[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 56.783783][ T26] audit: type=1800 audit(1572354331.260:25): pid=8538 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 56.803851][ T26] audit: type=1800 audit(1572354331.270:26): pid=8538 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 56.826036][ T26] audit: type=1800 audit(1572354331.270:27): pid=8538 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.38' (ECDSA) to the list of known hosts. 2019/10/29 13:05:42 fuzzer started 2019/10/29 13:05:43 dialing manager at 10.128.0.26:34715 2019/10/29 13:05:43 syscalls: 2541 2019/10/29 13:05:43 code coverage: enabled 2019/10/29 13:05:43 comparison tracing: enabled 2019/10/29 13:05:43 extra coverage: extra coverage is not supported by the kernel 2019/10/29 13:05:43 setuid sandbox: enabled 2019/10/29 13:05:43 namespace sandbox: enabled 2019/10/29 13:05:43 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/29 13:05:43 fault injection: enabled 2019/10/29 13:05:43 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/29 13:05:43 net packet injection: enabled 2019/10/29 13:05:43 net device setup: enabled 2019/10/29 13:05:43 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 13:07:20 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2, 0x40003, 0x0, 0x2, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}]}, 0x50}}, 0x0) 13:07:20 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x12, &(0x7f0000fbe000)={0x0, 0x0}, 0x10) syzkaller login: [ 165.695292][ T8701] IPVS: ftp: loaded support on port[0] = 21 [ 165.864938][ T8701] chnl_net:caif_netlink_parms(): no params data found 13:07:20 executing program 2: r0 = epoll_create1(0x0) flock(r0, 0x6) r1 = epoll_create1(0x0) flock(r1, 0x2) r2 = gettid() dup2(r0, r1) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r2, 0x1000000000015) [ 165.957206][ T8704] IPVS: ftp: loaded support on port[0] = 21 [ 165.964264][ T8701] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.990120][ T8701] bridge0: port 1(bridge_slave_0) entered disabled state [ 166.009932][ T8701] device bridge_slave_0 entered promiscuous mode [ 166.030494][ T8701] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.037648][ T8701] bridge0: port 2(bridge_slave_1) entered disabled state [ 166.071044][ T8701] device bridge_slave_1 entered promiscuous mode [ 166.132555][ T8701] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 166.152685][ T8701] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 166.181172][ T8707] IPVS: ftp: loaded support on port[0] = 21 13:07:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0800b5055e0bcfe87b0071") r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0xfea2, 0x20000802, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0xffffffd8) [ 166.221538][ T8701] team0: Port device team_slave_0 added [ 166.279272][ T8701] team0: Port device team_slave_1 added [ 166.347586][ T8704] chnl_net:caif_netlink_parms(): no params data found [ 166.424484][ T8701] device hsr_slave_0 entered promiscuous mode 13:07:21 executing program 4: io_setup(0x8e30, &(0x7f0000000100)=0x0) io_destroy(r0) [ 166.489542][ T8701] device hsr_slave_1 entered promiscuous mode [ 166.577265][ T8710] IPVS: ftp: loaded support on port[0] = 21 [ 166.702325][ T8704] bridge0: port 1(bridge_slave_0) entered blocking state [ 166.711195][ T8704] bridge0: port 1(bridge_slave_0) entered disabled state [ 166.720462][ T8704] device bridge_slave_0 entered promiscuous mode [ 166.741921][ T8707] chnl_net:caif_netlink_parms(): no params data found [ 166.753882][ T8704] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.761811][ T8704] bridge0: port 2(bridge_slave_1) entered disabled state [ 166.771181][ T8704] device bridge_slave_1 entered promiscuous mode [ 166.788308][ T8701] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.795624][ T8701] bridge0: port 2(bridge_slave_1) entered forwarding state [ 166.803558][ T8701] bridge0: port 1(bridge_slave_0) entered blocking state [ 166.810717][ T8701] bridge0: port 1(bridge_slave_0) entered forwarding state [ 166.886153][ T8704] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 166.905711][ T8713] IPVS: ftp: loaded support on port[0] = 21 [ 166.914830][ T47] bridge0: port 1(bridge_slave_0) entered disabled state 13:07:21 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f00000000c0)=@get={0x1, &(0x7f0000000cc0)=""/4096, 0xd00e}) fchdir(r0) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f00000004c0)={0x0, 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x0, &(0x7f0000005c80)=0x9, 0xfffffffffffffff9) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000240)=0x1, 0x4) fcntl$notify(r0, 0x402, 0x8) getpid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x5, &(0x7f0000000140)=[{0x2, 0x1, 0x46a, 0x2b}, {0x5, 0x6e4, 0xffffffffffffffff}, {0x0, 0x8001, 0x9, 0x77d5241e}, {0xbf, 0x4, 0x0, 0x101}, {0x1, 0x7fffffff}]}) r3 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x0, 0x82) r4 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7}, 0x7) ioctl$FS_IOC_MEASURE_VERITY(r3, 0xc0046686, &(0x7f0000000780)=ANY=[@ANYBLOB="1d00dd00e93b1a7f79947e8edc0a4b5d5e7d91009b4ae28a97eded91288fc23735d36bb8cd6463ea972f091ca729dc094d433f8cd1e748070d207d7183ffcef0f53281153c77c43af59e3edf45a024b33dcc5ea96db30aad178b24976695e74b61482374e76f0c6bf5d00895d53f4bb54fe9d097614cf46a33f8ec7aa1c36e03b11b60de0ff8a6f0ffaa66d3699a2c7c6287e4aa4a766d03a8bcf6b3b9b9eb7bba09fb37a2b2de5952806422e9b942212888c8dc17671d6013da22f0f216e997045270a7045988fd6eee7abff784c65fe3993030ec1a3cba2aa341f07edbabb9d94906ff3b8e5a6a2d40e3fc7b31afe5e9f60f085402e1349e2cef03caf38c864f0dace9392cc381ea366518bc4e434553bb4314c74d99f719fde5f7789920fde81fe76664067500db5552edd9dfbf9f8783e90fda90669e30abdf18359ab8af075dd3fbdd6705d226e74f00000000000000"]) ioctl$BLKDISCARD(r3, 0x1277, &(0x7f0000000180)=0x6) r5 = syz_open_dev$admmidi(&(0x7f0000000300)='/dev/admmidi#\x00', 0xffffffffffff8538, 0x400200) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000280)={'irlan0\x00', {0x2, 0x4e24, @empty}}) pwritev(r4, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) r6 = syz_open_procfs(0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xf4X#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r6, &(0x7f0000000b00)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\xfb\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0x0) io_destroy(r0) 13:07:26 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f00000000c0)=@get={0x1, &(0x7f0000000cc0)=""/4096, 0xd00e}) fchdir(r0) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f00000004c0)={0x0, 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x0, &(0x7f0000005c80)=0x9, 0xfffffffffffffff9) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000240)=0x1, 0x4) fcntl$notify(r0, 0x402, 0x8) getpid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x5, &(0x7f0000000140)=[{0x2, 0x1, 0x46a, 0x2b}, {0x5, 0x6e4, 0xffffffffffffffff}, {0x0, 0x8001, 0x9, 0x77d5241e}, {0xbf, 0x4, 0x0, 0x101}, {0x1, 0x7fffffff}]}) r3 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x0, 0x82) r4 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7}, 0x7) ioctl$FS_IOC_MEASURE_VERITY(r3, 0xc0046686, &(0x7f0000000780)=ANY=[@ANYBLOB="1d00dd00e93b1a7f79947e8edc0a4b5d5e7d91009b4ae28a97eded91288fc23735d36bb8cd6463ea972f091ca729dc094d433f8cd1e748070d207d7183ffcef0f53281153c77c43af59e3edf45a024b33dcc5ea96db30aad178b24976695e74b61482374e76f0c6bf5d00895d53f4bb54fe9d097614cf46a33f8ec7aa1c36e03b11b60de0ff8a6f0ffaa66d3699a2c7c6287e4aa4a766d03a8bcf6b3b9b9eb7bba09fb37a2b2de5952806422e9b942212888c8dc17671d6013da22f0f216e997045270a7045988fd6eee7abff784c65fe3993030ec1a3cba2aa341f07edbabb9d94906ff3b8e5a6a2d40e3fc7b31afe5e9f60f085402e1349e2cef03caf38c864f0dace9392cc381ea366518bc4e434553bb4314c74d99f719fde5f7789920fde81fe76664067500db5552edd9dfbf9f8783e90fda90669e30abdf18359ab8af075dd3fbdd6705d226e74f00000000000000"]) ioctl$BLKDISCARD(r3, 0x1277, &(0x7f0000000180)=0x6) r5 = syz_open_dev$admmidi(&(0x7f0000000300)='/dev/admmidi#\x00', 0xffffffffffff8538, 0x400200) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000280)={'irlan0\x00', {0x2, 0x4e24, @empty}}) pwritev(r4, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) r6 = syz_open_procfs(0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xf4X#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r6, &(0x7f0000000b00)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\xfb\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0x0) io_destroy(r0) 13:07:26 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f00000000c0)=@get={0x1, &(0x7f0000000cc0)=""/4096, 0xd00e}) fchdir(r0) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f00000004c0)={0x0, 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x0, &(0x7f0000005c80)=0x9, 0xfffffffffffffff9) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000240)=0x1, 0x4) fcntl$notify(r0, 0x402, 0x8) getpid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x5, &(0x7f0000000140)=[{0x2, 0x1, 0x46a, 0x2b}, {0x5, 0x6e4, 0xffffffffffffffff}, {0x0, 0x8001, 0x9, 0x77d5241e}, {0xbf, 0x4, 0x0, 0x101}, {0x1, 0x7fffffff}]}) r3 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x0, 0x82) r4 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7}, 0x7) ioctl$FS_IOC_MEASURE_VERITY(r3, 0xc0046686, &(0x7f0000000780)=ANY=[@ANYBLOB="1d00dd00e93b1a7f79947e8edc0a4b5d5e7d91009b4ae28a97eded91288fc23735d36bb8cd6463ea972f091ca729dc094d433f8cd1e748070d207d7183ffcef0f53281153c77c43af59e3edf45a024b33dcc5ea96db30aad178b24976695e74b61482374e76f0c6bf5d00895d53f4bb54fe9d097614cf46a33f8ec7aa1c36e03b11b60de0ff8a6f0ffaa66d3699a2c7c6287e4aa4a766d03a8bcf6b3b9b9eb7bba09fb37a2b2de5952806422e9b942212888c8dc17671d6013da22f0f216e997045270a7045988fd6eee7abff784c65fe3993030ec1a3cba2aa341f07edbabb9d94906ff3b8e5a6a2d40e3fc7b31afe5e9f60f085402e1349e2cef03caf38c864f0dace9392cc381ea366518bc4e434553bb4314c74d99f719fde5f7789920fde81fe76664067500db5552edd9dfbf9f8783e90fda90669e30abdf18359ab8af075dd3fbdd6705d226e74f00000000000000"]) ioctl$BLKDISCARD(r3, 0x1277, &(0x7f0000000180)=0x6) r5 = syz_open_dev$admmidi(&(0x7f0000000300)='/dev/admmidi#\x00', 0xffffffffffff8538, 0x400200) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000280)={'irlan0\x00', {0x2, 0x4e24, @empty}}) pwritev(r4, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) r6 = syz_open_procfs(0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xf4X#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r6, &(0x7f0000000b00)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\xfb\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0x0) io_destroy(r0) 13:07:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0800b5055e0bcfe87b0071") r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffffffffffd, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x200000000011, r2, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, 0x0, 0xfea2, 0x20000802, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0xffffffd8) 13:07:27 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f00000000c0)=@get={0x1, &(0x7f0000000cc0)=""/4096, 0xd00e}) fchdir(r0) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f00000004c0)={0x0, 0x0}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x0, &(0x7f0000005c80)=0x9, 0xfffffffffffffff9) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000240)=0x1, 0x4) fcntl$notify(r0, 0x402, 0x8) getpid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x5, &(0x7f0000000140)=[{0x2, 0x1, 0x46a, 0x2b}, {0x5, 0x6e4, 0xffffffffffffffff}, {0x0, 0x8001, 0x9, 0x77d5241e}, {0xbf, 0x4, 0x0, 0x101}, {0x1, 0x7fffffff}]}) r3 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x0, 0x82) r4 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) write$P9_RSETATTR(r4, &(0x7f0000000000)={0x7}, 0x7) ioctl$FS_IOC_MEASURE_VERITY(r3, 0xc0046686, &(0x7f0000000780)=ANY=[@ANYBLOB="1d00dd00e93b1a7f79947e8edc0a4b5d5e7d91009b4ae28a97eded91288fc23735d36bb8cd6463ea972f091ca729dc094d433f8cd1e748070d207d7183ffcef0f53281153c77c43af59e3edf45a024b33dcc5ea96db30aad178b24976695e74b61482374e76f0c6bf5d00895d53f4bb54fe9d097614cf46a33f8ec7aa1c36e03b11b60de0ff8a6f0ffaa66d3699a2c7c6287e4aa4a766d03a8bcf6b3b9b9eb7bba09fb37a2b2de5952806422e9b942212888c8dc17671d6013da22f0f216e997045270a7045988fd6eee7abff784c65fe3993030ec1a3cba2aa341f07edbabb9d94906ff3b8e5a6a2d40e3fc7b31afe5e9f60f085402e1349e2cef03caf38c864f0dace9392cc381ea366518bc4e434553bb4314c74d99f719fde5f7789920fde81fe76664067500db5552edd9dfbf9f8783e90fda90669e30abdf18359ab8af075dd3fbdd6705d226e74f00000000000000"]) ioctl$BLKDISCARD(r3, 0x1277, &(0x7f0000000180)=0x6) r5 = syz_open_dev$admmidi(&(0x7f0000000300)='/dev/admmidi#\x00', 0xffffffffffff8538, 0x400200) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000280)={'irlan0\x00', {0x2, 0x4e24, @empty}}) pwritev(r4, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) r6 = syz_open_procfs(0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xf4X#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r6, &(0x7f0000000b00)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\xfb\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x18, 0x0, &(0x7f0000000380)=[@decrefs={0x40046305}, @clear_death={0x40046306}], 0x0, 0x0, 0x0}) [ 181.541634][ T9198] binder: 9195:9198 unknown command 0 [ 181.582556][ T9198] binder: 9195:9198 ioctl c0306201 20000080 returned -22 13:07:36 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000d379)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000140001030000000000005bb828d4bc1ae08950b579f566b1e4c15b6c0000b8040d00"], 0x9b}}, 0x0) 13:07:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x18, 0x0, &(0x7f0000000380)=[@decrefs={0x40046305}, @clear_death={0x40046306}], 0x0, 0x0, 0x0}) 13:07:36 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000700)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@empty, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@tmpl={0x44, 0x5, [{{}, 0x2, @in=@multicast2}]}]}, 0xfc}}, 0x0) 13:07:36 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000000140)='H', 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="480000001400190d09004beafd0d8c560284ed7a80ffe00600000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed4e00009052946f02", 0x48}], 0x1) recvmmsg(r2, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=""/166, 0xa6}, {&(0x7f0000000180)=""/157, 0x9d}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x3}}], 0x1, 0x0, 0x0) 13:07:36 executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000000140)='H', 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="480000001400190d09004beafd0d8c560284ed7a80ffe00600000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed4e00009052946f02", 0x48}], 0x1) recvmmsg(r2, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=""/166, 0xa6}, {&(0x7f0000000180)=""/157, 0x9d}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x3}}], 0x1, 0x0, 0x0) 13:07:36 executing program 2: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x21, 0x2, 0x2, &(0x7f0000000040)) [ 182.198273][ T9215] binder: 9212:9215 unknown command 0 [ 182.311323][ T9215] binder: 9212:9215 ioctl c0306201 20000080 returned -22 13:07:36 executing program 5: clock_nanosleep(0x0, 0x1, &(0x7f0000000040)={0x77359400}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) sendmmsg(0xffffffffffffffff, &(0x7f0000005480)=[{{&(0x7f0000000000)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x80, 0x0}}], 0x1, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 13:07:36 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000341000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000395000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) 13:07:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x18, 0x0, &(0x7f0000000380)=[@decrefs={0x40046305}, @clear_death={0x40046306}], 0x0, 0x0, 0x0}) 13:07:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r1 = fsopen(&(0x7f0000000000)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x6, 0x0, 0x0, 0x0) 13:07:37 executing program 0: setrlimit(0x7, &(0x7f0000becff0)) clone(0x802102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 182.729728][ T9244] binder: 9241:9244 unknown command 0 13:07:37 executing program 5: clock_nanosleep(0x0, 0x1, &(0x7f0000000040)={0x77359400}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) sendmmsg(0xffffffffffffffff, &(0x7f0000005480)=[{{&(0x7f0000000000)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x80, 0x0}}], 0x1, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) [ 182.789084][ T9244] binder: 9241:9244 ioctl c0306201 20000080 returned -22 13:07:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r1, r2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x18, 0x0, &(0x7f0000000380)=[@decrefs={0x40046305}, @clear_death={0x40046306}], 0x0, 0x0, 0x0}) 13:07:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r1 = fsopen(&(0x7f0000000000)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x6, 0x0, 0x0, 0x0) 13:07:37 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, 0x0) 13:07:37 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000000140)='H', 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="480000001400190d09004beafd0d8c560284ed7a80ffe00600000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed4e00009052946f02", 0x48}], 0x1) recvmmsg(r2, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=""/166, 0xa6}, {&(0x7f0000000180)=""/157, 0x9d}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x3}}], 0x1, 0x0, 0x0) 13:07:37 executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000000140)='H', 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="480000001400190d09004beafd0d8c560284ed7a80ffe00600000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed4e00009052946f02", 0x48}], 0x1) recvmmsg(r2, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=""/166, 0xa6}, {&(0x7f0000000180)=""/157, 0x9d}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x3}}], 0x1, 0x0, 0x0) 13:07:37 executing program 5: clock_nanosleep(0x0, 0x1, &(0x7f0000000040)={0x77359400}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) sendmmsg(0xffffffffffffffff, &(0x7f0000005480)=[{{&(0x7f0000000000)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x80, 0x0}}], 0x1, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 13:07:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r1 = fsopen(&(0x7f0000000000)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x6, 0x0, 0x0, 0x0) [ 183.160154][ T9266] binder: 9265:9266 unknown command 0 [ 183.199448][ T9266] binder: 9265:9266 ioctl c0306201 20000080 returned -22 13:07:37 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x11, @rand_addr, 0x0, 0x0, 'lblcr\x00', 0x27}, 0x2c) 13:07:37 executing program 5: clock_nanosleep(0x0, 0x1, &(0x7f0000000040)={0x77359400}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) sendmmsg(0xffffffffffffffff, &(0x7f0000005480)=[{{&(0x7f0000000000)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x80, 0x0}}], 0x1, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) tkill(r0, 0x15) 13:07:38 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r1 = fsopen(&(0x7f0000000000)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x6, 0x0, 0x0, 0x0) [ 183.510200][ T9293] IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0xdcc/0xec0 13:07:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x11, @rand_addr, 0x0, 0x0, 'lblcr\x00', 0x27}, 0x2c) 13:07:38 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000000)='team\x00') ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x60, r1, 0x1, 0x0, 0x0, {0x1, 0x6c00000000000000}, [{{0x8, 0x1, r2}, {0x44, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x3}}, {0x8}}}]}}]}, 0x60}}, 0x0) 13:07:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0xfffffffffffffe79, &(0x7f0000000200)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x10, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}, @IFLA_ADDRESS={0x6, 0x1, @dev}]}, 0x40}}, 0x0) [ 183.656782][ T9304] IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0xdcc/0xec0 13:07:38 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0x80045518, &(0x7f0000000340)=@urb_type_control={0x2, {0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 13:07:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x11, @rand_addr, 0x0, 0x0, 'lblcr\x00', 0x27}, 0x2c) [ 183.756782][ T9309] netlink: 'syz-executor.2': attribute type 3 has an invalid length. [ 183.814441][ T9309] netlink: 'syz-executor.2': attribute type 3 has an invalid length. [ 183.837075][ T9311] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 183.877506][ T9318] IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0xdcc/0xec0 13:07:38 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000000140)='H', 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="480000001400190d09004beafd0d8c560284ed7a80ffe00600000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed4e00009052946f02", 0x48}], 0x1) recvmmsg(r2, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=""/166, 0xa6}, {&(0x7f0000000180)=""/157, 0x9d}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x3}}], 0x1, 0x0, 0x0) 13:07:38 executing program 0: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000000)={0x30}, 0x30) 13:07:38 executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000000140)='H', 0x1, 0x0, &(0x7f0000000100)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000280)=[{&(0x7f0000000040)="480000001400190d09004beafd0d8c560284ed7a80ffe00600000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed4e00009052946f02", 0x48}], 0x1) recvmmsg(r2, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=""/166, 0xa6}, {&(0x7f0000000180)=""/157, 0x9d}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x3}}], 0x1, 0x0, 0x0) 13:07:38 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='bpf\x00', 0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB=',lowerdir=.:file0']) open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) chdir(&(0x7f0000000080)='./file0\x00') chown(&(0x7f0000000140)='./bus\x00', 0xee01, 0x0) 13:07:38 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x5, 0x3f, 0x6d, 0x2, 0x0, 0x0}, 0x26) unshare(0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000480), &(0x7f00000000c0)}, 0x20) r1 = dup(r0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r1, &(0x7f0000000640)}, 0x20) 13:07:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x11, @rand_addr, 0x0, 0x0, 'lblcr\x00', 0x27}, 0x2c) [ 184.239505][ T9327] IPVS: ip_vs_svc_hash(): request for already hashed, called from do_ip_vs_set_ctl+0xdcc/0xec0 13:07:38 executing program 0: socket(0x200000000000011, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) geteuid() ioprio_set$uid(0x3, 0x0, 0x0) 13:07:38 executing program 5: r0 = creat(&(0x7f0000000280)='./file0\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet_sctp(r0, &(0x7f0000000b40)=[{&(0x7f0000000200)=@in6={0xa, 0x0, 0x0, @rand_addr="e10c8ffd9d48c5ddcbac3b70d4ec45c6"}, 0x1c, &(0x7f00000004c0)=[{&(0x7f00000002c0)="fd", 0x1}], 0x1, &(0x7f0000000080)=[@sndrcv={0x30}], 0x30}], 0x1, 0x4000040) 13:07:38 executing program 3: r0 = socket$vsock_stream(0x28, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x240000c5) 13:07:38 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000300)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x100000351, 0x20020059, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) shutdown(r0, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvmmsg(r0, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 13:07:38 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x0) pipe(&(0x7f00000015c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:07:38 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) r0 = add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)='g', 0x524, 0xfffffffffffffffb) keyctl$revoke(0x3, r0) keyctl$revoke(0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) [ 184.536189][ T9357] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 13:07:39 executing program 0: socket(0x200000000000011, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) geteuid() ioprio_set$uid(0x3, 0x0, 0x0) 13:07:39 executing program 4: madvise(&(0x7f0000aa2000/0x1000)=nil, 0x20aa2000, 0x4) 13:07:39 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) r0 = add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)='g', 0x524, 0xfffffffffffffffb) keyctl$revoke(0x3, r0) keyctl$revoke(0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) 13:07:39 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) r0 = add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)='g', 0x524, 0xfffffffffffffffb) keyctl$revoke(0x3, r0) keyctl$revoke(0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) 13:07:39 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) rt_sigpending(&(0x7f0000000000), 0x4f) 13:07:39 executing program 0: socket(0x200000000000011, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) geteuid() ioprio_set$uid(0x3, 0x0, 0x0) 13:07:39 executing program 4: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, &(0x7f00000008c0)={0xa}) 13:07:39 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) r0 = add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)='g', 0x524, 0xfffffffffffffffb) keyctl$revoke(0x3, r0) keyctl$revoke(0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) 13:07:39 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) r0 = add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)='g', 0x524, 0xfffffffffffffffb) keyctl$revoke(0x3, r0) keyctl$revoke(0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) 13:07:39 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) getsockopt$inet_mreqsrc(r0, 0x0, 0xe, 0x0, &(0x7f00000002c0)) 13:07:40 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x0) pipe(&(0x7f00000015c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:07:40 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000300)='|', 0x9d80}], 0x8, &(0x7f0000000600)=[@rights={{0x18, 0x1, 0x1, [r0, r0]}}], 0x18}], 0x1, 0x0) 13:07:40 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) r0 = add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)='g', 0x524, 0xfffffffffffffffb) keyctl$revoke(0x3, r0) keyctl$revoke(0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) 13:07:40 executing program 0: socket(0x200000000000011, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) geteuid() ioprio_set$uid(0x3, 0x0, 0x0) 13:07:40 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9) r0 = add_key(&(0x7f0000000040)='big_key\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)='g', 0x524, 0xfffffffffffffffb) keyctl$revoke(0x3, r0) keyctl$revoke(0x3, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) 13:07:40 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) getsockopt$inet_mreqsrc(r0, 0x0, 0xe, 0x0, &(0x7f00000002c0)) 13:07:40 executing program 4: perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000580), 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f1, &(0x7f0000000580)='ip6_vti0\x00') ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f2, &(0x7f0000000580)='ip6_vti1\x00') 13:07:40 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x31, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f00000089c0)={0x0, 0x0, 0x0}, 0x0) connect$inet(r0, &(0x7f0000000400)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 13:07:40 executing program 2: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000001880)="2600000013003ff1eb14c1f8030322ff001000e313000081093903680000000006000300124b", 0x26) 13:07:40 executing program 5: r0 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)='X', 0x1, 0xfffffffffffffffe) keyctl$search(0xa, r0, &(0x7f0000000000)='trusted\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0) 13:07:40 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) getsockopt$inet_mreqsrc(r0, 0x0, 0xe, 0x0, &(0x7f00000002c0)) 13:07:40 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000140)={0x0, 0x8, 0x4, @tid=r0}, &(0x7f0000000400)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1}, {0x0, 0x1c9c380}}, 0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000ff8)={0xfffffffffffffdb1}, 0x8, 0x0) read(r1, &(0x7f0000000080)=""/128, 0x2c0537e) timer_delete(0x0) 13:07:40 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x0) pipe(&(0x7f00000015c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:07:40 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc(0x0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(0x0, &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [], {}, [{}, {}, {}, {}]}, 0x44, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 13:07:40 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x31, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f00000089c0)={0x0, 0x0, 0x0}, 0x0) connect$inet(r0, &(0x7f0000000400)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 13:07:40 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, 0xfffffffffffffffe, 0x3be) 13:07:40 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) getsockopt$inet_mreqsrc(r0, 0x0, 0xe, 0x0, &(0x7f00000002c0)) 13:07:40 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000140)={0x0, 0x8, 0x4, @tid=r0}, &(0x7f0000000400)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1}, {0x0, 0x1c9c380}}, 0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000ff8)={0xfffffffffffffdb1}, 0x8, 0x0) read(r1, &(0x7f0000000080)=""/128, 0x2c0537e) timer_delete(0x0) 13:07:41 executing program 4: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f00000011c0)={0x6, 0x4, 0xc700, 0xe8}, 0x3c) 13:07:41 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_int(r0, 0x101, 0x4, &(0x7f0000000000), 0x4) [ 186.693522][ T9466] overlayfs: workdir and upperdir must reside under the same mount 13:07:41 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000140)={0x0, 0x8, 0x4, @tid=r0}, &(0x7f0000000400)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1}, {0x0, 0x1c9c380}}, 0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000ff8)={0xfffffffffffffdb1}, 0x8, 0x0) read(r1, &(0x7f0000000080)=""/128, 0x2c0537e) timer_delete(0x0) 13:07:41 executing program 4: r0 = socket$inet(0x2, 0x4000000805, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = dup3(r0, r1, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r2, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r1, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000025e000)=ANY=[@ANYBLOB="e92b0000", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000c40)={r4}, &(0x7f0000000d00)=0x8) [ 186.772655][ T9477] overlayfs: workdir and upperdir must reside under the same mount 13:07:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x31, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f00000089c0)={0x0, 0x0, 0x0}, 0x0) connect$inet(r0, &(0x7f0000000400)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 13:07:41 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_int(r0, 0x101, 0x4, &(0x7f0000000000), 0x4) 13:07:41 executing program 3: signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000ff8), 0x8, 0x0) openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x0) pipe(&(0x7f00000015c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 13:07:41 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc(0x0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(0x0, &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [], {}, [{}, {}, {}, {}]}, 0x44, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 13:07:41 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_int(r0, 0x101, 0x4, &(0x7f0000000000), 0x4) 13:07:41 executing program 4: r0 = socket$inet(0x2, 0x4000000805, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = dup3(r0, r1, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r2, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r1, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000025e000)=ANY=[@ANYBLOB="e92b0000", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000c40)={r4}, &(0x7f0000000d00)=0x8) 13:07:41 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000140)={0x0, 0x8, 0x4, @tid=r0}, &(0x7f0000000400)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x1}, {0x0, 0x1c9c380}}, 0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000ff8)={0xfffffffffffffdb1}, 0x8, 0x0) read(r1, &(0x7f0000000080)=""/128, 0x2c0537e) timer_delete(0x0) 13:07:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x31, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f00000089c0)={0x0, 0x0, 0x0}, 0x0) connect$inet(r0, &(0x7f0000000400)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 13:07:42 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_int(r0, 0x101, 0x4, &(0x7f0000000000), 0x4) 13:07:42 executing program 4: r0 = socket$inet(0x2, 0x4000000805, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = dup3(r0, r1, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r2, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r1, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000025e000)=ANY=[@ANYBLOB="e92b0000", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000c40)={r4}, &(0x7f0000000d00)=0x8) 13:07:42 executing program 5: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x800000000008031, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x3) move_pages(0x0, 0x2, &(0x7f0000000140)=[&(0x7f0000ffd000/0x1000)=nil], &(0x7f0000000080), &(0x7f0000000000), 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 13:07:42 executing program 0: mkdir(0x0, 0x0) truncate(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000300)={0xa, 0x8000002}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000540)='dctcp\x00', 0x6) sendto$inet6(r0, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='bbr\x00', 0x4) sendto$packet(r0, &(0x7f0000000340), 0xfffffffffffffd72, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) link(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='./file0\x00') 13:07:42 executing program 1: perf_event_open$cgroup(&(0x7f0000000000)={0x0, 0xffffffffffffffec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40043, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x3}, 0xfffffeb7) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890b, &(0x7f0000000000)) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x890c, &(0x7f0000000000)) 13:07:42 executing program 4: r0 = socket$inet(0x2, 0x4000000805, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = dup3(r0, r1, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r2, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r1, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000025e000)=ANY=[@ANYBLOB="e92b0000", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000c40)={r4}, &(0x7f0000000d00)=0x8) 13:07:42 executing program 4: msgget$private(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000100)={0x19980330}, &(0x7f00000001c0)) r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000040)={0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x2, 'lblcr\x00', 0x1, 0x0, 0x17}, 0x2c) r1 = io_uring_setup(0xa4, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000280)=[r0, r0], 0x2) io_uring_register$IORING_UNREGISTER_FILES(r1, 0x3, 0x0, 0x0) 13:07:42 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc(0x0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(0x0, &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [], {}, [{}, {}, {}, {}]}, 0x44, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) 13:07:42 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, "1c69ab0d058b1b678397214eec9ff0d0cc8773ebb2cfd89b0252317a845d3df759d280ad530ff887d31ed8f9bf42b889fadb99a5defc79bd6b2023939c49224f", "e9af2deca424f1d69c3cef2acc10d15cae4da1bf9b1c974dd2de2185a2ae81bbcb58ebaa0b202596b0b84f59798e42bca13b7dd7218fcb5e75d1d7299ff17955", "804c0e6791e9da90dce632e1e4efa40c25402952a8dd77a5bf0805cfc3425350"}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r0, 0x4c01) 13:07:42 executing program 0: sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="240000001a0007041dfffd946f6105000a7400001f0000000000080008001b00ffffffff", 0x25f}], 0x1}, 0x0) r0 = socket(0x10, 0x800000000080002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x52b, 0x0) 13:07:42 executing program 3: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000000e0623010090205af6a28118b3001b00"], 0x14}}, 0x0) r0 = socket(0x10, 0x80002, 0xc) sendmmsg$alg(r0, &(0x7f0000000140), 0x492492492492805, 0x0) [ 188.404491][ T9545] netlink: 'syz-executor.0': attribute type 27 has an invalid length. 13:07:42 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x171, 0xea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000040)) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000600)={0xffffffffffffffff}, 0x13f}}, 0x20) r2 = dup2(r0, r0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000600)={0xffffffffffffffff}, 0x13f}}, 0x20) r5 = dup2(r3, r3) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r4}}, 0x48) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) [ 188.467311][ T9552] capability: warning: `syz-executor.4' uses 32-bit capabilities (legacy support in use) [ 188.595262][ T9555] blk_update_request: I/O error, dev loop0, sector 768 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 0 [ 188.610218][ T9565] netlink: 'syz-executor.0': attribute type 27 has an invalid length. 13:07:43 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x171, 0xea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x541a, &(0x7f0000000040)) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000600)={0xffffffffffffffff}, 0x13f}}, 0x20) r2 = dup2(r0, r0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000600)={0xffffffffffffffff}, 0x13f}}, 0x20) r5 = dup2(r3, r3) write$RDMA_USER_CM_CMD_RESOLVE_IP(r5, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r4}}, 0x48) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) [ 188.757397][ T9546] ================================================================== [ 188.765704][ T9546] BUG: KASAN: null-ptr-deref in io_wq_cancel_all+0x28/0x2a0 [ 188.772991][ T9546] Write of size 8 at addr 0000000000000004 by task syz-executor.4/9546 [ 188.781231][ T9546] [ 188.783568][ T9546] CPU: 1 PID: 9546 Comm: syz-executor.4 Not tainted 5.4.0-rc5-next-20191029 #0 [ 188.792499][ T9546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 188.802557][ T9546] Call Trace: [ 188.805852][ T9546] dump_stack+0x172/0x1f0 [ 188.810289][ T9546] ? io_wq_cancel_all+0x28/0x2a0 [ 188.815224][ T9546] ? io_wq_cancel_all+0x28/0x2a0 [ 188.820163][ T9546] __kasan_report.cold+0x5/0x41 [ 188.825010][ T9546] ? io_wq_cancel_all+0x28/0x2a0 [ 188.829955][ T9546] kasan_report+0x12/0x20 [ 188.834304][ T9546] check_memory_region+0x134/0x1a0 [ 188.839430][ T9546] __kasan_check_write+0x14/0x20 [ 188.844372][ T9546] io_wq_cancel_all+0x28/0x2a0 [ 188.849156][ T9546] io_uring_flush+0x35a/0x4e0 [ 188.853840][ T9546] ? exit_sem+0x9a4/0x1d89 [ 188.858269][ T9546] ? io_wake_function+0x260/0x260 [ 188.863299][ T9546] ? exit_files+0x7b/0xb0 [ 188.867632][ T9546] ? finish_wait+0x260/0x260 [ 188.872216][ T9546] ? exit_files+0x7b/0xb0 [ 188.876546][ T9546] ? io_wake_function+0x260/0x260 [ 188.881568][ T9546] filp_close+0xbd/0x170 [ 188.885801][ T9546] put_files_struct+0x1d7/0x2f0 [ 188.890670][ T9546] exit_files+0x83/0xb0 [ 188.894816][ T9546] do_exit+0x8d2/0x2e60 [ 188.898978][ T9546] ? mm_update_next_owner+0x640/0x640 [ 188.904344][ T9546] ? lock_downgrade+0x920/0x920 [ 188.909187][ T9546] ? _raw_spin_unlock_irq+0x23/0x80 [ 188.914738][ T9546] ? get_signal+0x392/0x24f0 [ 188.919329][ T9546] ? _raw_spin_unlock_irq+0x23/0x80 [ 188.924537][ T9546] do_group_exit+0x135/0x360 [ 188.929124][ T9546] get_signal+0x47c/0x24f0 [ 188.933540][ T9546] ? lock_downgrade+0x920/0x920 [ 188.938407][ T9546] do_signal+0x87/0x1700 [ 188.942644][ T9546] ? __kasan_check_read+0x11/0x20 [ 188.953557][ T9546] ? _copy_to_user+0x118/0x160 [ 188.958310][ T9546] ? setup_sigcontext+0x7d0/0x7d0 [ 188.963334][ T9546] ? exit_to_usermode_loop+0x43/0x380 [ 188.968689][ T9546] ? do_syscall_64+0x65f/0x760 [ 188.973439][ T9546] ? exit_to_usermode_loop+0x43/0x380 [ 188.978885][ T9546] ? lockdep_hardirqs_on+0x421/0x5e0 [ 188.984157][ T9546] ? trace_hardirqs_on+0x67/0x240 [ 188.989172][ T9546] exit_to_usermode_loop+0x286/0x380 [ 188.994449][ T9546] do_syscall_64+0x65f/0x760 [ 188.999029][ T9546] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 189.004906][ T9546] RIP: 0033:0x459f49 [ 189.008789][ T9546] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 189.028464][ T9546] RSP: 002b:00007fc905c40cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 189.036862][ T9546] RAX: 0000000000000000 RBX: 000000000075bf28 RCX: 0000000000459f49 [ 189.044819][ T9546] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bf28 13:07:43 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, "1c69ab0d058b1b678397214eec9ff0d0cc8773ebb2cfd89b0252317a845d3df759d280ad530ff887d31ed8f9bf42b889fadb99a5defc79bd6b2023939c49224f", "e9af2deca424f1d69c3cef2acc10d15cae4da1bf9b1c974dd2de2185a2ae81bbcb58ebaa0b202596b0b84f59798e42bca13b7dd7218fcb5e75d1d7299ff17955", "804c0e6791e9da90dce632e1e4efa40c25402952a8dd77a5bf0805cfc3425350"}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r0, r0, 0x0, 0x24000000) ioctl$LOOP_CLR_FD(r0, 0x4c01) [ 189.052788][ T9546] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 189.060743][ T9546] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bf2c [ 189.068716][ T9546] R13: 00007ffd3b9a0b4f R14: 00007fc905c419c0 R15: 000000000075bf2c [ 189.076688][ T9546] ================================================================== [ 189.084729][ T9546] Disabling lock debugging due to kernel taint [ 189.164184][ T9546] Kernel panic - not syncing: panic_on_warn set ... [ 189.170819][ T9546] CPU: 1 PID: 9546 Comm: syz-executor.4 Tainted: G B 5.4.0-rc5-next-20191029 #0 [ 189.181134][ T9546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 189.191186][ T9546] Call Trace: [ 189.194480][ T9546] dump_stack+0x172/0x1f0 [ 189.198818][ T9546] panic+0x2e3/0x75c [ 189.202717][ T9546] ? add_taint.cold+0x16/0x16 [ 189.207395][ T9546] ? io_wq_cancel_all+0x28/0x2a0 [ 189.212330][ T9546] ? preempt_schedule+0x4b/0x60 [ 189.217181][ T9546] ? ___preempt_schedule+0x16/0x18 [ 189.222289][ T9546] ? trace_hardirqs_on+0x5e/0x240 [ 189.227317][ T9546] ? io_wq_cancel_all+0x28/0x2a0 [ 189.232257][ T9546] end_report+0x47/0x4f [ 189.236408][ T9546] ? io_wq_cancel_all+0x28/0x2a0 [ 189.241349][ T9546] __kasan_report.cold+0xe/0x41 [ 189.246200][ T9546] ? io_wq_cancel_all+0x28/0x2a0 [ 189.251141][ T9546] kasan_report+0x12/0x20 [ 189.255470][ T9546] check_memory_region+0x134/0x1a0 [ 189.260590][ T9546] __kasan_check_write+0x14/0x20 [ 189.265556][ T9546] io_wq_cancel_all+0x28/0x2a0 [ 189.270325][ T9546] io_uring_flush+0x35a/0x4e0 [ 189.275000][ T9546] ? exit_sem+0x9a4/0x1d89 [ 189.279423][ T9546] ? io_wake_function+0x260/0x260 [ 189.284464][ T9546] ? exit_files+0x7b/0xb0 [ 189.288796][ T9546] ? finish_wait+0x260/0x260 [ 189.293385][ T9546] ? exit_files+0x7b/0xb0 [ 189.297721][ T9546] ? io_wake_function+0x260/0x260 [ 189.302747][ T9546] filp_close+0xbd/0x170 [ 189.306991][ T9546] put_files_struct+0x1d7/0x2f0 [ 189.311847][ T9546] exit_files+0x83/0xb0 [ 189.316002][ T9546] do_exit+0x8d2/0x2e60 [ 189.320170][ T9546] ? mm_update_next_owner+0x640/0x640 [ 189.325548][ T9546] ? lock_downgrade+0x920/0x920 [ 189.330402][ T9546] ? _raw_spin_unlock_irq+0x23/0x80 [ 189.335596][ T9546] ? get_signal+0x392/0x24f0 [ 189.340172][ T9546] ? _raw_spin_unlock_irq+0x23/0x80 [ 189.345356][ T9546] do_group_exit+0x135/0x360 [ 189.349929][ T9546] get_signal+0x47c/0x24f0 [ 189.354330][ T9546] ? lock_downgrade+0x920/0x920 [ 189.359172][ T9546] do_signal+0x87/0x1700 [ 189.363401][ T9546] ? __kasan_check_read+0x11/0x20 [ 189.368410][ T9546] ? _copy_to_user+0x118/0x160 [ 189.373160][ T9546] ? setup_sigcontext+0x7d0/0x7d0 [ 189.378176][ T9546] ? exit_to_usermode_loop+0x43/0x380 [ 189.383533][ T9546] ? do_syscall_64+0x65f/0x760 [ 189.388279][ T9546] ? exit_to_usermode_loop+0x43/0x380 [ 189.393636][ T9546] ? lockdep_hardirqs_on+0x421/0x5e0 [ 189.398904][ T9546] ? trace_hardirqs_on+0x67/0x240 [ 189.403924][ T9546] exit_to_usermode_loop+0x286/0x380 [ 189.409195][ T9546] do_syscall_64+0x65f/0x760 [ 189.413772][ T9546] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 189.419650][ T9546] RIP: 0033:0x459f49 [ 189.423528][ T9546] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 189.443113][ T9546] RSP: 002b:00007fc905c40cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 189.451509][ T9546] RAX: 0000000000000000 RBX: 000000000075bf28 RCX: 0000000000459f49 [ 189.459550][ T9546] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bf28 [ 189.467509][ T9546] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 189.475464][ T9546] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bf2c [ 189.483418][ T9546] R13: 00007ffd3b9a0b4f R14: 00007fc905c419c0 R15: 000000000075bf2c [ 189.492822][ T9546] Kernel Offset: disabled [ 189.497164][ T9546] Rebooting in 86400 seconds..