x284/0x380 [ 377.789363] ? set_bdev_super+0x110/0x110 [ 377.789376] ? ns_test_super+0x50/0x50 [ 377.789392] sget_userns+0x122/0xcd0 [ 377.789406] ? set_bdev_super+0x110/0x110 [ 377.789424] ? ns_test_super+0x50/0x50 [ 377.789441] ? set_bdev_super+0x110/0x110 [ 377.789453] ? ns_test_super+0x50/0x50 [ 377.789465] sget+0x102/0x140 [ 377.789488] mount_bdev+0xf8/0x3b0 [ 377.827453] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 377.830763] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 377.830782] erofs_mount+0x8c/0xc0 [ 377.830795] ? erofs_kill_sb+0x20/0x20 [ 377.830815] ? alloc_pages_current+0x19b/0x2a0 [ 377.845079] erofs: root inode @ nid 0 [ 377.847923] ? __lockdep_init_map+0x100/0x5a0 [ 377.847941] mount_fs+0xa3/0x310 [ 377.847960] vfs_kern_mount.part.0+0x68/0x470 [ 377.847979] do_mount+0x115c/0x2f50 [ 377.847997] ? cmp_ex_sort+0xc0/0xc0 [ 377.848014] ? __do_page_fault+0x180/0xd60 [ 377.848031] ? copy_mount_string+0x40/0x40 [ 377.897114] ? memset+0x20/0x40 [ 377.900405] ? copy_mount_options+0x26f/0x380 [ 377.904916] ksys_mount+0xcf/0x130 [ 377.908482] __x64_sys_mount+0xba/0x150 [ 377.912461] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 377.917057] do_syscall_64+0xf9/0x620 [ 377.920885] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 377.925382] erofs: bogus i_mode (0) @ nid 0 [ 377.926073] RIP: 0033:0x7f9c3f20f7aa [ 377.926089] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 377.926097] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 377.926112] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 377.967955] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 20:43:29 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 377.975250] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 377.982520] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 377.989791] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 378.003323] 9pnet: Could not find request transport: xen [ 378.006873] erofs: unmounted for /dev/loop2 20:43:29 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1500000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:29 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 378.030383] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 378.055137] 9pnet: Could not find request transport: xen 20:43:29 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 47) [ 378.151916] erofs: read_super, device -> /dev/loop0 [ 378.161043] erofs: read_super, device -> /dev/loop2 [ 378.178851] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 378.192129] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 378.210087] erofs: FAULT_INJECTION was not selected [ 378.218655] FAULT_INJECTION: forcing a failure. [ 378.218655] name failslab, interval 1, probability 0, space 0, times 0 [ 378.237378] erofs: FAULT_INJECTION was not selected [ 378.258539] erofs: root inode @ nid 0 [ 378.264620] erofs: root inode @ nid 36 [ 378.273867] erofs: bogus i_mode (0) @ nid 0 [ 378.281784] erofs: mounted on /dev/loop2 with opts: noacl. [ 378.290830] CPU: 1 PID: 23646 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 378.298744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 378.308091] Call Trace: [ 378.310682] dump_stack+0x1fc/0x2ef [ 378.314318] should_fail.cold+0xa/0xf [ 378.318128] ? setup_fault_attr+0x200/0x200 [ 378.322458] ? lock_acquire+0x170/0x3c0 [ 378.326449] __should_failslab+0x115/0x180 [ 378.330696] should_failslab+0x5/0x10 [ 378.334503] kmem_cache_alloc_node_trace+0x244/0x3b0 [ 378.339614] __kmalloc_node+0x38/0x70 [ 378.343422] kvmalloc_node+0x61/0xf0 [ 378.347139] __list_lru_init+0x4c6/0x7f0 [ 378.351206] ? up_read+0xb3/0x110 [ 378.354667] sget_userns+0x7e2/0xcd0 [ 378.358381] ? set_bdev_super+0x110/0x110 [ 378.362536] ? ns_test_super+0x50/0x50 [ 378.366426] ? set_bdev_super+0x110/0x110 [ 378.370579] ? ns_test_super+0x50/0x50 [ 378.374474] sget+0x102/0x140 [ 378.377583] mount_bdev+0xf8/0x3b0 [ 378.381126] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 378.386412] erofs_mount+0x8c/0xc0 [ 378.389957] ? erofs_kill_sb+0x20/0x20 [ 378.393852] ? alloc_pages_current+0x19b/0x2a0 [ 378.398438] ? __lockdep_init_map+0x100/0x5a0 [ 378.399699] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 378.402937] mount_fs+0xa3/0x310 [ 378.416564] vfs_kern_mount.part.0+0x68/0x470 [ 378.421068] do_mount+0x115c/0x2f50 [ 378.424698] ? cmp_ex_sort+0xc0/0xc0 [ 378.425501] 9pnet: Could not find request transport: xen [ 378.428426] ? __do_page_fault+0x180/0xd60 [ 378.428445] ? copy_mount_string+0x40/0x40 [ 378.428471] ? memset+0x20/0x40 [ 378.428488] ? copy_mount_options+0x26f/0x380 [ 378.450115] ksys_mount+0xcf/0x130 [ 378.453666] __x64_sys_mount+0xba/0x150 [ 378.457647] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 378.462231] do_syscall_64+0xf9/0x620 [ 378.466038] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 378.471224] RIP: 0033:0x7f9c3f20f7aa [ 378.475022] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 378.494455] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 378.502166] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa 20:43:29 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:29 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 378.509440] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 378.516710] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 378.523980] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 378.531249] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 20:43:29 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:30 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 48) 20:43:30 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1600000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 378.598096] erofs: unmounted for /dev/loop2 [ 378.737876] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 378.746825] FAULT_INJECTION: forcing a failure. [ 378.746825] name failslab, interval 1, probability 0, space 0, times 0 [ 378.762372] CPU: 0 PID: 23664 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 378.770270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 378.779622] Call Trace: [ 378.782219] dump_stack+0x1fc/0x2ef [ 378.785852] should_fail.cold+0xa/0xf [ 378.789659] ? setup_fault_attr+0x200/0x200 [ 378.793986] ? lock_acquire+0x170/0x3c0 [ 378.797974] __should_failslab+0x115/0x180 [ 378.802217] should_failslab+0x5/0x10 [ 378.806023] __kmalloc+0x2ab/0x3c0 [ 378.809571] ? __list_lru_init+0xd3/0x7f0 [ 378.813723] __list_lru_init+0xd3/0x7f0 [ 378.817706] ? up_write+0x18/0x150 [ 378.821258] sget_userns+0x7e2/0xcd0 [ 378.824979] ? set_bdev_super+0x110/0x110 [ 378.829136] ? ns_test_super+0x50/0x50 [ 378.833032] ? set_bdev_super+0x110/0x110 [ 378.837188] ? ns_test_super+0x50/0x50 [ 378.841082] sget+0x102/0x140 [ 378.844196] mount_bdev+0xf8/0x3b0 [ 378.847737] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 378.853018] erofs_mount+0x8c/0xc0 [ 378.856568] ? erofs_kill_sb+0x20/0x20 [ 378.860496] ? alloc_pages_current+0x19b/0x2a0 [ 378.865080] ? __lockdep_init_map+0x100/0x5a0 [ 378.869583] mount_fs+0xa3/0x310 [ 378.872957] vfs_kern_mount.part.0+0x68/0x470 [ 378.877457] do_mount+0x115c/0x2f50 [ 378.881088] ? cmp_ex_sort+0xc0/0xc0 [ 378.884803] ? __do_page_fault+0x180/0xd60 [ 378.889043] ? copy_mount_string+0x40/0x40 [ 378.893288] ? memset+0x20/0x40 [ 378.895665] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 378.896568] ? copy_mount_options+0x26f/0x380 [ 378.896588] ksys_mount+0xcf/0x130 [ 378.896606] __x64_sys_mount+0xba/0x150 [ 378.896623] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 378.896637] do_syscall_64+0xf9/0x620 [ 378.896657] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 378.932333] RIP: 0033:0x7f9c3f20f7aa 20:43:30 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 378.932507] 9pnet: Could not find request transport: xen [ 378.936047] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 378.936054] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 378.936068] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 378.936076] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 378.936086] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 378.936094] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 378.936103] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 378.957494] erofs: read_super, device -> /dev/loop0 [ 378.999570] 9pnet: Could not find request transport: xen [ 379.026371] erofs: read_super, device -> /dev/loop2 [ 379.056641] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, 20:43:30 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:30 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x4000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 379.102943] erofs: FAULT_INJECTION was not selected [ 379.119456] erofs: root inode @ nid 36 [ 379.127781] erofs: mounted on /dev/loop2 with opts: noacl. [ 379.133701] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 379.148070] erofs: FAULT_INJECTION was not selected 20:43:30 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 379.153446] erofs: unmounted for /dev/loop2 [ 379.170517] erofs: root inode @ nid 0 [ 379.176758] erofs: bogus i_mode (0) @ nid 0 20:43:30 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x1700000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:30 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 49) [ 379.277992] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 379.290769] erofs: read_super, device -> /dev/loop2 [ 379.309254] 9pnet: Could not find request transport: xen [ 379.311606] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 379.343208] FAULT_INJECTION: forcing a failure. [ 379.343208] name failslab, interval 1, probability 0, space 0, times 0 [ 379.384117] CPU: 1 PID: 23696 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 379.392359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 379.401840] Call Trace: [ 379.404440] dump_stack+0x1fc/0x2ef [ 379.408080] should_fail.cold+0xa/0xf [ 379.411893] ? setup_fault_attr+0x200/0x200 [ 379.416221] ? lock_acquire+0x170/0x3c0 [ 379.420212] __should_failslab+0x115/0x180 [ 379.424458] should_failslab+0x5/0x10 [ 379.428266] kmem_cache_alloc_node_trace+0x244/0x3b0 [ 379.433380] __kmalloc_node+0x38/0x70 [ 379.437200] kvmalloc_node+0x61/0xf0 [ 379.440921] __list_lru_init+0x4c6/0x7f0 [ 379.444985] ? up_read+0xb3/0x110 [ 379.448453] sget_userns+0x7e2/0xcd0 [ 379.452170] ? set_bdev_super+0x110/0x110 [ 379.456449] ? ns_test_super+0x50/0x50 [ 379.460349] ? set_bdev_super+0x110/0x110 [ 379.464502] ? ns_test_super+0x50/0x50 [ 379.468393] sget+0x102/0x140 [ 379.471507] mount_bdev+0xf8/0x3b0 [ 379.475055] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 379.480339] erofs_mount+0x8c/0xc0 [ 379.483884] ? erofs_kill_sb+0x20/0x20 [ 379.487783] ? alloc_pages_current+0x19b/0x2a0 [ 379.492130] 9pnet: Could not find request transport: xen [ 379.492364] ? __lockdep_init_map+0x100/0x5a0 [ 379.492380] mount_fs+0xa3/0x310 [ 379.492399] vfs_kern_mount.part.0+0x68/0x470 [ 379.510159] do_mount+0x115c/0x2f50 [ 379.513793] ? cmp_ex_sort+0xc0/0xc0 [ 379.517519] ? __do_page_fault+0x180/0xd60 [ 379.521773] ? copy_mount_string+0x40/0x40 [ 379.526022] ? memset+0x20/0x40 [ 379.529309] ? copy_mount_options+0x26f/0x380 [ 379.533817] ksys_mount+0xcf/0x130 [ 379.535127] overlayfs: './file0' not a directory [ 379.537368] __x64_sys_mount+0xba/0x150 [ 379.537387] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 379.537402] do_syscall_64+0xf9/0x620 [ 379.537422] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 379.537434] RIP: 0033:0x7f9c3f20f7aa [ 379.537449] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 20:43:31 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 379.537456] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 379.537470] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 379.537479] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 379.537487] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 379.537495] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 379.537506] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 379.607602] erofs: read_super, device -> /dev/loop0 20:43:31 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:31 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 50) [ 379.632083] erofs: FAULT_INJECTION was not selected [ 379.651230] erofs: root inode @ nid 36 [ 379.674386] erofs: mounted on /dev/loop2 with opts: noacl. [ 379.700211] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.708749] ieee802154 phy1 wpan1: encryption failed: -22 20:43:31 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x5000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:31 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 379.768519] erofs: unmounted for /dev/loop2 [ 379.778590] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 379.828566] FAULT_INJECTION: forcing a failure. [ 379.828566] name failslab, interval 1, probability 0, space 0, times 0 [ 379.853659] erofs: FAULT_INJECTION was not selected [ 379.884908] erofs: root inode @ nid 0 [ 379.910606] CPU: 0 PID: 23713 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 379.918505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 379.927856] Call Trace: [ 379.930454] dump_stack+0x1fc/0x2ef [ 379.934093] should_fail.cold+0xa/0xf [ 379.937908] ? setup_fault_attr+0x200/0x200 [ 379.942254] ? lock_acquire+0x170/0x3c0 [ 379.946251] __should_failslab+0x115/0x180 [ 379.950495] should_failslab+0x5/0x10 [ 379.954303] kmem_cache_alloc_node_trace+0x244/0x3b0 [ 379.959420] __kmalloc_node+0x38/0x70 [ 379.961826] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 379.963221] kvmalloc_node+0x61/0xf0 [ 379.963239] __list_lru_init+0x4c6/0x7f0 [ 379.963255] ? up_read+0xb3/0x110 [ 379.963275] sget_userns+0x7e2/0xcd0 [ 379.963289] ? set_bdev_super+0x110/0x110 [ 379.963308] ? ns_test_super+0x50/0x50 [ 379.963324] ? set_bdev_super+0x110/0x110 [ 379.963336] ? ns_test_super+0x50/0x50 [ 379.963351] sget+0x102/0x140 [ 380.007967] mount_bdev+0xf8/0x3b0 [ 380.011511] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 380.016826] erofs_mount+0x8c/0xc0 [ 380.020370] ? erofs_kill_sb+0x20/0x20 [ 380.024270] ? alloc_pages_current+0x19b/0x2a0 [ 380.028858] ? __lockdep_init_map+0x100/0x5a0 [ 380.031453] 9pnet: Could not find request transport: xen [ 380.033358] mount_fs+0xa3/0x310 [ 380.033384] vfs_kern_mount.part.0+0x68/0x470 [ 380.046665] do_mount+0x115c/0x2f50 [ 380.050298] ? cmp_ex_sort+0xc0/0xc0 [ 380.054032] ? __do_page_fault+0x180/0xd60 [ 380.058281] ? copy_mount_string+0x40/0x40 [ 380.062531] ? memset+0x20/0x40 [ 380.065821] ? copy_mount_options+0x26f/0x380 [ 380.070325] ksys_mount+0xcf/0x130 [ 380.073874] __x64_sys_mount+0xba/0x150 [ 380.074659] erofs: bogus i_mode (0) @ nid 0 [ 380.077849] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 380.077864] do_syscall_64+0xf9/0x620 [ 380.077885] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 380.077897] RIP: 0033:0x7f9c3f20f7aa [ 380.077911] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 380.077918] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 380.077930] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 380.077938] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 380.077946] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 380.077954] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 380.077961] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 380.140309] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 380.146084] erofs: read_super, device -> /dev/loop2 [ 380.168133] 9pnet: Could not find request transport: xen 20:43:31 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014000100"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:31 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x6000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 380.292591] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 380.309518] erofs: FAULT_INJECTION was not selected [ 380.315531] erofs: root inode @ nid 36 [ 380.319974] erofs: mounted on /dev/loop2 with opts: noacl. [ 380.341583] erofs: unmounted for /dev/loop2 20:43:31 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2000000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:31 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:31 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 51) [ 380.426479] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 380.450869] 9pnet: Could not find request transport: xen 20:43:31 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014000100"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 380.585572] erofs: read_super, device -> /dev/loop2 [ 380.590862] FAULT_INJECTION: forcing a failure. [ 380.590862] name failslab, interval 1, probability 0, space 0, times 0 [ 380.603969] erofs: read_super, device -> /dev/loop0 [ 380.610720] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 380.623618] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 380.644357] erofs: FAULT_INJECTION was not selected [ 380.653450] CPU: 1 PID: 23745 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 380.661346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 380.670699] Call Trace: [ 380.673299] dump_stack+0x1fc/0x2ef [ 380.676940] should_fail.cold+0xa/0xf [ 380.680754] ? setup_fault_attr+0x200/0x200 [ 380.685084] ? lock_acquire+0x170/0x3c0 [ 380.689594] __should_failslab+0x115/0x180 [ 380.693838] should_failslab+0x5/0x10 [ 380.697649] kmem_cache_alloc_node_trace+0x244/0x3b0 [ 380.702765] __kmalloc_node+0x38/0x70 [ 380.706575] kvmalloc_node+0x61/0xf0 [ 380.711428] __list_lru_init+0x4c6/0x7f0 [ 380.715495] ? up_read+0xb3/0x110 [ 380.718958] sget_userns+0x7e2/0xcd0 [ 380.722675] ? set_bdev_super+0x110/0x110 [ 380.726838] ? ns_test_super+0x50/0x50 [ 380.730732] ? set_bdev_super+0x110/0x110 [ 380.734883] ? ns_test_super+0x50/0x50 [ 380.738780] sget+0x102/0x140 [ 380.741900] mount_bdev+0xf8/0x3b0 [ 380.743135] 9pnet: Could not find request transport: xen [ 380.745443] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 380.745463] erofs_mount+0x8c/0xc0 [ 380.745478] ? erofs_kill_sb+0x20/0x20 [ 380.745497] ? alloc_pages_current+0x19b/0x2a0 [ 380.757648] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 380.759712] ? __lockdep_init_map+0x100/0x5a0 [ 380.759729] mount_fs+0xa3/0x310 [ 380.759749] vfs_kern_mount.part.0+0x68/0x470 [ 380.759767] do_mount+0x115c/0x2f50 [ 380.794355] ? cmp_ex_sort+0xc0/0xc0 [ 380.798075] ? __do_page_fault+0x180/0xd60 [ 380.802346] ? copy_mount_string+0x40/0x40 [ 380.806597] ? memset+0x20/0x40 [ 380.810052] ? copy_mount_options+0x26f/0x380 [ 380.814555] ksys_mount+0xcf/0x130 [ 380.818199] __x64_sys_mount+0xba/0x150 [ 380.822177] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 380.826762] do_syscall_64+0xf9/0x620 [ 380.830575] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 380.835764] RIP: 0033:0x7f9c3f20f7aa [ 380.839479] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 380.858380] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 380.866089] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 380.873356] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 380.880625] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 380.887893] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 20:43:32 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014000100"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:32 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 380.895600] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 380.896703] erofs: FAULT_INJECTION was not selected [ 380.969308] erofs: root inode @ nid 36 [ 380.976759] erofs: root inode @ nid 0 [ 380.987954] erofs: mounted on /dev/loop2 with opts: noacl. [ 380.997977] erofs: bogus i_mode (0) @ nid 0 20:43:32 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x7000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 381.051119] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 381.072188] erofs: unmounted for /dev/loop2 [ 381.082286] 9pnet: Could not find request transport: xen 20:43:32 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014000100"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:32 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3f00000000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:32 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 52) [ 381.204021] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 381.210856] erofs: read_super, device -> /dev/loop2 [ 381.224936] 9pnet: Could not find request transport: xen [ 381.225357] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 381.247283] erofs: read_super, device -> /dev/loop0 [ 381.252336] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 381.265131] erofs: read_super, device -> /dev/loop4 [ 381.270874] erofs: options -> noacl,acl, [ 381.275243] FAULT_INJECTION: forcing a failure. [ 381.275243] name failslab, interval 1, probability 0, space 0, times 0 [ 381.293578] erofs: FAULT_INJECTION was not selected [ 381.300694] erofs: FAULT_INJECTION was not selected [ 381.305824] erofs: root inode @ nid 36 [ 381.315355] erofs: root inode @ nid 0 [ 381.320020] CPU: 1 PID: 23777 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 381.327909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 381.337264] Call Trace: [ 381.339857] dump_stack+0x1fc/0x2ef [ 381.343497] should_fail.cold+0xa/0xf [ 381.347338] ? setup_fault_attr+0x200/0x200 [ 381.351669] ? lock_acquire+0x170/0x3c0 [ 381.355659] __should_failslab+0x115/0x180 [ 381.359928] should_failslab+0x5/0x10 [ 381.363737] kmem_cache_alloc_trace+0x284/0x380 [ 381.368421] erofs_fill_super+0x167/0x12cc [ 381.372668] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 381.377950] ? vsprintf+0x30/0x30 [ 381.381416] ? wait_for_completion_io+0x10/0x10 [ 381.386089] ? set_blocksize+0x163/0x3f0 [ 381.390163] mount_bdev+0x2fc/0x3b0 [ 381.393792] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 381.399339] erofs_mount+0x8c/0xc0 [ 381.402883] ? erofs_kill_sb+0x20/0x20 [ 381.406783] ? alloc_pages_current+0x19b/0x2a0 [ 381.411370] ? __lockdep_init_map+0x100/0x5a0 [ 381.415873] mount_fs+0xa3/0x310 [ 381.419252] vfs_kern_mount.part.0+0x68/0x470 [ 381.423765] do_mount+0x115c/0x2f50 [ 381.427403] ? cmp_ex_sort+0xc0/0xc0 [ 381.431126] ? __do_page_fault+0x180/0xd60 [ 381.435363] ? copy_mount_string+0x40/0x40 [ 381.439611] ? memset+0x20/0x40 [ 381.442898] ? copy_mount_options+0x26f/0x380 [ 381.447403] ksys_mount+0xcf/0x130 [ 381.450951] __x64_sys_mount+0xba/0x150 [ 381.454684] 9pnet: Could not find request transport: xen [ 381.454925] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 381.454942] do_syscall_64+0xf9/0x620 [ 381.468748] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 381.473940] RIP: 0033:0x7f9c3f20f7aa [ 381.477655] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 381.496557] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 20:43:32 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014000100"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 381.504268] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 381.511537] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 381.518805] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 381.520271] overlayfs: './file0' not a directory [ 381.526069] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 381.526077] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 20:43:32 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 53) 20:43:32 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff00000000040008801400010070"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 381.557625] erofs: bogus i_mode (0) @ nid 0 [ 381.565504] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:33 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x8cffffff00000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:33 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x8000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 381.653492] erofs: unmounted for /dev/loop2 [ 381.714425] erofs: read_super, device -> /dev/loop0 [ 381.719903] erofs: read_super, device -> /dev/loop4 [ 381.743828] erofs: options -> noacl,acl, 20:43:33 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 381.758464] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 381.760249] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 381.794897] 9pnet: Could not find request transport: xen [ 381.823896] FAULT_INJECTION: forcing a failure. [ 381.823896] name failslab, interval 1, probability 0, space 0, times 0 [ 381.845675] CPU: 1 PID: 23800 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 381.847551] erofs: read_super, device -> /dev/loop2 [ 381.853567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 381.853573] Call Trace: [ 381.853594] dump_stack+0x1fc/0x2ef [ 381.853615] should_fail.cold+0xa/0xf [ 381.853630] ? do_mount+0x115c/0x2f50 [ 381.853645] ? setup_fault_attr+0x200/0x200 [ 381.853660] ? blk_queue_enter+0x40b/0xb70 [ 381.853681] __should_failslab+0x115/0x180 [ 381.853697] should_failslab+0x5/0x10 [ 381.853710] kmem_cache_alloc_node+0x54/0x3b0 [ 381.853729] create_task_io_context+0x2c/0x430 [ 381.853747] generic_make_request_checks+0x1c4f/0x22e0 [ 381.853768] ? should_fail_bio.isra.0+0xa0/0xa0 [ 381.853785] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 381.853800] ? kmem_cache_alloc+0x315/0x370 [ 381.853821] generic_make_request+0x23f/0xdf0 [ 381.853840] ? blk_put_request+0x110/0x110 [ 381.853858] ? lock_downgrade+0x720/0x720 [ 381.853881] submit_bio+0xb1/0x430 [ 381.853899] ? generic_make_request+0xdf0/0xdf0 [ 381.853915] ? check_preemption_disabled+0x41/0x280 [ 381.853948] ? guard_bio_eod+0x2a0/0x650 [ 381.853967] submit_bh_wbc+0x5a7/0x760 [ 381.853987] __bread_gfp+0x14e/0x300 [ 381.854004] erofs_fill_super+0x207/0x12cc [ 381.854024] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 381.854039] ? vsprintf+0x30/0x30 [ 381.854057] ? wait_for_completion_io+0x10/0x10 [ 381.854070] ? set_blocksize+0x163/0x3f0 [ 381.854090] mount_bdev+0x2fc/0x3b0 [ 381.854103] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 381.854121] erofs_mount+0x8c/0xc0 [ 381.854135] ? erofs_kill_sb+0x20/0x20 [ 381.854160] ? alloc_pages_current+0x19b/0x2a0 [ 381.854172] ? __lockdep_init_map+0x100/0x5a0 [ 381.854188] mount_fs+0xa3/0x310 [ 381.946076] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 381.948186] vfs_kern_mount.part.0+0x68/0x470 [ 381.948206] do_mount+0x115c/0x2f50 [ 381.948224] ? cmp_ex_sort+0xc0/0xc0 [ 381.948242] ? __do_page_fault+0x180/0xd60 [ 381.948257] ? copy_mount_string+0x40/0x40 [ 381.948279] ? memset+0x20/0x40 [ 382.009454] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 382.011968] ? copy_mount_options+0x26f/0x380 [ 382.011989] ksys_mount+0xcf/0x130 [ 382.012008] __x64_sys_mount+0xba/0x150 [ 382.012025] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 382.012040] do_syscall_64+0xf9/0x620 [ 382.012063] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 382.017470] 9pnet: Could not find request transport: xen [ 382.022505] RIP: 0033:0x7f9c3f20f7aa [ 382.022520] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 382.022528] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 382.022543] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa 20:43:33 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff00000000040008801400010070"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 382.022551] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 382.022563] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 382.139527] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 382.146804] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 382.155326] erofs: FAULT_INJECTION was not selected 20:43:33 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xf6ffffff00000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 382.174296] erofs: FAULT_INJECTION was not selected [ 382.181622] erofs: root inode @ nid 0 [ 382.185704] erofs: bogus i_mode (0) @ nid 0 [ 382.190776] erofs: root inode @ nid 36 [ 382.194900] erofs: mounted on /dev/loop4 with opts: noacl. [ 382.213809] erofs: root inode @ nid 36 20:43:33 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 54) 20:43:33 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014000100"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 382.234336] erofs: mounted on /dev/loop2 with opts: noacl. [ 382.252387] erofs: unmounted for /dev/loop4 20:43:33 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x9000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 382.308957] erofs: unmounted for /dev/loop2 [ 382.362716] erofs: read_super, device -> /dev/loop0 [ 382.390287] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 382.396687] erofs: read_super, device -> /dev/loop4 [ 382.421434] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 382.432399] erofs: options -> noacl,acl, [ 382.452212] erofs: root inode @ nid 36 [ 382.462062] FAULT_INJECTION: forcing a failure. [ 382.462062] name failslab, interval 1, probability 0, space 0, times 0 [ 382.474938] CPU: 0 PID: 23836 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 382.482835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 382.483222] erofs: FAULT_INJECTION was not selected [ 382.492191] Call Trace: [ 382.492217] dump_stack+0x1fc/0x2ef [ 382.492239] should_fail.cold+0xa/0xf [ 382.492258] ? setup_fault_attr+0x200/0x200 [ 382.492273] ? lock_acquire+0x170/0x3c0 [ 382.492293] __should_failslab+0x115/0x180 [ 382.492311] should_failslab+0x5/0x10 [ 382.492325] kmem_cache_alloc+0x277/0x370 [ 382.492340] ? destroy_inode+0x20/0x20 [ 382.492353] alloc_inode+0x18/0x50 [ 382.492364] ? destroy_inode+0x20/0x20 [ 382.492381] alloc_inode+0x5d/0x180 [ 382.542728] iget_locked+0x193/0x480 [ 382.546456] erofs_iget+0x27/0x2720 [ 382.550094] ? do_raw_spin_unlock+0x171/0x230 [ 382.554603] erofs_fill_super+0xf65/0x12cc [ 382.558852] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 382.564139] ? vsprintf+0x30/0x30 [ 382.567603] ? wait_for_completion_io+0x10/0x10 [ 382.572278] ? set_blocksize+0x163/0x3f0 [ 382.576355] mount_bdev+0x2fc/0x3b0 [ 382.579993] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 382.585284] erofs_mount+0x8c/0xc0 [ 382.588837] ? erofs_kill_sb+0x20/0x20 [ 382.592741] ? alloc_pages_current+0x19b/0x2a0 [ 382.597336] ? __lockdep_init_map+0x100/0x5a0 [ 382.601839] mount_fs+0xa3/0x310 [ 382.605226] vfs_kern_mount.part.0+0x68/0x470 [ 382.609742] do_mount+0x115c/0x2f50 [ 382.613383] ? cmp_ex_sort+0xc0/0xc0 [ 382.614138] erofs: root inode @ nid 0 [ 382.617112] ? __do_page_fault+0x180/0xd60 [ 382.617131] ? copy_mount_string+0x40/0x40 [ 382.617155] ? memset+0x20/0x40 [ 382.617172] ? copy_mount_options+0x26f/0x380 [ 382.617188] ksys_mount+0xcf/0x130 [ 382.617204] __x64_sys_mount+0xba/0x150 [ 382.617220] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 382.617234] do_syscall_64+0xf9/0x620 [ 382.617251] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 382.617265] RIP: 0033:0x7f9c3f20f7aa [ 382.626978] 9pnet: Could not find request transport: xen [ 382.629511] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 382.655014] erofs: bogus i_mode (0) @ nid 0 [ 382.658335] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 20:43:34 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 382.658349] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 382.658356] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 382.658365] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 382.658373] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 382.658382] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 382.707460] overlayfs: './file0' not a directory [ 382.761996] 9pnet: Could not find request transport: xen [ 382.813835] erofs: read_super, device -> /dev/loop2 20:43:34 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff00000000040008801400010070"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:34 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014000100"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:34 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 55) 20:43:34 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xffff1f0000000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 382.853625] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 382.880868] erofs: FAULT_INJECTION was not selected [ 382.901144] erofs: root inode @ nid 36 [ 382.913006] erofs: mounted on /dev/loop2 with opts: noacl. [ 382.926752] erofs: read_super, device -> /dev/loop4 [ 382.940174] erofs: options -> noacl,acl, [ 382.965151] erofs: read_super, device -> /dev/loop0 20:43:34 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x10000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 383.006121] erofs: root inode @ nid 36 [ 383.013636] erofs: unmounted for /dev/loop2 [ 383.028260] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 383.050301] erofs: mounted on /dev/loop4 with opts: noacl. [ 383.077655] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 383.094005] FAULT_INJECTION: forcing a failure. [ 383.094005] name failslab, interval 1, probability 0, space 0, times 0 [ 383.106228] erofs: FAULT_INJECTION was not selected [ 383.112050] erofs: root inode @ nid 0 [ 383.116078] erofs: bogus i_mode (0) @ nid 0 [ 383.123252] CPU: 1 PID: 23855 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 383.123494] 9pnet: Could not find request transport: xen [ 383.131532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 383.131538] Call Trace: [ 383.131560] dump_stack+0x1fc/0x2ef [ 383.131580] should_fail.cold+0xa/0xf [ 383.131597] ? setup_fault_attr+0x200/0x200 [ 383.131611] ? lock_acquire+0x170/0x3c0 [ 383.131631] __should_failslab+0x115/0x180 [ 383.131648] should_failslab+0x5/0x10 [ 383.131662] kmem_cache_alloc_trace+0x284/0x380 [ 383.131679] get_mountpoint+0x140/0x3c0 [ 383.181417] lock_mount+0x131/0x4a0 [ 383.185057] ? lookup_mnt+0x420/0x420 [ 383.188856] ? vfs_kern_mount.part.0+0x2b4/0x470 [ 383.193617] do_add_mount+0x73/0x560 [ 383.197318] ? graft_tree+0x210/0x210 [ 383.201111] ? do_raw_spin_unlock+0x171/0x230 [ 383.205610] ? _raw_spin_unlock+0x29/0x40 [ 383.208631] 9pnet: Could not find request transport: xen [ 383.209763] ? vfs_kern_mount.part.0+0x2b9/0x470 [ 383.209783] do_mount+0x1976/0x2f50 [ 383.209801] ? cmp_ex_sort+0xc0/0xc0 [ 383.209819] ? __do_page_fault+0x180/0xd60 [ 383.231532] ? copy_mount_string+0x40/0x40 [ 383.235759] ? memset+0x20/0x40 [ 383.239026] ? copy_mount_options+0x26f/0x380 [ 383.243510] ksys_mount+0xcf/0x130 [ 383.247039] __x64_sys_mount+0xba/0x150 [ 383.251028] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 383.255627] do_syscall_64+0xf9/0x620 [ 383.259419] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 383.264594] RIP: 0033:0x7f9c3f20f7aa [ 383.268292] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 383.287183] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 383.294887] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 383.302174] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 383.309431] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 383.316686] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 20:43:34 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:34 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0xffffffff00000000, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 383.323941] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 383.334477] erofs: unmounted for /dev/loop4 [ 383.335789] overlayfs: failed to resolve './file1': -2 20:43:34 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff000000000400088014000100"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:34 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 56) [ 383.408369] erofs: read_super, device -> /dev/loop2 [ 383.422102] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 383.444188] erofs: read_super, device -> /dev/loop0 [ 383.475837] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 383.477881] erofs: FAULT_INJECTION was not selected [ 383.516387] erofs: root inode @ nid 36 [ 383.524232] erofs: read_super, device -> /dev/loop4 [ 383.537871] erofs: mounted on /dev/loop2 with opts: noacl. [ 383.545695] erofs: options -> noacl,acl, [ 383.546570] erofs: FAULT_INJECTION was not selected [ 383.555337] erofs: root inode @ nid 36 20:43:35 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x20000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 383.573760] erofs: root inode @ nid 0 [ 383.592756] FAULT_INJECTION: forcing a failure. [ 383.592756] name failslab, interval 1, probability 0, space 0, times 0 [ 383.605994] erofs: bogus i_mode (0) @ nid 0 [ 383.611419] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 383.625005] CPU: 1 PID: 23889 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 383.625926] 9pnet: Could not find request transport: xen [ 383.632899] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 383.632905] Call Trace: [ 383.632925] dump_stack+0x1fc/0x2ef [ 383.632944] should_fail.cold+0xa/0xf [ 383.632961] ? setup_fault_attr+0x200/0x200 [ 383.632976] ? static_obj+0x50/0x50 [ 383.632996] __should_failslab+0x115/0x180 [ 383.633013] should_failslab+0x5/0x10 [ 383.633031] kmem_cache_alloc+0x3f/0x370 [ 383.641698] erofs: unmounted for /dev/loop2 [ 383.647821] ? mempool_alloc+0x350/0x350 [ 383.647835] mempool_alloc+0x146/0x350 [ 383.647853] ? mempool_resize+0x790/0x790 [ 383.647872] ? find_get_entry+0x4f4/0x8a0 [ 383.647893] bio_alloc_bioset+0x389/0x5e0 [ 383.702444] ? mark_page_accessed+0x581/0xda0 [ 383.706936] ? bvec_alloc+0x2f0/0x2f0 [ 383.710729] ? pagecache_get_page+0x1c4/0xd50 [ 383.715222] erofs_get_meta_page+0x2bb/0xcd0 [ 383.719630] erofs_iget+0x21b/0x2720 [ 383.723341] erofs_fill_super+0xf65/0x12cc [ 383.727574] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 383.732845] ? vsprintf+0x30/0x30 [ 383.736294] ? wait_for_completion_io+0x10/0x10 [ 383.740953] ? set_blocksize+0x163/0x3f0 [ 383.745009] mount_bdev+0x2fc/0x3b0 [ 383.748630] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 383.753902] erofs_mount+0x8c/0xc0 [ 383.757435] ? erofs_kill_sb+0x20/0x20 [ 383.761316] ? alloc_pages_current+0x19b/0x2a0 [ 383.765888] ? __lockdep_init_map+0x100/0x5a0 [ 383.770374] mount_fs+0xa3/0x310 [ 383.773737] vfs_kern_mount.part.0+0x68/0x470 [ 383.778229] do_mount+0x115c/0x2f50 [ 383.781852] ? cmp_ex_sort+0xc0/0xc0 [ 383.785559] ? __do_page_fault+0x180/0xd60 [ 383.789788] ? copy_mount_string+0x40/0x40 [ 383.794021] ? memset+0x20/0x40 [ 383.797298] ? copy_mount_options+0x26f/0x380 [ 383.801791] ksys_mount+0xcf/0x130 [ 383.805326] __x64_sys_mount+0xba/0x150 [ 383.809293] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 383.813871] do_syscall_64+0xf9/0x620 [ 383.817670] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 383.822847] RIP: 0033:0x7f9c3f20f7aa [ 383.826553] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 383.845444] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 383.853151] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 383.860446] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 383.867705] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 20:43:35 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 383.874965] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 383.882225] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 20:43:35 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:35 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 383.933979] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 383.961902] erofs: mounted on /dev/loop4 with opts: noacl. [ 383.998032] 9pnet: Could not find request transport: xen [ 384.033347] erofs: read_super, device -> /dev/loop0 20:43:35 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 57) 20:43:35 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 384.045471] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 384.057919] erofs: read_super, device -> /dev/loop2 [ 384.074715] erofs: unmounted for /dev/loop4 [ 384.079352] erofs: FAULT_INJECTION was not selected [ 384.084459] erofs: root inode @ nid 0 [ 384.092736] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 384.101682] erofs: bogus i_mode (0) @ nid 0 [ 384.108314] erofs: FAULT_INJECTION was not selected [ 384.113420] erofs: root inode @ nid 36 [ 384.118614] erofs: mounted on /dev/loop2 with opts: noacl. 20:43:35 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x4, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 384.150179] erofs: read_super, device -> /dev/loop4 20:43:35 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x23000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 384.209291] erofs: unmounted for /dev/loop2 [ 384.224420] erofs: options -> noacl,acl, [ 384.235932] erofs: root inode @ nid 36 [ 384.269926] FAULT_INJECTION: forcing a failure. [ 384.269926] name failslab, interval 1, probability 0, space 0, times 0 [ 384.277084] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 384.290299] 9pnet: Could not find request transport: xen [ 384.304919] CPU: 0 PID: 23916 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 384.312828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 384.315763] erofs: read_super, device -> /dev/loop0 [ 384.322182] Call Trace: [ 384.322204] dump_stack+0x1fc/0x2ef [ 384.322222] should_fail.cold+0xa/0xf [ 384.322239] ? setup_fault_attr+0x200/0x200 [ 384.322253] ? static_obj+0x50/0x50 [ 384.322274] __should_failslab+0x115/0x180 [ 384.349495] should_failslab+0x5/0x10 [ 384.353316] kmem_cache_alloc+0x3f/0x370 [ 384.357385] ? mempool_alloc+0x350/0x350 [ 384.361454] mempool_alloc+0x146/0x350 [ 384.365356] ? mempool_resize+0x790/0x790 [ 384.369517] ? find_get_entry+0x4f4/0x8a0 [ 384.373684] bio_alloc_bioset+0x389/0x5e0 [ 384.377842] ? mark_page_accessed+0x581/0xda0 [ 384.382349] ? bvec_alloc+0x2f0/0x2f0 [ 384.385838] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 384.386161] ? pagecache_get_page+0x1c4/0xd50 [ 384.386186] erofs_get_meta_page+0x2bb/0xcd0 [ 384.386210] erofs_iget+0x21b/0x2720 [ 384.386235] erofs_fill_super+0xf65/0x12cc [ 384.413373] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 384.418663] ? vsprintf+0x30/0x30 [ 384.422133] ? wait_for_completion_io+0x10/0x10 [ 384.426812] ? set_blocksize+0x163/0x3f0 [ 384.430893] mount_bdev+0x2fc/0x3b0 [ 384.434240] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 384.434536] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 384.434555] erofs_mount+0x8c/0xc0 [ 384.451129] ? erofs_kill_sb+0x20/0x20 [ 384.455036] ? alloc_pages_current+0x19b/0x2a0 [ 384.459630] ? __lockdep_init_map+0x100/0x5a0 [ 384.464141] mount_fs+0xa3/0x310 [ 384.467523] vfs_kern_mount.part.0+0x68/0x470 [ 384.472043] do_mount+0x115c/0x2f50 [ 384.475431] erofs: FAULT_INJECTION was not selected [ 384.475851] ? cmp_ex_sort+0xc0/0xc0 [ 384.484574] ? __do_page_fault+0x180/0xd60 [ 384.488822] ? copy_mount_string+0x40/0x40 [ 384.493080] ? memset+0x20/0x40 [ 384.496372] ? copy_mount_options+0x26f/0x380 [ 384.500884] ksys_mount+0xcf/0x130 [ 384.504443] __x64_sys_mount+0xba/0x150 [ 384.508435] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 384.513029] do_syscall_64+0xf9/0x620 20:43:35 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 384.514763] erofs: root inode @ nid 0 [ 384.516929] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 384.516941] RIP: 0033:0x7f9c3f20f7aa [ 384.516955] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 384.516962] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 384.516975] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 384.516983] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 384.516990] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 384.516999] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 384.517006] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 384.594644] erofs: mounted on /dev/loop4 with opts: noacl. [ 384.597984] erofs: read_super, device -> /dev/loop2 [ 384.603673] 9pnet: Could not find request transport: xen 20:43:36 executing program 4: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}]}) (fail_nth: 58) [ 384.633012] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 384.670601] erofs: FAULT_INJECTION was not selected [ 384.680449] erofs: unmounted for /dev/loop4 [ 384.690997] erofs: root inode @ nid 36 [ 384.695082] erofs: mounted on /dev/loop2 with opts: noacl. [ 384.701888] erofs: bogus i_mode (0) @ nid 0 20:43:36 executing program 2: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x3f000000, 0x3, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c0024", 0xf, 0x400}, {&(0x7f0000010100)="05000000c041", 0x6, 0x480}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) 20:43:36 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r3 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000240)={0x0, @rand_addr, @initdev}, &(0x7f0000000180)=0xc) [ 384.769401] erofs: unmounted for /dev/loop2 20:43:36 executing program 5: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400000024001d0f0000010400000000000000", @ANYRES32, @ANYBLOB="0b000000f1fff1ff00000000040008801400010070"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') 20:43:36 executing program 0: syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x8, &(0x7f0000000140)=[{&(0x7f0000010000)="e2e1f5e0ea02744a010000000c", 0xd, 0x400}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000080)={[{@noacl}, {@acl}, {@fault_injection}]}) [ 384.810357] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 384.845252] 9pnet: Could not find request transport: xen [ 384.854990] erofs: read_super, device -> /dev/loop4 [ 384.861108] erofs: options -> noacl,acl, [ 384.865417] erofs: root inode @ nid 36 [ 384.870943] FAULT_INJECTION: forcing a failure. [ 384.870943] name failslab, interval 1, probability 0, space 0, times 0 [ 384.883083] CPU: 0 PID: 23947 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 384.890972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 384.900323] Call Trace: [ 384.902923] dump_stack+0x1fc/0x2ef [ 384.906567] should_fail.cold+0xa/0xf [ 384.910381] ? setup_fault_attr+0x200/0x200 [ 384.914716] ? lock_acquire+0x170/0x3c0 [ 384.918702] __should_failslab+0x115/0x180 [ 384.922956] should_failslab+0x5/0x10 [ 384.926768] kmem_cache_alloc+0x277/0x370 [ 384.930930] __d_alloc+0x2b/0xa10 [ 384.934406] d_make_root+0x3e/0x90 [ 384.937959] erofs_fill_super+0x102f/0x12cc [ 384.942301] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 384.947600] ? vsprintf+0x30/0x30 [ 384.951073] ? wait_for_completion_io+0x10/0x10 [ 384.955755] ? set_blocksize+0x163/0x3f0 20:43:36 executing program 3: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc000000000000}, 0x0, 0x0, 0x0, 0x0, 0x1f, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='lowerdir=.:file0']) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) lsetxattr$system_posix_acl(&(0x7f0000000600)='./bus\x00', &(0x7f00000006c0)='system.posix_acl_default\x00', &(0x7f0000000a80)={{}, {}, [{}, {}, {}, {}, {0x2, 0x4}, {0x2, 0x4}], {0x4, 0x4}, [{}]}, 0x5c, 0x0) creat(&(0x7f0000000180)='./bus/file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) rename(&(0x7f0000000380)='./bus\x00', &(0x7f00000005c0)='./bus/file0\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYRES32, @ANYBLOB="0b000000f1fff1ff0000000004000880140001007066"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000780)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000010) mount(&(0x7f0000000340)=@sr0, 0x0, &(0x7f0000000500)='fuseblk\x00', 0x180b004, &(0x7f0000000540)='fsmagic') rename(0x0, &(0x7f00000003c0)='./bus\x00') lsetxattr$security_capability(0x0, &(0x7f0000000880), &(0x7f0000000900)=@v2, 0x14, 0x1) mount$9p_xen(&(0x7f00000002c0), &(0x7f00000004c0)='./bus\x00', &(0x7f0000000580), 0x8, &(0x7f0000000b00)={'trans=xen,', {[{@debug}, {@nodevmap}, {@cache_mmap}, {@posixacl}, {@access_uid}, {@cache_loose}], [{@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@dont_hash}, {@permit_directio}, {@euid_lt}, {@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fsmagic={'fsmagic', 0x3d, 0x7}}]}}) chdir(&(0x7f00000001c0)='./bus\x00') rename(&(0x7f0000000100)='./bus/file0\x00', &(0x7f0000000440)='./file0\x00') [ 384.960182] mount_bdev+0x2fc/0x3b0 [ 384.963822] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 384.969117] erofs_mount+0x8c/0xc0 [ 384.972675] ? erofs_kill_sb+0x20/0x20 [ 384.976588] ? alloc_pages_current+0x19b/0x2a0 [ 384.981180] ? __lockdep_init_map+0x100/0x5a0 [ 384.985684] mount_fs+0xa3/0x310 [ 384.989070] vfs_kern_mount.part.0+0x68/0x470 [ 384.993577] do_mount+0x115c/0x2f50 [ 384.997209] ? cmp_ex_sort+0xc0/0xc0 [ 385.000939] ? __do_page_fault+0x180/0xd60 [ 385.005183] ? copy_mount_string+0x40/0x40 [ 385.009435] ? memset+0x20/0x40 [ 385.012726] ? copy_mount_options+0x26f/0x380 [ 385.017235] ksys_mount+0xcf/0x130 [ 385.020790] __x64_sys_mount+0xba/0x150 [ 385.024773] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 385.029364] do_syscall_64+0xf9/0x620 [ 385.033172] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 385.038365] RIP: 0033:0x7f9c3f20f7aa [ 385.042085] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 385.061038] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 385.068753] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 385.076030] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 385.083306] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 385.090580] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 385.097855] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 385.129610] erofs: read_super, device -> /dev/loop0 [ 385.136067] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 385.141769] ------------[ cut here ]------------ [ 385.147960] kernel BUG at fs/inode.c:1571! [ 385.165635] erofs: read_super, device -> /dev/loop2 [ 385.195060] erofs: options -> noacl,acl,fault_injection=0x0000000000000000, [ 385.215831] 9pnet: Could not find request transport: xen [ 385.230841] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 385.240388] erofs: FAULT_INJECTION was not selected [ 385.245902] erofs: FAULT_INJECTION was not selected [ 385.263665] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 385.269219] CPU: 0 PID: 23947 Comm: syz-executor.4 Not tainted 4.19.211-syzkaller #0 [ 385.277099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 [ 385.281161] erofs: root inode @ nid 0 [ 385.286463] RIP: 0010:iput+0x727/0x860 [ 385.286476] Code: b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 84 18 fd ff ff 48 8b 3c 24 e8 33 d9 ee ff e9 0a fd ff ff e8 39 fc b8 ff <0f> 0b e8 32 fc b8 ff 48 89 ef e8 1a f7 ff ff 4c 89 f7 e8 b2 c6 6f [ 385.286487] RSP: 0018:ffff88805369fa80 EFLAGS: 00010246 [ 385.318413] RAX: 0000000000040000 RBX: 0000000000000040 RCX: ffffc900076ed000 [ 385.325686] RDX: 0000000000040000 RSI: ffffffff81a98937 RDI: 0000000000000007 [ 385.332967] RBP: ffff88805c001268 R08: 0000000000000000 R09: 0000000000000000 [ 385.336785] erofs: root inode @ nid 36 [ 385.340235] R10: 0000000000000007 R11: 0000000000000000 R12: ffff88809c2facc0 [ 385.340243] R13: ffff88805c001268 R14: 0000000000000000 R15: 00000000fffffff4 [ 385.340254] FS: 00007f9c3db83700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 [ 385.340260] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 385.340272] CR2: 0000001b2f637000 CR3: 00000000a1251000 CR4: 00000000003406f0 [ 385.368174] erofs: mounted on /dev/loop2 with opts: noacl. [ 385.372981] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 385.372990] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 385.372994] Call Trace: [ 385.373018] erofs_fill_super+0x1205/0x12cc [ 385.390695] erofs: bogus i_mode (0) @ nid 0 [ 385.393153] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 385.393165] ? vsprintf+0x30/0x30 [ 385.393181] ? wait_for_completion_io+0x10/0x10 [ 385.424995] ? set_blocksize+0x163/0x3f0 [ 385.429065] mount_bdev+0x2fc/0x3b0 [ 385.432698] ? gb_gbphy_register_driver.cold+0x39/0x39 [ 385.437985] erofs_mount+0x8c/0xc0 [ 385.441536] ? erofs_kill_sb+0x20/0x20 [ 385.445436] ? alloc_pages_current+0x19b/0x2a0 [ 385.450032] ? __lockdep_init_map+0x100/0x5a0 [ 385.454532] mount_fs+0xa3/0x310 [ 385.457909] vfs_kern_mount.part.0+0x68/0x470 [ 385.462418] do_mount+0x115c/0x2f50 [ 385.466058] ? cmp_ex_sort+0xc0/0xc0 [ 385.469779] ? __do_page_fault+0x180/0xd60 [ 385.474025] ? copy_mount_string+0x40/0x40 [ 385.478270] ? memset+0x20/0x40 [ 385.481484] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 385.481554] ? copy_mount_options+0x26f/0x380 [ 385.481571] ksys_mount+0xcf/0x130 [ 385.499801] __x64_sys_mount+0xba/0x150 [ 385.503786] ? lockdep_hardirqs_on+0x3a8/0x5c0 [ 385.508468] do_syscall_64+0xf9/0x620 [ 385.512278] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 385.514569] 9pnet: Could not find request transport: xen [ 385.517463] RIP: 0033:0x7f9c3f20f7aa [ 385.517476] Code: 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 385.517483] RSP: 002b:00007f9c3db82f88 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 385.517494] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 00007f9c3f20f7aa [ 385.517502] RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9c3db82fe0 [ 385.517509] RBP: 00007f9c3db83020 R08: 00007f9c3db83020 R09: 0000000020000000 [ 385.517517] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000020000000 [ 385.517524] R13: 0000000020000100 R14: 00007f9c3db82fe0 R15: 0000000020000080 [ 385.517535] Modules linked in: [ 385.552564] ---[ end trace feb97ffd66107bd7 ]--- [ 385.552582] RIP: 0010:iput+0x727/0x860 [ 385.552596] Code: b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 84 18 fd ff ff 48 8b 3c 24 e8 33 d9 ee ff e9 0a fd ff ff e8 39 fc b8 ff <0f> 0b e8 32 fc b8 ff 48 89 ef e8 1a f7 ff ff 4c 89 f7 e8 b2 c6 6f [ 385.552604] RSP: 0018:ffff88805369fa80 EFLAGS: 00010246 [ 385.552615] RAX: 0000000000040000 RBX: 0000000000000040 RCX: ffffc900076ed000 [ 385.552623] RDX: 0000000000040000 RSI: ffffffff81a98937 RDI: 0000000000000007 [ 385.552631] RBP: ffff88805c001268 R08: 0000000000000000 R09: 0000000000000000 [ 385.552638] R10: 0000000000000007 R11: 0000000000000000 R12: ffff88809c2facc0 [ 385.552646] R13: ffff88805c001268 R14: 0000000000000000 R15: 00000000fffffff4 [ 385.552658] FS: 00007f9c3db83700(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 [ 385.552666] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 385.552673] CR2: 0000001b2f63f000 CR3: 00000000a1251000 CR4: 00000000003406f0 [ 385.552686] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 385.552694] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 385.552701] Kernel panic - not syncing: Fatal exception [ 385.552899] Kernel Offset: disabled [ 385.714203] Rebooting in 86400 seconds..