kern.securelevel: 0 -> 1 creating runtime link editor directory cache. preserving editor files. starting network daemons: sshd. starting local daemons:. Wed Jan 23 23:07:52 PST 2019 OpenBSD/amd64 (ci-openbsd-setuid-1.c.syzkaller.internal) (tty00) Warning: Permanently added '10.128.0.3' (ECDSA) to the list of known hosts. 2019/01/23 23:08:17 fuzzer started 2019/01/23 23:08:22 dialing manager at 10.128.15.235:45991 2019/01/23 23:08:22 syscalls: 1 2019/01/23 23:08:22 code coverage: enabled 2019/01/23 23:08:22 comparison tracing: enabled 2019/01/23 23:08:22 extra coverage: support is not implemented in syzkaller 2019/01/23 23:08:22 setuid sandbox: enabled 2019/01/23 23:08:22 namespace sandbox: support is not implemented in syzkaller 2019/01/23 23:08:22 Android sandbox: support is not implemented in syzkaller 2019/01/23 23:08:22 fault injection: support is not implemented in syzkaller 2019/01/23 23:08:22 leak checking: support is not implemented in syzkaller 2019/01/23 23:08:22 net packet injection: enabled 2019/01/23 23:08:22 net device setup: support is not implemented in syzkaller 23:08:23 executing program 0: munmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000) minherit(&(0x7f0000fec000/0x14000)=nil, 0x14000, 0x0) madvise(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) 23:08:23 executing program 1: r0 = kqueue() r1 = fcntl$dupfd(r0, 0x1, 0xffffffffffffffff) fchmod(r1, 0x0) 23:08:24 executing program 0: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) write(r0, &(0x7f0000000180)='X', 0x1) close(r0) syz_open_pts() r1 = syz_open_pts() ioctl$TIOCSETAW(r1, 0x802c7415, &(0x7f0000000000)={0x0, 0x0, 0xffffffffffffcf26, 0x0, "172d768989ca984c8831ca15004a546eb3dd1b1b"}) ioctl$TIOCSETAF(r1, 0x802c7416, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, "058832a528295affd1c8add1ad044097f4d25e92"}) syz_open_pts() 23:08:24 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x100000000000000b, &(0x7f0000000040)='\x00', 0x1) setsockopt(r0, 0x0, 0xd, &(0x7f0000000080), 0x0) 23:08:24 executing program 1: r0 = socket$inet6(0x18, 0x8001, 0x0) listen(r0, 0x0) shutdown(r0, 0x0) accept$inet6(r0, 0x0, 0x0) 23:08:24 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) setsockopt$sock_int(r0, 0xffff, 0x10, 0x0, 0x0) 23:08:24 executing program 1: ioctl$TIOCSETAF(0xffffffffffffffff, 0x802c7416, &(0x7f0000000140)={0x0, 0x8, 0x0, 0x0, "d70000020000000000ffffff7f00"}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x29, 0xd, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) 23:08:24 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) setsockopt$sock_int(r0, 0xffff, 0x10, 0x0, 0x0) 23:08:24 executing program 1: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) write(r0, &(0x7f0000000180)="582720efabd16ebae63225259560f8e5815f73f2a044fd33055552fbd5e41789632dfc94ff334a5619515a4c8ab06198824b3da025bbd47b3bf579456fc7d4096e8c8b6b87cb2d72b8bcdb9ad8a4f5f728193ef16ab93f12fc4d5f16b136a5d00d1628b53a", 0x65) write(r0, &(0x7f00000002c0)="9085", 0x2) r1 = syz_open_pts() close(r0) dup(r1) r2 = syz_open_pts() fcntl$setstatus(r2, 0x4, 0x40) ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f0000000040)={0x0, 0x0, 0x9, 0xffffffffffffbffe, "854955882e0261ce4e66378e5dea9c11fe4dbfa6"}) poll(&(0x7f0000000200)=[{r2, 0x4c}], 0x1, 0x0) 23:08:24 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) setsockopt$sock_int(r0, 0xffff, 0x10, 0x0, 0x0) 23:08:24 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) setsockopt$sock_int(r0, 0xffff, 0x10, 0x0, 0x0) 23:08:24 executing program 1: r0 = socket$inet6(0x18, 0x2, 0x0) getsockopt$sock_int(r0, 0xffff, 0x40, 0x0, 0x0) 23:08:24 executing program 1: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) write(r0, &(0x7f00000000c0)="582720efabd16ebae63225259560f8e5815f73f2a044fd33055552fbd5e41789632dfc94ff334a5619515a4c8ab06198824b3da025bbd47b3bf579456fc7d4096e8c8b6b87cb2d72b8bcdb9ad8a4f5f728193ef16ab93f12fc4d5f16b136a5d00d1628b53a", 0x65) write(r0, &(0x7f0000000240)="3e2a7913e4bad21c734f4dd36a27e5e27b216d673553c0c01b3dfaf90f001e4b2ae5eefeaff0f2c85e2831c61ad4491d1f7828bc2d2a500a35", 0x39) r1 = syz_open_pts() close(r0) dup(r1) r2 = syz_open_pts() ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f0000000000)={0xffffbffffffffffc, 0x0, 0xfffffffffffffffe, 0xffffffffffffff7f, "90d2fdaa510000000000000bffea9c11fe4dbfa6"}) readv(r2, &(0x7f0000000140)=[{&(0x7f0000000200)=""/45, 0x2d}], 0x1) 23:08:24 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) unveil(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='c\x00') open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) 23:08:24 executing program 0: r0 = socket$inet6(0x18, 0x2, 0x0) setsockopt$sock_int(r0, 0xffff, 0x100, 0x0, 0x0) 23:08:24 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_opts(r0, 0x0, 0x200000000000004, &(0x7f0000739ff1)=""/15, &(0x7f0000000000)=0xf) 23:08:24 executing program 0: r0 = open(&(0x7f0000000040)='./file0\x00', 0x611, 0x0) pwritev(r0, &(0x7f00000003c0), 0x273, 0x0) 23:08:24 executing program 1: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) write(r0, &(0x7f0000000180)="582720efabd16ebae63225259560f8e5815f73f2a044fd33055552fbd5e41789632dfc94ff334a5619515a4c8ab06198824b3da025bbd47b3bf579456fc7d4096e8c8b6b87cb2d72b8bcdb9ad8a4f5f728193ef16ab93f12fc4d5f16b136a5d00d1628b53a", 0x65) writev(r0, &(0x7f0000001700)=[{&(0x7f0000001680)="a3c31bb88f83ce1d484c7bba13b18cbfbb8641cd4a7f36b7331ee50bb61cd720b1e3b679526dc633e59658b5d22e045ff59d950dd3ceba7f6c5d865ca6", 0x3d}], 0x1) r1 = syz_open_pts() close(r0) dup(r1) r2 = syz_open_pts() ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f0000000140)={0xffffffffffffff74, 0x0, 0x1, 0xffffffffffffff7d, "85fe68bfa60204000007ad00cb5fffffffffff7d"}) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/45, 0x2d}], 0x1) 23:08:24 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000040)='h', 0x1) recvmsg(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/96, 0x60}, {&(0x7f0000000a40)=""/4096, 0xfffffd4f}], 0x2, 0x0}, 0x40) shutdown(r1, 0x0) read(r1, 0x0, 0x3b) execve(0x0, 0x0, 0x0) getsockopt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 23:08:24 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000040)='h', 0x1) recvmsg(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/96, 0x60}, {&(0x7f0000000a40)=""/4096, 0xfffffd4f}], 0x2, 0x0}, 0x40) shutdown(r1, 0x0) read(r1, 0x0, 0x3b) execve(0x0, 0x0, 0x0) getsockopt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 23:08:24 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000040)='h', 0x1) recvmsg(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/96, 0x60}, {&(0x7f0000000a40)=""/4096, 0xfffffd4f}], 0x2, 0x0}, 0x40) shutdown(r1, 0x0) read(r1, 0x0, 0x3b) execve(0x0, 0x0, 0x0) getsockopt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 23:08:25 executing program 1: r0 = shmget$private(0x0, 0x2000, 0x110, &(0x7f0000ffe000/0x2000)=nil) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000700)=""/223) 23:08:25 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000040)='h', 0x1) recvmsg(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/96, 0x60}, {&(0x7f0000000a40)=""/4096, 0xfffffd4f}], 0x2, 0x0}, 0x40) shutdown(r1, 0x0) read(r1, 0x0, 0x3b) execve(0x0, 0x0, 0x0) getsockopt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 23:08:25 executing program 1: r0 = syz_open_pts() syz_open_pts() syz_open_pts() fcntl$getown(r0, 0x5) 23:08:25 executing program 0: r0 = dup(0xffffffffffffff9c) ioctl$TIOCGFLAGS(r0, 0x4004745d, &(0x7f0000000000)) ioctl$TIOCDRAIN(r0, 0x2000745e) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x10004) getsockopt$sock_linger(r1, 0xffff, 0x80, &(0x7f0000000080), &(0x7f00000000c0)=0x8) pledge(&(0x7f0000000100)='\xb0\x00', &(0x7f0000000140)=',\x00') ioctl$TIOCDRAIN(r0, 0x2000745e) ioctl$TIOCMBIS(r2, 0x8004746c, &(0x7f0000000180)) shutdown(r2, 0x0) ioctl$TIOCEXCL(r2, 0x2000740d) ioctl$TIOCSWINSZ(r2, 0x80087467, &(0x7f00000001c0)={0xfffffffffffffffb, 0x6, 0x10000, 0xb88}) ioctl$TIOCMBIS(r2, 0x8004746c, &(0x7f0000000200)=0x9) ioctl$TIOCCHKVERAUTH(r2, 0x2000741e) ioctl$TIOCSPGRP(r2, 0x40047477, &(0x7f0000000240)) ioctl$TIOCGWINSZ(r2, 0x40087468, &(0x7f0000000280)) sendto(r0, &(0x7f00000002c0)="387a97c8d11b3b67bb8eee9a896860", 0xf, 0x0, 0x0, 0x0) r3 = open(&(0x7f0000000340)='./file0\x00', 0x200, 0x2) ioctl$TIOCSFLAGS(r2, 0x8004745c, &(0x7f0000000380)=0xa955) ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f00000003c0)={0x10001, 0x2, 0x8, 0x5, "f293a12ada23ff76bf4a11b246b762b7d61d68cf", 0x93, 0x20}) r4 = semget$private(0x0, 0x3, 0x100) semctl$GETNCNT(r4, 0x7, 0x3, &(0x7f0000000400)=""/161) ioctl$TIOCSFLAGS(r3, 0x8004745c, &(0x7f00000004c0)=0x9f) poll(&(0x7f0000000500)=[{r3}, {r0, 0x20}, {r2, 0x4}, {r2, 0x4}, {r1, 0x60}, {r3}, {r1, 0x4}, {r2}, {r1, 0x8}, {r1, 0x10}], 0xa, 0x80000000) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000580)="70babd7367b97a133b43816db96684c6ddc1f1d6d8f45e7935a9f4e6e6ff70493cf0e6c8a0e79d50362aa68839a05a62ade22034286b6d1ded54a265fa98129c095c378b36a1158132a053f99ca926d8beeb7572dc6df35a90b11265466f2a8a589d583038099e23f3551a", 0x6b}], 0x1) ioctl$TIOCSFLAGS(r1, 0x8004745c, &(0x7f0000000640)=0x6e06) 23:08:25 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000f72000)="94040013", 0x4) 23:08:25 executing program 0: r0 = dup(0xffffffffffffff9c) ioctl$TIOCGFLAGS(r0, 0x4004745d, &(0x7f0000000000)) ioctl$TIOCDRAIN(r0, 0x2000745e) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x10004) getsockopt$sock_linger(r1, 0xffff, 0x80, &(0x7f0000000080), &(0x7f00000000c0)=0x8) pledge(&(0x7f0000000100)='\xb0\x00', &(0x7f0000000140)=',\x00') ioctl$TIOCDRAIN(r0, 0x2000745e) ioctl$TIOCMBIS(r2, 0x8004746c, &(0x7f0000000180)) shutdown(r2, 0x0) ioctl$TIOCEXCL(r2, 0x2000740d) ioctl$TIOCSWINSZ(r2, 0x80087467, &(0x7f00000001c0)={0xfffffffffffffffb, 0x6, 0x10000, 0xb88}) ioctl$TIOCMBIS(r2, 0x8004746c, &(0x7f0000000200)=0x9) ioctl$TIOCCHKVERAUTH(r2, 0x2000741e) ioctl$TIOCSPGRP(r2, 0x40047477, &(0x7f0000000240)) ioctl$TIOCGWINSZ(r2, 0x40087468, &(0x7f0000000280)) sendto(r0, &(0x7f00000002c0)="387a97c8d11b3b67bb8eee9a896860", 0xf, 0x0, 0x0, 0x0) r3 = open(&(0x7f0000000340)='./file0\x00', 0x200, 0x2) ioctl$TIOCSFLAGS(r2, 0x8004745c, &(0x7f0000000380)=0xa955) ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f00000003c0)={0x10001, 0x2, 0x8, 0x5, "f293a12ada23ff76bf4a11b246b762b7d61d68cf", 0x93, 0x20}) r4 = semget$private(0x0, 0x3, 0x100) semctl$GETNCNT(r4, 0x7, 0x3, &(0x7f0000000400)=""/161) ioctl$TIOCSFLAGS(r3, 0x8004745c, &(0x7f00000004c0)=0x9f) poll(&(0x7f0000000500)=[{r3}, {r0, 0x20}, {r2, 0x4}, {r2, 0x4}, {r1, 0x60}, {r3}, {r1, 0x4}, {r2}, {r1, 0x8}, {r1, 0x10}], 0xa, 0x80000000) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000580)="70babd7367b97a133b43816db96684c6ddc1f1d6d8f45e7935a9f4e6e6ff70493cf0e6c8a0e79d50362aa68839a05a62ade22034286b6d1ded54a265fa98129c095c378b36a1158132a053f99ca926d8beeb7572dc6df35a90b11265466f2a8a589d583038099e23f3551a", 0x6b}], 0x1) ioctl$TIOCSFLAGS(r1, 0x8004745c, &(0x7f0000000640)=0x6e06) 23:08:25 executing program 1: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="3007c0c093ed11c1062c6b76328f9735873a402ba4ee0c7a947f442d447e8135b97f8b5ff86018a1194f090e87354fcabe756b79cf30f0ac033cca0aa1b40293c3807ad44144aff983a7b111f0a748614999abccdb3189cfb38f83ff90c2452c60af2b51ad", 0x65}], 0x1) write(r0, &(0x7f0000000200), 0xfe72) sendmsg(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f00000003c0)="2b81bc1c58c8860cff73b19b8d28c97eeb0f2c45bd61fcbde6b016b70f1ea7268faf9500a24fd23916d2a8c108b75e0e0b2eccafa3cfa72f4b44958da7ce780d7301bdf6d0e67f3530e28e1292cff531f79a9171640f4de9f75806fd89874bbc63262af0d0ef7354cd82a7352bcb71f7000eaf074e8472df7a8604c11f53c2306befcff88bce7197b4ed775f6d53547b34aa6aed26579b34509cbc95a3906819fb0cb60115ad69b4b3d1142a9049a4d29b336516931d822d8b2549e7b39c13e30adb1338b909bb5d429f4c693f532f06a5eacdc4c8ba54c3730c6172ad0f7a1cc5c7712107f7de63b8ae0bcd91bce6153d17de48b02f3adc9ebe912f99fe4eb35ab2210b17d9276358fc21bd28e457d62d0486972488631658565f35910780c8de757f57b1537c57fc31490d7d52b959d90e19f5a1fc28dba24294930f638f195b67bc64c8760518dad7caa0f42b25c3df8c877e8cbf8c3f172ba970f9273298844087d9e605b07d184ae285000db163d77cbd217183c000ed6aec386ec9eb9301b434f08e4b7cf04afd68bb722f27351b61443e152e783f7a603e8384990c95c1e176ff44fc7cbd630c0cec01e6a3d26bbd5cd7da71cb92d83e996992b8bd4d754835db0bdc6282a4aa516d6d19582e642bfec22546543c7bc71e1e814471c2ce7ece751ce40c331a55042e9098513ec4304a3ecea3bb819f2947e3ce11dcef9fb1fa53198d95615e2de6bbbdc40d47b6fd9275e6c6fc01d455c11712379e1cb09097234b50760444e0d50693704fd250abd1ed9cd816c2445240b6a5c7c1b88448647005f880e1b66ca3b751bcf600abda2c37125906d977de4545ac90a951449ca8e04612cc8bb2c9c63699c3a61ea7b185453ae2c3962d2e01f2a3a73340126d7c5f7144bcd7d2962cf5efccd8f7c1ce64d7bf367ac734e08a1089eb3d9a37d95815249563a9210873d15379cb032f5252db0f92e67315690a95734da207f896ad2dc74ec599147f73c53404b0bd5c255083607ebbdd09a96c70c13049c41d33248a9096de0829f3268b71d5bfa56d386cf4cdb8185dd0d7eaa8bef8b24d4b7a325fec38576e52b454d82c73e3772304c78d709cbb2086a7149957d0a81823c9364b7ea1233fa021be006b423e43067d545fde9f13e911a55283160d8d15", 0x340}], 0x1}, 0x0) r1 = syz_open_pts() close(r0) dup(r1) syz_open_pts() ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) 23:08:25 executing program 0: r0 = dup(0xffffffffffffff9c) ioctl$TIOCGFLAGS(r0, 0x4004745d, &(0x7f0000000000)) ioctl$TIOCDRAIN(r0, 0x2000745e) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x10004) getsockopt$sock_linger(r1, 0xffff, 0x80, &(0x7f0000000080), &(0x7f00000000c0)=0x8) pledge(&(0x7f0000000100)='\xb0\x00', &(0x7f0000000140)=',\x00') ioctl$TIOCDRAIN(r0, 0x2000745e) ioctl$TIOCMBIS(r2, 0x8004746c, &(0x7f0000000180)) shutdown(r2, 0x0) ioctl$TIOCEXCL(r2, 0x2000740d) ioctl$TIOCSWINSZ(r2, 0x80087467, &(0x7f00000001c0)={0xfffffffffffffffb, 0x6, 0x10000, 0xb88}) ioctl$TIOCMBIS(r2, 0x8004746c, &(0x7f0000000200)=0x9) ioctl$TIOCCHKVERAUTH(r2, 0x2000741e) ioctl$TIOCSPGRP(r2, 0x40047477, &(0x7f0000000240)) ioctl$TIOCGWINSZ(r2, 0x40087468, &(0x7f0000000280)) sendto(r0, &(0x7f00000002c0)="387a97c8d11b3b67bb8eee9a896860", 0xf, 0x0, 0x0, 0x0) r3 = open(&(0x7f0000000340)='./file0\x00', 0x200, 0x2) ioctl$TIOCSFLAGS(r2, 0x8004745c, &(0x7f0000000380)=0xa955) ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f00000003c0)={0x10001, 0x2, 0x8, 0x5, "f293a12ada23ff76bf4a11b246b762b7d61d68cf", 0x93, 0x20}) r4 = semget$private(0x0, 0x3, 0x100) semctl$GETNCNT(r4, 0x7, 0x3, &(0x7f0000000400)=""/161) ioctl$TIOCSFLAGS(r3, 0x8004745c, &(0x7f00000004c0)=0x9f) poll(&(0x7f0000000500)=[{r3}, {r0, 0x20}, {r2, 0x4}, {r2, 0x4}, {r1, 0x60}, {r3}, {r1, 0x4}, {r2}, {r1, 0x8}, {r1, 0x10}], 0xa, 0x80000000) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000580)="70babd7367b97a133b43816db96684c6ddc1f1d6d8f45e7935a9f4e6e6ff70493cf0e6c8a0e79d50362aa68839a05a62ade22034286b6d1ded54a265fa98129c095c378b36a1158132a053f99ca926d8beeb7572dc6df35a90b11265466f2a8a589d583038099e23f3551a", 0x6b}], 0x1) ioctl$TIOCSFLAGS(r1, 0x8004745c, &(0x7f0000000640)=0x6e06) 23:08:25 executing program 0: r0 = dup(0xffffffffffffff9c) ioctl$TIOCGFLAGS(r0, 0x4004745d, &(0x7f0000000000)) ioctl$TIOCDRAIN(r0, 0x2000745e) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x10004) getsockopt$sock_linger(r1, 0xffff, 0x80, &(0x7f0000000080), &(0x7f00000000c0)=0x8) pledge(&(0x7f0000000100)='\xb0\x00', &(0x7f0000000140)=',\x00') ioctl$TIOCDRAIN(r0, 0x2000745e) ioctl$TIOCMBIS(r2, 0x8004746c, &(0x7f0000000180)) shutdown(r2, 0x0) ioctl$TIOCEXCL(r2, 0x2000740d) ioctl$TIOCSWINSZ(r2, 0x80087467, &(0x7f00000001c0)={0xfffffffffffffffb, 0x6, 0x10000, 0xb88}) ioctl$TIOCMBIS(r2, 0x8004746c, &(0x7f0000000200)=0x9) ioctl$TIOCCHKVERAUTH(r2, 0x2000741e) ioctl$TIOCSPGRP(r2, 0x40047477, &(0x7f0000000240)) ioctl$TIOCGWINSZ(r2, 0x40087468, &(0x7f0000000280)) sendto(r0, &(0x7f00000002c0)="387a97c8d11b3b67bb8eee9a896860", 0xf, 0x0, 0x0, 0x0) r3 = open(&(0x7f0000000340)='./file0\x00', 0x200, 0x2) ioctl$TIOCSFLAGS(r2, 0x8004745c, &(0x7f0000000380)=0xa955) ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f00000003c0)={0x10001, 0x2, 0x8, 0x5, "f293a12ada23ff76bf4a11b246b762b7d61d68cf", 0x93, 0x20}) r4 = semget$private(0x0, 0x3, 0x100) semctl$GETNCNT(r4, 0x7, 0x3, &(0x7f0000000400)=""/161) ioctl$TIOCSFLAGS(r3, 0x8004745c, &(0x7f00000004c0)=0x9f) poll(&(0x7f0000000500)=[{r3}, {r0, 0x20}, {r2, 0x4}, {r2, 0x4}, {r1, 0x60}, {r3}, {r1, 0x4}, {r2}, {r1, 0x8}, {r1, 0x10}], 0xa, 0x80000000) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000580)="70babd7367b97a133b43816db96684c6ddc1f1d6d8f45e7935a9f4e6e6ff70493cf0e6c8a0e79d50362aa68839a05a62ade22034286b6d1ded54a265fa98129c095c378b36a1158132a053f99ca926d8beeb7572dc6df35a90b11265466f2a8a589d583038099e23f3551a", 0x6b}], 0x1) ioctl$TIOCSFLAGS(r1, 0x8004745c, &(0x7f0000000640)=0x6e06) 23:08:25 executing program 0: ioctl$TIOCSETAF(0xffffffffffffffff, 0x802c7416, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0, 0x0, "010000000000000000ffffff7f00"}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x29, 0xc, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) setsockopt(r0, 0x29, 0xc, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) 23:08:25 executing program 1: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="3007c0c093ed11c1062c6b76328f9735873a402ba4ee0c7a947f442d447e8135b97f8b5ff86018a1194f090e87354fcabe756b79cf30f0ac033cca0aa1b40293c3807ad44144aff983a7b111f0a748614999abccdb3189cfb38f83ff90c2452c60af2b51ad", 0x65}], 0x1) write(r0, &(0x7f0000000200), 0xfe72) sendmsg(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f00000003c0)="2b81bc1c58c8860cff73b19b8d28c97eeb0f2c45bd61fcbde6b016b70f1ea7268faf9500a24fd23916d2a8c108b75e0e0b2eccafa3cfa72f4b44958da7ce780d7301bdf6d0e67f3530e28e1292cff531f79a9171640f4de9f75806fd89874bbc63262af0d0ef7354cd82a7352bcb71f7000eaf074e8472df7a8604c11f53c2306befcff88bce7197b4ed775f6d53547b34aa6aed26579b34509cbc95a3906819fb0cb60115ad69b4b3d1142a9049a4d29b336516931d822d8b2549e7b39c13e30adb1338b909bb5d429f4c693f532f06a5eacdc4c8ba54c3730c6172ad0f7a1cc5c7712107f7de63b8ae0bcd91bce6153d17de48b02f3adc9ebe912f99fe4eb35ab2210b17d9276358fc21bd28e457d62d0486972488631658565f35910780c8de757f57b1537c57fc31490d7d52b959d90e19f5a1fc28dba24294930f638f195b67bc64c8760518dad7caa0f42b25c3df8c877e8cbf8c3f172ba970f9273298844087d9e605b07d184ae285000db163d77cbd217183c000ed6aec386ec9eb9301b434f08e4b7cf04afd68bb722f27351b61443e152e783f7a603e8384990c95c1e176ff44fc7cbd630c0cec01e6a3d26bbd5cd7da71cb92d83e996992b8bd4d754835db0bdc6282a4aa516d6d19582e642bfec22546543c7bc71e1e814471c2ce7ece751ce40c331a55042e9098513ec4304a3ecea3bb819f2947e3ce11dcef9fb1fa53198d95615e2de6bbbdc40d47b6fd9275e6c6fc01d455c11712379e1cb09097234b50760444e0d50693704fd250abd1ed9cd816c2445240b6a5c7c1b88448647005f880e1b66ca3b751bcf600abda2c37125906d977de4545ac90a951449ca8e04612cc8bb2c9c63699c3a61ea7b185453ae2c3962d2e01f2a3a73340126d7c5f7144bcd7d2962cf5efccd8f7c1ce64d7bf367ac734e08a1089eb3d9a37d95815249563a9210873d15379cb032f5252db0f92e67315690a95734da207f896ad2dc74ec599147f73c53404b0bd5c255083607ebbdd09a96c70c13049c41d33248a9096de0829f3268b71d5bfa56d386cf4cdb8185dd0d7eaa8bef8b24d4b7a325fec38576e52b454d82c73e3772304c78d709cbb2086a7149957d0a81823c9364b7ea1233fa021be006b423e43067d545fde9f13e911a55283160d8d15", 0x340}], 0x1}, 0x0) r1 = syz_open_pts() close(r0) dup(r1) syz_open_pts() ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) 23:08:25 executing program 0: setitimer(0x0, 0x0, &(0x7f0000000040)) 23:08:25 executing program 0: r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) getsockopt(r0, 0x0, 0x8, &(0x7f0000000040)=""/123, &(0x7f00000000c0)=0x7b) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSCTTY(r2, 0x20007461) sendto(r2, &(0x7f0000000380)="293ff03a00b958e6c3d79d824c94610d9fd8975b641a89fb6420a469eabea7c91100cd6efff52f06c753d87e86e2cb3bb97cfd1528b2ea3fb38bcf3b4e650c39617df2dca9a50494e2f2b9311a5c22c6a16680b125a382a0d09408f85ab3eda594b64822e19e63eced96a4023054c34465b603272db8094703ef48a2513de04bb2fa566cf542019a3e7fdbd845211339b16cff993781644471daf19bb0b187a41287d8619a883fdb0344e60c750b6caf1d1b131aba894290e4d183522e7d7ed9cd4ed642ed9824d8f8daa4c93ea3670aa429d5d502f008996f0d2078c90a949964efe2e3d33575653bd581404f1b54", 0xef, 0x1, 0x0, 0x0) fchdir(r0) r3 = getuid() ioctl$TIOCSTOP(r1, 0x2000746f) r4 = getegid() lchown(&(0x7f0000000340)='./file0\x00', r3, r4) r5 = semget$private(0x0, 0x7, 0x480) setsockopt$sock_int(r1, 0xffff, 0x1807, &(0x7f0000000600)=0x80000000, 0xffffffffffffffda) r6 = getuid() munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) setuid(r6) shutdown(r0, 0x1) getsockopt$SO_PEERCRED(r2, 0xffff, 0x1022, &(0x7f0000000640)={0x0, 0x0}, 0xc) fsync(r0) semop(r5, &(0x7f00000001c0)=[{0x4, 0x4, 0x1000}, {0x1, 0x8, 0x1000}], 0x2) open(&(0x7f0000000180)='./file0\x00', 0xa0, 0x4) openat(r2, &(0x7f0000000480)='./file0\x00', 0x800, 0x8) r8 = getgid() fchown(r2, r7, r8) symlink(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00') accept(r2, &(0x7f00000002c0)=@in6, &(0x7f0000000300)=0xc) getsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000200), &(0x7f0000000240)=0x10) sendto(r0, &(0x7f00000004c0)="b88f3305c19220f1b09cc7dfe23a2582c0a36fb21e14d2d092518d52f63d69495a2c6920b295ae187dd85d1eccccbd70a81af4273b58e77991c1ef064c6ff20378fd1e551f7897e1e1f27a0c7dda31ebc5b581c2a647a26efd3a8985488f93711eb5d9ce7571bb2967d347c2acb7cd4b5f87b6eead2f05fec434e3da3943f1f19be7ebaaa22161530884288a9eadbec6af2be634e13fd36bed3cc36b1acd78383c16d2faa26eb7f9ff62", 0xaa, 0x2, 0x0, 0x0) semop(r5, &(0x7f0000000100)=[{0x0, 0x9, 0x800}, {0x6, 0x4}, {0x0, 0x1, 0x800}, {0x3, 0xdd2, 0x1000}], 0x4) fsync(r2) pipe2(0x0, 0xffff) 23:08:25 executing program 0: r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) getsockopt(r0, 0x0, 0x8, &(0x7f0000000040)=""/123, &(0x7f00000000c0)=0x7b) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSCTTY(r2, 0x20007461) sendto(r2, &(0x7f0000000380)="293ff03a00b958e6c3d79d824c94610d9fd8975b641a89fb6420a469eabea7c91100cd6efff52f06c753d87e86e2cb3bb97cfd1528b2ea3fb38bcf3b4e650c39617df2dca9a50494e2f2b9311a5c22c6a16680b125a382a0d09408f85ab3eda594b64822e19e63eced96a4023054c34465b603272db8094703ef48a2513de04bb2fa566cf542019a3e7fdbd845211339b16cff993781644471daf19bb0b187a41287d8619a883fdb0344e60c750b6caf1d1b131aba894290e4d183522e7d7ed9cd4ed642ed9824d8f8daa4c93ea3670aa429d5d502f008996f0d2078c90a949964efe2e3d33575653bd581404f1b54", 0xef, 0x1, 0x0, 0x0) fchdir(r0) r3 = getuid() ioctl$TIOCSTOP(r1, 0x2000746f) r4 = getegid() lchown(&(0x7f0000000340)='./file0\x00', r3, r4) r5 = semget$private(0x0, 0x7, 0x480) setsockopt$sock_int(r1, 0xffff, 0x1807, &(0x7f0000000600)=0x80000000, 0xffffffffffffffda) r6 = getuid() munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) setuid(r6) shutdown(r0, 0x1) getsockopt$SO_PEERCRED(r2, 0xffff, 0x1022, &(0x7f0000000640)={0x0, 0x0}, 0xc) fsync(r0) semop(r5, &(0x7f00000001c0)=[{0x4, 0x4, 0x1000}, {0x1, 0x8, 0x1000}], 0x2) open(&(0x7f0000000180)='./file0\x00', 0xa0, 0x4) openat(r2, &(0x7f0000000480)='./file0\x00', 0x800, 0x8) r8 = getgid() fchown(r2, r7, r8) symlink(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00') accept(r2, &(0x7f00000002c0)=@in6, &(0x7f0000000300)=0xc) getsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000200), &(0x7f0000000240)=0x10) sendto(r0, &(0x7f00000004c0)="b88f3305c19220f1b09cc7dfe23a2582c0a36fb21e14d2d092518d52f63d69495a2c6920b295ae187dd85d1eccccbd70a81af4273b58e77991c1ef064c6ff20378fd1e551f7897e1e1f27a0c7dda31ebc5b581c2a647a26efd3a8985488f93711eb5d9ce7571bb2967d347c2acb7cd4b5f87b6eead2f05fec434e3da3943f1f19be7ebaaa22161530884288a9eadbec6af2be634e13fd36bed3cc36b1acd78383c16d2faa26eb7f9ff62", 0xaa, 0x2, 0x0, 0x0) semop(r5, &(0x7f0000000100)=[{0x0, 0x9, 0x800}, {0x6, 0x4}, {0x0, 0x1, 0x800}, {0x3, 0xdd2, 0x1000}], 0x4) fsync(r2) pipe2(0x0, 0xffff) 23:08:25 executing program 1: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="3007c0c093ed11c1062c6b76328f9735873a402ba4ee0c7a947f442d447e8135b97f8b5ff86018a1194f090e87354fcabe756b79cf30f0ac033cca0aa1b40293c3807ad44144aff983a7b111f0a748614999abccdb3189cfb38f83ff90c2452c60af2b51ad", 0x65}], 0x1) write(r0, &(0x7f0000000200), 0xfe72) sendmsg(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f00000003c0)="2b81bc1c58c8860cff73b19b8d28c97eeb0f2c45bd61fcbde6b016b70f1ea7268faf9500a24fd23916d2a8c108b75e0e0b2eccafa3cfa72f4b44958da7ce780d7301bdf6d0e67f3530e28e1292cff531f79a9171640f4de9f75806fd89874bbc63262af0d0ef7354cd82a7352bcb71f7000eaf074e8472df7a8604c11f53c2306befcff88bce7197b4ed775f6d53547b34aa6aed26579b34509cbc95a3906819fb0cb60115ad69b4b3d1142a9049a4d29b336516931d822d8b2549e7b39c13e30adb1338b909bb5d429f4c693f532f06a5eacdc4c8ba54c3730c6172ad0f7a1cc5c7712107f7de63b8ae0bcd91bce6153d17de48b02f3adc9ebe912f99fe4eb35ab2210b17d9276358fc21bd28e457d62d0486972488631658565f35910780c8de757f57b1537c57fc31490d7d52b959d90e19f5a1fc28dba24294930f638f195b67bc64c8760518dad7caa0f42b25c3df8c877e8cbf8c3f172ba970f9273298844087d9e605b07d184ae285000db163d77cbd217183c000ed6aec386ec9eb9301b434f08e4b7cf04afd68bb722f27351b61443e152e783f7a603e8384990c95c1e176ff44fc7cbd630c0cec01e6a3d26bbd5cd7da71cb92d83e996992b8bd4d754835db0bdc6282a4aa516d6d19582e642bfec22546543c7bc71e1e814471c2ce7ece751ce40c331a55042e9098513ec4304a3ecea3bb819f2947e3ce11dcef9fb1fa53198d95615e2de6bbbdc40d47b6fd9275e6c6fc01d455c11712379e1cb09097234b50760444e0d50693704fd250abd1ed9cd816c2445240b6a5c7c1b88448647005f880e1b66ca3b751bcf600abda2c37125906d977de4545ac90a951449ca8e04612cc8bb2c9c63699c3a61ea7b185453ae2c3962d2e01f2a3a73340126d7c5f7144bcd7d2962cf5efccd8f7c1ce64d7bf367ac734e08a1089eb3d9a37d95815249563a9210873d15379cb032f5252db0f92e67315690a95734da207f896ad2dc74ec599147f73c53404b0bd5c255083607ebbdd09a96c70c13049c41d33248a9096de0829f3268b71d5bfa56d386cf4cdb8185dd0d7eaa8bef8b24d4b7a325fec38576e52b454d82c73e3772304c78d709cbb2086a7149957d0a81823c9364b7ea1233fa021be006b423e43067d545fde9f13e911a55283160d8d15", 0x340}], 0x1}, 0x0) r1 = syz_open_pts() close(r0) dup(r1) syz_open_pts() ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) 23:08:25 executing program 0: r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) getsockopt(r0, 0x0, 0x8, &(0x7f0000000040)=""/123, &(0x7f00000000c0)=0x7b) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSCTTY(r2, 0x20007461) sendto(r2, &(0x7f0000000380)="293ff03a00b958e6c3d79d824c94610d9fd8975b641a89fb6420a469eabea7c91100cd6efff52f06c753d87e86e2cb3bb97cfd1528b2ea3fb38bcf3b4e650c39617df2dca9a50494e2f2b9311a5c22c6a16680b125a382a0d09408f85ab3eda594b64822e19e63eced96a4023054c34465b603272db8094703ef48a2513de04bb2fa566cf542019a3e7fdbd845211339b16cff993781644471daf19bb0b187a41287d8619a883fdb0344e60c750b6caf1d1b131aba894290e4d183522e7d7ed9cd4ed642ed9824d8f8daa4c93ea3670aa429d5d502f008996f0d2078c90a949964efe2e3d33575653bd581404f1b54", 0xef, 0x1, 0x0, 0x0) fchdir(r0) r3 = getuid() ioctl$TIOCSTOP(r1, 0x2000746f) r4 = getegid() lchown(&(0x7f0000000340)='./file0\x00', r3, r4) r5 = semget$private(0x0, 0x7, 0x480) setsockopt$sock_int(r1, 0xffff, 0x1807, &(0x7f0000000600)=0x80000000, 0xffffffffffffffda) r6 = getuid() munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) setuid(r6) shutdown(r0, 0x1) getsockopt$SO_PEERCRED(r2, 0xffff, 0x1022, &(0x7f0000000640)={0x0, 0x0}, 0xc) fsync(r0) semop(r5, &(0x7f00000001c0)=[{0x4, 0x4, 0x1000}, {0x1, 0x8, 0x1000}], 0x2) open(&(0x7f0000000180)='./file0\x00', 0xa0, 0x4) openat(r2, &(0x7f0000000480)='./file0\x00', 0x800, 0x8) r8 = getgid() fchown(r2, r7, r8) symlink(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00') accept(r2, &(0x7f00000002c0)=@in6, &(0x7f0000000300)=0xc) getsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000200), &(0x7f0000000240)=0x10) sendto(r0, &(0x7f00000004c0)="b88f3305c19220f1b09cc7dfe23a2582c0a36fb21e14d2d092518d52f63d69495a2c6920b295ae187dd85d1eccccbd70a81af4273b58e77991c1ef064c6ff20378fd1e551f7897e1e1f27a0c7dda31ebc5b581c2a647a26efd3a8985488f93711eb5d9ce7571bb2967d347c2acb7cd4b5f87b6eead2f05fec434e3da3943f1f19be7ebaaa22161530884288a9eadbec6af2be634e13fd36bed3cc36b1acd78383c16d2faa26eb7f9ff62", 0xaa, 0x2, 0x0, 0x0) semop(r5, &(0x7f0000000100)=[{0x0, 0x9, 0x800}, {0x6, 0x4}, {0x0, 0x1, 0x800}, {0x3, 0xdd2, 0x1000}], 0x4) fsync(r2) pipe2(0x0, 0xffff) 23:08:26 executing program 0: r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) getsockopt(r0, 0x0, 0x8, &(0x7f0000000040)=""/123, &(0x7f00000000c0)=0x7b) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSCTTY(r2, 0x20007461) sendto(r2, &(0x7f0000000380)="293ff03a00b958e6c3d79d824c94610d9fd8975b641a89fb6420a469eabea7c91100cd6efff52f06c753d87e86e2cb3bb97cfd1528b2ea3fb38bcf3b4e650c39617df2dca9a50494e2f2b9311a5c22c6a16680b125a382a0d09408f85ab3eda594b64822e19e63eced96a4023054c34465b603272db8094703ef48a2513de04bb2fa566cf542019a3e7fdbd845211339b16cff993781644471daf19bb0b187a41287d8619a883fdb0344e60c750b6caf1d1b131aba894290e4d183522e7d7ed9cd4ed642ed9824d8f8daa4c93ea3670aa429d5d502f008996f0d2078c90a949964efe2e3d33575653bd581404f1b54", 0xef, 0x1, 0x0, 0x0) fchdir(r0) r3 = getuid() ioctl$TIOCSTOP(r1, 0x2000746f) r4 = getegid() lchown(&(0x7f0000000340)='./file0\x00', r3, r4) r5 = semget$private(0x0, 0x7, 0x480) setsockopt$sock_int(r1, 0xffff, 0x1807, &(0x7f0000000600)=0x80000000, 0xffffffffffffffda) r6 = getuid() munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) setuid(r6) shutdown(r0, 0x1) getsockopt$SO_PEERCRED(r2, 0xffff, 0x1022, &(0x7f0000000640)={0x0, 0x0}, 0xc) fsync(r0) semop(r5, &(0x7f00000001c0)=[{0x4, 0x4, 0x1000}, {0x1, 0x8, 0x1000}], 0x2) open(&(0x7f0000000180)='./file0\x00', 0xa0, 0x4) openat(r2, &(0x7f0000000480)='./file0\x00', 0x800, 0x8) r8 = getgid() fchown(r2, r7, r8) symlink(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00') accept(r2, &(0x7f00000002c0)=@in6, &(0x7f0000000300)=0xc) getsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000200), &(0x7f0000000240)=0x10) sendto(r0, &(0x7f00000004c0)="b88f3305c19220f1b09cc7dfe23a2582c0a36fb21e14d2d092518d52f63d69495a2c6920b295ae187dd85d1eccccbd70a81af4273b58e77991c1ef064c6ff20378fd1e551f7897e1e1f27a0c7dda31ebc5b581c2a647a26efd3a8985488f93711eb5d9ce7571bb2967d347c2acb7cd4b5f87b6eead2f05fec434e3da3943f1f19be7ebaaa22161530884288a9eadbec6af2be634e13fd36bed3cc36b1acd78383c16d2faa26eb7f9ff62", 0xaa, 0x2, 0x0, 0x0) semop(r5, &(0x7f0000000100)=[{0x0, 0x9, 0x800}, {0x6, 0x4}, {0x0, 0x1, 0x800}, {0x3, 0xdd2, 0x1000}], 0x4) fsync(r2) pipe2(0x0, 0xffff) 23:08:26 executing program 1: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)="3007c0c093ed11c1062c6b76328f9735873a402ba4ee0c7a947f442d447e8135b97f8b5ff86018a1194f090e87354fcabe756b79cf30f0ac033cca0aa1b40293c3807ad44144aff983a7b111f0a748614999abccdb3189cfb38f83ff90c2452c60af2b51ad", 0x65}], 0x1) write(r0, &(0x7f0000000200), 0xfe72) sendmsg(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f00000003c0)="2b81bc1c58c8860cff73b19b8d28c97eeb0f2c45bd61fcbde6b016b70f1ea7268faf9500a24fd23916d2a8c108b75e0e0b2eccafa3cfa72f4b44958da7ce780d7301bdf6d0e67f3530e28e1292cff531f79a9171640f4de9f75806fd89874bbc63262af0d0ef7354cd82a7352bcb71f7000eaf074e8472df7a8604c11f53c2306befcff88bce7197b4ed775f6d53547b34aa6aed26579b34509cbc95a3906819fb0cb60115ad69b4b3d1142a9049a4d29b336516931d822d8b2549e7b39c13e30adb1338b909bb5d429f4c693f532f06a5eacdc4c8ba54c3730c6172ad0f7a1cc5c7712107f7de63b8ae0bcd91bce6153d17de48b02f3adc9ebe912f99fe4eb35ab2210b17d9276358fc21bd28e457d62d0486972488631658565f35910780c8de757f57b1537c57fc31490d7d52b959d90e19f5a1fc28dba24294930f638f195b67bc64c8760518dad7caa0f42b25c3df8c877e8cbf8c3f172ba970f9273298844087d9e605b07d184ae285000db163d77cbd217183c000ed6aec386ec9eb9301b434f08e4b7cf04afd68bb722f27351b61443e152e783f7a603e8384990c95c1e176ff44fc7cbd630c0cec01e6a3d26bbd5cd7da71cb92d83e996992b8bd4d754835db0bdc6282a4aa516d6d19582e642bfec22546543c7bc71e1e814471c2ce7ece751ce40c331a55042e9098513ec4304a3ecea3bb819f2947e3ce11dcef9fb1fa53198d95615e2de6bbbdc40d47b6fd9275e6c6fc01d455c11712379e1cb09097234b50760444e0d50693704fd250abd1ed9cd816c2445240b6a5c7c1b88448647005f880e1b66ca3b751bcf600abda2c37125906d977de4545ac90a951449ca8e04612cc8bb2c9c63699c3a61ea7b185453ae2c3962d2e01f2a3a73340126d7c5f7144bcd7d2962cf5efccd8f7c1ce64d7bf367ac734e08a1089eb3d9a37d95815249563a9210873d15379cb032f5252db0f92e67315690a95734da207f896ad2dc74ec599147f73c53404b0bd5c255083607ebbdd09a96c70c13049c41d33248a9096de0829f3268b71d5bfa56d386cf4cdb8185dd0d7eaa8bef8b24d4b7a325fec38576e52b454d82c73e3772304c78d709cbb2086a7149957d0a81823c9364b7ea1233fa021be006b423e43067d545fde9f13e911a55283160d8d15", 0x340}], 0x1}, 0x0) r1 = syz_open_pts() close(r0) dup(r1) syz_open_pts() ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) 23:08:26 executing program 0: r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) getsockopt(r0, 0x0, 0x8, &(0x7f0000000040)=""/123, &(0x7f00000000c0)=0x7b) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSCTTY(r2, 0x20007461) sendto(r2, &(0x7f0000000380)="293ff03a00b958e6c3d79d824c94610d9fd8975b641a89fb6420a469eabea7c91100cd6efff52f06c753d87e86e2cb3bb97cfd1528b2ea3fb38bcf3b4e650c39617df2dca9a50494e2f2b9311a5c22c6a16680b125a382a0d09408f85ab3eda594b64822e19e63eced96a4023054c34465b603272db8094703ef48a2513de04bb2fa566cf542019a3e7fdbd845211339b16cff993781644471daf19bb0b187a41287d8619a883fdb0344e60c750b6caf1d1b131aba894290e4d183522e7d7ed9cd4ed642ed9824d8f8daa4c93ea3670aa429d5d502f008996f0d2078c90a949964efe2e3d33575653bd581404f1b54", 0xef, 0x1, 0x0, 0x0) fchdir(r0) r3 = getuid() ioctl$TIOCSTOP(r1, 0x2000746f) r4 = getegid() lchown(&(0x7f0000000340)='./file0\x00', r3, r4) r5 = semget$private(0x0, 0x7, 0x480) setsockopt$sock_int(r1, 0xffff, 0x1807, &(0x7f0000000600)=0x80000000, 0xffffffffffffffda) r6 = getuid() munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) setuid(r6) shutdown(r0, 0x1) getsockopt$SO_PEERCRED(r2, 0xffff, 0x1022, &(0x7f0000000640)={0x0, 0x0}, 0xc) fsync(r0) semop(r5, &(0x7f00000001c0)=[{0x4, 0x4, 0x1000}, {0x1, 0x8, 0x1000}], 0x2) open(&(0x7f0000000180)='./file0\x00', 0xa0, 0x4) openat(r2, &(0x7f0000000480)='./file0\x00', 0x800, 0x8) r8 = getgid() fchown(r2, r7, r8) symlink(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00') accept(r2, &(0x7f00000002c0)=@in6, &(0x7f0000000300)=0xc) getsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000200), &(0x7f0000000240)=0x10) sendto(r0, &(0x7f00000004c0)="b88f3305c19220f1b09cc7dfe23a2582c0a36fb21e14d2d092518d52f63d69495a2c6920b295ae187dd85d1eccccbd70a81af4273b58e77991c1ef064c6ff20378fd1e551f7897e1e1f27a0c7dda31ebc5b581c2a647a26efd3a8985488f93711eb5d9ce7571bb2967d347c2acb7cd4b5f87b6eead2f05fec434e3da3943f1f19be7ebaaa22161530884288a9eadbec6af2be634e13fd36bed3cc36b1acd78383c16d2faa26eb7f9ff62", 0xaa, 0x2, 0x0, 0x0) semop(r5, &(0x7f0000000100)=[{0x0, 0x9, 0x800}, {0x6, 0x4}, {0x0, 0x1, 0x800}, {0x3, 0xdd2, 0x1000}], 0x4) fsync(r2) pipe2(0x0, 0xffff) 23:08:26 executing program 0: r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) getsockopt(r0, 0x0, 0x8, &(0x7f0000000040)=""/123, &(0x7f00000000c0)=0x7b) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSCTTY(r2, 0x20007461) sendto(r2, &(0x7f0000000380)="293ff03a00b958e6c3d79d824c94610d9fd8975b641a89fb6420a469eabea7c91100cd6efff52f06c753d87e86e2cb3bb97cfd1528b2ea3fb38bcf3b4e650c39617df2dca9a50494e2f2b9311a5c22c6a16680b125a382a0d09408f85ab3eda594b64822e19e63eced96a4023054c34465b603272db8094703ef48a2513de04bb2fa566cf542019a3e7fdbd845211339b16cff993781644471daf19bb0b187a41287d8619a883fdb0344e60c750b6caf1d1b131aba894290e4d183522e7d7ed9cd4ed642ed9824d8f8daa4c93ea3670aa429d5d502f008996f0d2078c90a949964efe2e3d33575653bd581404f1b54", 0xef, 0x1, 0x0, 0x0) fchdir(r0) r3 = getuid() ioctl$TIOCSTOP(r1, 0x2000746f) r4 = getegid() lchown(&(0x7f0000000340)='./file0\x00', r3, r4) r5 = semget$private(0x0, 0x7, 0x480) setsockopt$sock_int(r1, 0xffff, 0x1807, &(0x7f0000000600)=0x80000000, 0xffffffffffffffda) r6 = getuid() munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) setuid(r6) shutdown(r0, 0x1) getsockopt$SO_PEERCRED(r2, 0xffff, 0x1022, &(0x7f0000000640)={0x0, 0x0}, 0xc) fsync(r0) semop(r5, &(0x7f00000001c0)=[{0x4, 0x4, 0x1000}, {0x1, 0x8, 0x1000}], 0x2) open(&(0x7f0000000180)='./file0\x00', 0xa0, 0x4) openat(r2, &(0x7f0000000480)='./file0\x00', 0x800, 0x8) r8 = getgid() fchown(r2, r7, r8) symlink(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00') accept(r2, &(0x7f00000002c0)=@in6, &(0x7f0000000300)=0xc) getsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000200), &(0x7f0000000240)=0x10) sendto(r0, &(0x7f00000004c0)="b88f3305c19220f1b09cc7dfe23a2582c0a36fb21e14d2d092518d52f63d69495a2c6920b295ae187dd85d1eccccbd70a81af4273b58e77991c1ef064c6ff20378fd1e551f7897e1e1f27a0c7dda31ebc5b581c2a647a26efd3a8985488f93711eb5d9ce7571bb2967d347c2acb7cd4b5f87b6eead2f05fec434e3da3943f1f19be7ebaaa22161530884288a9eadbec6af2be634e13fd36bed3cc36b1acd78383c16d2faa26eb7f9ff62", 0xaa, 0x2, 0x0, 0x0) semop(r5, &(0x7f0000000100)=[{0x0, 0x9, 0x800}, {0x6, 0x4}, {0x0, 0x1, 0x800}, {0x3, 0xdd2, 0x1000}], 0x4) fsync(r2) pipe2(0x0, 0xffff) 23:08:26 executing program 1: r0 = kqueue() pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) kevent(r0, &(0x7f00000000c0)=[{{r2}, 0xffffffffffffffff, 0x11}], 0x3f, 0x0, 0x0, 0x0) kevent(r0, &(0x7f0000000080)=[{{r1}, 0xfffffffffffffffe, 0x5}], 0x1f, 0x0, 0x0, 0x0) r3 = kqueue() r4 = kqueue() kevent(r3, &(0x7f0000000000), 0x20, 0x0, 0x10000, 0x0) kevent(r4, &(0x7f0000000040), 0x4, 0x0, 0x3, 0x0) dup2(r0, r2) 23:08:26 executing program 0: r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) getsockopt(r0, 0x0, 0x8, &(0x7f0000000040)=""/123, &(0x7f00000000c0)=0x7b) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSCTTY(r2, 0x20007461) sendto(r2, &(0x7f0000000380)="293ff03a00b958e6c3d79d824c94610d9fd8975b641a89fb6420a469eabea7c91100cd6efff52f06c753d87e86e2cb3bb97cfd1528b2ea3fb38bcf3b4e650c39617df2dca9a50494e2f2b9311a5c22c6a16680b125a382a0d09408f85ab3eda594b64822e19e63eced96a4023054c34465b603272db8094703ef48a2513de04bb2fa566cf542019a3e7fdbd845211339b16cff993781644471daf19bb0b187a41287d8619a883fdb0344e60c750b6caf1d1b131aba894290e4d183522e7d7ed9cd4ed642ed9824d8f8daa4c93ea3670aa429d5d502f008996f0d2078c90a949964efe2e3d33575653bd581404f1b54", 0xef, 0x1, 0x0, 0x0) fchdir(r0) r3 = getuid() ioctl$TIOCSTOP(r1, 0x2000746f) r4 = getegid() lchown(&(0x7f0000000340)='./file0\x00', r3, r4) r5 = semget$private(0x0, 0x7, 0x480) setsockopt$sock_int(r1, 0xffff, 0x1807, &(0x7f0000000600)=0x80000000, 0xffffffffffffffda) r6 = getuid() munlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) setuid(r6) shutdown(r0, 0x1) getsockopt$SO_PEERCRED(r2, 0xffff, 0x1022, &(0x7f0000000640)={0x0, 0x0}, 0xc) fsync(r0) semop(r5, &(0x7f00000001c0)=[{0x4, 0x4, 0x1000}, {0x1, 0x8, 0x1000}], 0x2) open(&(0x7f0000000180)='./file0\x00', 0xa0, 0x4) openat(r2, &(0x7f0000000480)='./file0\x00', 0x800, 0x8) r8 = getgid() fchown(r2, r7, r8) symlink(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='./file0\x00') accept(r2, &(0x7f00000002c0)=@in6, &(0x7f0000000300)=0xc) getsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f0000000200), &(0x7f0000000240)=0x10) sendto(r0, &(0x7f00000004c0)="b88f3305c19220f1b09cc7dfe23a2582c0a36fb21e14d2d092518d52f63d69495a2c6920b295ae187dd85d1eccccbd70a81af4273b58e77991c1ef064c6ff20378fd1e551f7897e1e1f27a0c7dda31ebc5b581c2a647a26efd3a8985488f93711eb5d9ce7571bb2967d347c2acb7cd4b5f87b6eead2f05fec434e3da3943f1f19be7ebaaa22161530884288a9eadbec6af2be634e13fd36bed3cc36b1acd78383c16d2faa26eb7f9ff62", 0xaa, 0x2, 0x0, 0x0) semop(r5, &(0x7f0000000100)=[{0x0, 0x9, 0x800}, {0x6, 0x4}, {0x0, 0x1, 0x800}, {0x3, 0xdd2, 0x1000}], 0x4) fsync(r2) pipe2(0x0, 0xffff) 23:08:26 executing program 1: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) write(r0, &(0x7f0000000180)="582720efabd16ebae63225259560f8e5815f73f2a044fd33055552fbd5e41789632dfc94ff334a5619515a4c8ab06198824b3da025bbd47b3bf579456fc7d4096e8c8b6b87cb2d72b8bcdb9ad8a4f5f728193ef16ab93f12fc4d5f16b136a5d00d1628b53a", 0x65) write(r0, &(0x7f00000005c0)="3e2a7913e4bad21c714f4dd36a27e5e27b216d673551c0c01b3dfaf9173aee6cfd0f850000f1e552aaeefeaff0f2c85e2831c633d449011f78000000000000013c1fe90020391d0000000001ff103434820abc4bcabba344400214295fba6aefdb06c08ab24367c9f0abbbafe214dea79d9917dd1d95e8f6b9d360ee906e5afdc27b8c9831351d74122ab9bd510eb00bb2c4c7a18ef00235685c2001fc170000ded2cfb84c796ba78c8030ee2f873c1e711d5b65d2712d93ae731ffee5a62700007106bd31b4605f1d0008fdbc15a6029b9a5b806d3ea7b6a7d96d09007d3736b269790a96f5b101b348cebd1f74804091d0cf27da721ab3fe68bfddd27d0a110febf1b4d9977652ce45f4871774c7803ce59df49897872d4b0292851d36eeae7ebfb4c9d7b31f678df44ff0ff0000000000", 0x132) r1 = syz_open_pts() close(r0) dup(r1) r2 = syz_open_pts() ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f0000000000)={0x1ff, 0x0, 0x98b, 0xffffffffffffff7d, "02000000078d00cb5fffffffffff7f00"}) readv(r2, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/45, 0x2d}], 0x1) 23:08:26 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x1, &(0x7f0000000040)="0000e100000000e400000010", 0xc) setsockopt$inet_opts(r0, 0x0, 0x1, &(0x7f0000000200)='\"', 0x1) 23:08:26 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = dup2(r0, r0) setsockopt$sock_int(r1, 0xffff, 0x1023, 0x0, 0x0) 23:08:26 executing program 1: r0 = socket$inet6(0x18, 0x2, 0x0) getsockopt(r0, 0x29, 0x3e, 0x0, 0x0) 23:08:26 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = dup2(r0, r0) setsockopt$sock_int(r1, 0xffff, 0x1023, 0x0, 0x0) 23:08:26 executing program 1: unveil(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='cr') 23:08:26 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = dup2(r0, r0) setsockopt$sock_int(r1, 0xffff, 0x1023, 0x0, 0x0) 23:08:26 executing program 1: r0 = socket(0x11, 0x3, 0x0) socket(0x11, 0x4003, 0x0) r1 = kqueue() dup2(r1, r0) 23:08:26 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = dup2(r0, r0) setsockopt$sock_int(r1, 0xffff, 0x1023, 0x0, 0x0) 23:08:26 executing program 1: r0 = kqueue() mprotect(&(0x7f00001f3000/0x1000)=nil, 0x1000, 0x0) kevent(r0, &(0x7f0000000080), 0x9130fbf, 0x0, 0x4000000, 0x0) munmap(&(0x7f00001f0000/0x4000)=nil, 0x4000) 23:08:26 executing program 1: r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x9, 0x0, 0x86, &(0x7f00000001c0)={0x7f, 0xfffffffffffffff9}) close(r0) 23:08:26 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$unix(r1, &(0x7f0000000240)="d1201d9c07b00a16a86b937d24a7f2947be77f1cbe061ab59b4c483ac24bff05792c3b2d50e2f61fdd92120f14405cf540aea663e53940647fdbf6390c9d521a8ef176e290e1cfbead46e28d2cdfad33172d9d3cc0db9ce22cae4738532a1dc775f78b6d6052e279e6fb2f65bcbf4bf29cdbec91f52747de7323b7ac7626d427d51b6cbbbf298a0f33e9a2ef5ccd435c8b", 0x91, 0x40c, 0x0, 0x0) readv(r0, &(0x7f0000001600)=[{&(0x7f0000000180)=""/170, 0xaa}], 0x1) 23:08:26 executing program 1: r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x29, 0x9, 0x0, 0x0) 23:08:26 executing program 0: r0 = socket(0x10000000002, 0x2, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1021, &(0x7f0000000000), 0x4) 23:08:26 executing program 1: r0 = syz_open_pts() syz_open_pts() ioctl$TIOCSTAT(r0, 0x20007465, 0x0) 23:08:26 executing program 0: execve(0x0, &(0x7f0000000180)=[&(0x7f0000000100)='/{\x00'], 0x0) ioctl$TIOCSETAF(0xffffffffffffffff, 0x802c7416, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0, 0x0, "010000000000000000ffffff7f00"}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x29, 0xc, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) setsockopt(r0, 0x29, 0xa, &(0x7f0000000180)="f7f9e794", 0x4) 23:08:26 executing program 1: kevent(0xffffffffffffffff, &(0x7f0000000000)=[{{}, 0x0, 0x0, 0x0, 0x2}], 0x0, 0x0, 0x0, 0x0) ioctl$TIOCSETAF(0xffffffffffffffff, 0x802c7416, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0, 0x0, "010000000000000000ffffff7f00"}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x29, 0xc, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) setsockopt(r0, 0x29, 0xd, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) 23:08:27 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x10000014c) poll(&(0x7f0000000180)=[{r0, 0x185}], 0x1, 0x7f) 23:08:27 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_timeval(r0, 0xffff, 0x40, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x1022, 0x0, 0x0) 23:08:27 executing program 0: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0x90d2, 0x0, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) write(r0, &(0x7f0000000180)="582720efabd16ebae63225259560f8e5815f73f2a044fd33055552fbd5e41789632dfc94ff334a5619515a4c8ab06198824b3da025bbd47b3bf579456fc7d4096e8c8b6b87cb2d72b8bcdb9ad8a4f5f728193ef16ab93f12fc4d5f16b136a5d00d1628b53a", 0x65) write(r0, &(0x7f00000002c0)="a80870e5e787df15a3dad3cb91b1b9df276b3a6e23a492388af974d88b0a", 0x1e) r1 = syz_open_pts() close(r0) dup(r1) r2 = syz_open_pts() ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f0000000000)={0x0, 0x0, 0x212b5c23, 0x0, "1ced99f153e5918da43f20f3371f3fe2ed8be2be"}) ioctl$TIOCSETA(r2, 0x802c7414, &(0x7f00000000c0)={0x0, 0x0, 0x2003, 0xfffffffffffffff7, "854955882eda0ab3c5000000f1d84452f514eb9d"}) readv(r2, &(0x7f0000000580)=[{&(0x7f0000001900)=""/134, 0x86}], 0x1) syz_open_pts() 23:08:27 executing program 0: preadv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000001640)=""/247, 0xffffffcc}], 0x1, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x611, 0x0) pwritev(r0, &(0x7f0000000380)=[{&(0x7f0000000080)="89", 0x1}], 0x1, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0, 0x0) pwritev(r0, &(0x7f00000003c0), 0x273, 0x0) 23:08:27 executing program 1: nanosleep(&(0x7f0000001c40)={0xf0, 0x7ffffffe}, 0x0) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0xf8b4, 0x0, 0x10000fe, 0x0) kevent(r0, &(0x7f0000000000), 0x400, 0x0, 0x8000, 0x0) 23:08:27 executing program 0: preadv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000001640)=""/247, 0xffffffcc}], 0x1, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x611, 0x0) pwritev(r0, &(0x7f0000000380)=[{&(0x7f0000000080)="89", 0x1}], 0x1, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0, 0x0) pwritev(r0, &(0x7f00000003c0), 0x273, 0x0) 23:08:28 executing program 0: preadv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000001640)=""/247, 0xffffffcc}], 0x1, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x611, 0x0) pwritev(r0, &(0x7f0000000380)=[{&(0x7f0000000080)="89", 0x1}], 0x1, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0, 0x0) pwritev(r0, &(0x7f00000003c0), 0x273, 0x0) 23:08:28 executing program 1: nanosleep(&(0x7f0000001c40)={0xf0, 0x7ffffffe}, 0x0) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0xf8b4, 0x0, 0x10000fe, 0x0) kevent(r0, &(0x7f0000000000), 0x400, 0x0, 0x8000, 0x0) 23:08:28 executing program 0: preadv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000001640)=""/247, 0xffffffcc}], 0x1, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x611, 0x0) pwritev(r0, &(0x7f0000000380)=[{&(0x7f0000000080)="89", 0x1}], 0x1, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0, 0x0) pwritev(r0, &(0x7f00000003c0), 0x273, 0x0) 23:08:28 executing program 1: nanosleep(&(0x7f0000001c40)={0xf0, 0x7ffffffe}, 0x0) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0xf8b4, 0x0, 0x10000fe, 0x0) kevent(r0, &(0x7f0000000000), 0x400, 0x0, 0x8000, 0x0) 23:08:29 executing program 0: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000000)={0x0, 0x0, 0x90d2, 0x9, "d730c1e7bb6fc6e23c5b00000000000000e74de4"}) write(r0, &(0x7f0000000180)="582720efabd16ebae63225259560f8e5815f73f2a044fd33055552fbd5e41789632dfc94ff334a5619515a4c8ab06198824b3da025bbd47b3bf579456fc7d4096e8c8b6b87cb2d72b8bcdb9ad8a4f5f728193ef16ab93f12fc4d5f16b136a5d00d1628b53a", 0x65) write(r0, &(0x7f00000003c0)="3e2a7913e4ba6d673553c0c01b7b2ff90f1e1e4b2ae5eefeaff0f2c85e2831c61ad4091d1f7828bc2d2a500a35ace697be3be0fa9da398bcd62b103434820abc4bcacfa3444002000514295fbaabbbafe214e8f6b9d3b3c190fff0c9ea73a4000000dcb95a0100000000000000ffffffffff510eb0092e00000000bae9df8156745188e3629a90", 0x87) poll(&(0x7f0000000080)=[{r0, 0x80}, {r0, 0x80}, {r0}, {r0, 0x24}], 0x4, 0x3ff) r1 = syz_open_pts() close(r0) r2 = dup(r1) r3 = syz_open_pts() fcntl$dupfd(r0, 0xa, r2) ioctl$TIOCSETA(r3, 0x802c7414, &(0x7f0000000040)={0x0, 0x9, 0x3, 0xffffffffffffff7d, "854955882e0261ce4e66378e5dea9c11fe4dbfa6"}) getdents(r2, &(0x7f0000000480)=""/4096, 0x1000) 23:08:29 executing program 1: nanosleep(&(0x7f0000001c40)={0xf0, 0x7ffffffe}, 0x0) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0xf8b4, 0x0, 0x10000fe, 0x0) kevent(r0, &(0x7f0000000000), 0x400, 0x0, 0x8000, 0x0) 23:08:29 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="fecf76f148ff5213ba8797a7c4e58b061f19131a3b4adaef8b9813fb61a092110a74ccc52258aed92198f8f0fc125c94e0952a58efc794078f037000da7fa729e456be7abe5a831916cb519d516df81b91b03a798c4448931551f5f22108a6915ef4ccc90650159f5b24c62bbb43dcbdab5ef629b1bb1cb9d7e7f41a31cf9769c25fc130dbee09f2a6a764cae8a000c476", 0x91}], 0x1, 0x0, 0x0, 0x401}, 0x401) 23:08:29 executing program 1: r0 = socket(0x2, 0x400000000002, 0x0) recvmsg(r0, &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1) 23:08:29 executing program 0: r0 = shmget$private(0x0, 0x2000, 0x110, &(0x7f0000ffe000/0x2000)=nil) shmctl$IPC_STAT(r0, 0x2, 0x0) 23:08:29 executing program 1: r0 = socket$inet6(0x18, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x0) 23:08:29 executing program 0: symlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00') open$dir(&(0x7f0000000000)='./file0\x00', 0x100, 0x0) 23:08:29 executing program 1: r0 = syz_open_pts() fcntl$lock(r0, 0x8, &(0x7f0000000080)={0x0, 0x0, 0x5, 0x100000000}) flock(r0, 0x2) flock(r0, 0x2) fcntl$lock(r0, 0x9, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x100000000}) 23:08:29 executing program 0: r0 = socket(0x2, 0x2, 0x0) connect$unix(r0, &(0x7f0000000000)=@file={0xbd5699bc1ec0282, './file0\x00'}, 0x10) setsockopt$inet_opts(r0, 0x0, 0x20000000000001, &(0x7f0000000080)="9a02e303000000b90cba8590", 0xc) writev(r0, &(0x7f0000001280)=[{&(0x7f0000000840)="471b29b7ab6e6cd6d457c62db971872dec848e021b42b9b4e4b1769b3b44468c6c538ff805936e9b85fb4fc53557388a0ec8526ac6232d1fe502b11e27f8e39f73b7fd13d03b7b2a778c429842d8396b420a136efbb31a998da54450a201a01f1aa5c05ca0a265b9497658c555eea51ec5315d3c39c619a401fce5230f0b8ada5dae3e14f2a7376d7af6d0f1994dfb785e7c08b3173180feb41ab4255405778c22a436a02142011c744dad4b462b82c4106be5b8519cf0b99cb819ee7723213cee162dc650f26535ff5abeaf5e5ee642a196485ca7dc855b1b8f61e13fd198894f505251816223dd4c9e5351104bda2f05dbad4b28c6fb5c68418b47de20cbc9f86a5c8e75c3e9e3c5d76fd3c201d4d7983c2dfe763932096d4f5742bb997a3db2dc0f0172e67ee237f32ea06be7048bf2d603d2c1d7b19982071edb78f9507f7f5e3db25bae74aed589e1143ad6b546f39577a00cdadbe67011b64f3e9486c765f676bf84a118ace1f31db0db60bd6d3721620d43c7d5febf427c39e83ad26359aba8aea2d9c7e123ace8df795c34356a22f9bc3d46972ceec00f64d1a76a2e3566414118689474179c5919b12c6a43589631e5be494edacfd0144d46151c62da57aafaccde66a852c2fab9fd867e941ad24ad0dc5eda57f345594a085c9edc4a403daf13e57660dec687bcb4011f3f1c520b80177ca95a9a917b18239701885fb6e3dbe3cad79ebb61073f73762a17afabdafd82dd57f945c635ee11d8c6b939dd629138dd9d4b390380661b39e27e832ab7c4191b67ff98397a9af8aafcce960994734aeb56a924454ed9b35264516f98305468fa74cc4b886044fd611d4c230f79b1af3d363f70c0c5c2724bf4f892023e56fc5e578e59f522ec29c1c61a68a0b2635bf90f07b19020c5e02bab166fd1d0f9ade3d4cb0fd85dfba8ed6835caf8b8710eb83158513d0b12ac3848d53df5320222195cedfb1b514c85e919f2d188240397512896693ceb33e1943893e3c1e68267a537e60ac48860db4359e73c7714cc544dc336f29803d5fc5952f355e193e42a7b92ecdcc12c8d42e352f22cc319981ea848dcc243a55c11f4446f3477d4837356d5507f6295b3192edd712aefe87cf8049b0757a4ac7790a72123601562bdadc73f7f8a0a9c0ab66c8c3300e64e9511b76eb810e314a9a0d45847f65c05f0dc8b769d88451018d21daef3c6328113193f6a478f4c5c37dd398f1bc35c41821fff9578fb093b03744e5bf56a7880208df08df8fa40faadde00c599db40524be56317ea80abe1a0453e695e711d467ece36c5e806e58ea3ef3d650842a4d39fe1206f8097e5c3d378a3af0859df0edfe315370dc85bd8bf84a64c2636985e22c2dacd617fa40e4e8c8c3de636bd89c7a5138d176066f8bdcbfd3d1524830f40bb155c28089a02320a639b940cbe7507fbc7d4ac9d082c70e6d91538b17612f368efbd9622d8600837699e3f3b12dd7dd536518e4e06e029cdeb78ad4e89c9406f3d5de610b34289c2d0e5d136458cc39c744ffb348c2adb2609780c4b7c90a830a23286dba7e59d0956b7332ac134a3ac3e93b510fe7028c77df7ac750d2a2bf07138af0ec43b6e10a4f2c9f825ee7960bc4acf7c7b6f563d56cddf20213d9a3cf5f0253174daf258dace5ba270b39c373b0d3c2fce8494f3aa8fd9f6a172ae7943021070662a8b050c8a8817bb5583dd175fdf415ca8351f6c9b410b98350a3d3aa49002ea4701814ac0b4c7e8fbb91bd1e27ef2a06aef7a38a3acb707b636ab7adf9cefbd62a0aa3333070eddf41df9ec6eae6513acaf6a5338d9893ec0972158b4cfc7ef55b159ffcbe6c1d579a944908527d30e0c419c6ffc8201219544220d1c5b52d667bc6d27d2b42562561e8d33734f7e14893fe314c43bb2ca2ab63e2e602bbd61196cbf79fca4d0a971ff67e06515ae51787ff5ca8104f7924ec5ecaafe44a8f9818e1218a6b18956a4ef229c5e8a232f8c799053bb3ccc", 0x591}], 0x1) 23:08:29 executing program 0: r0 = socket$inet6(0x18, 0x2, 0x0) getsockopt$sock_int(r0, 0xffff, 0x100, 0x0, 0x0) 23:08:29 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x29, 0xa, &(0x7f0000000000)="d5ff9668", 0x4) setsockopt(r0, 0x200000000029, 0x80000000000000b, &(0x7f0000000080), 0x0) 23:08:30 executing program 1: setrlimit(0x6, &(0x7f0000000000)) r0 = semget$private(0x0, 0x3, 0x8) semctl$IPC_STAT(r0, 0x0, 0x2, &(0x7f0000000240)=""/179) getsockopt$SO_PEERCRED(0xffffffffffffffff, 0xffff, 0x1022, &(0x7f0000000040)={0x0, 0x0}, 0xc) r2 = getegid() r3 = geteuid() r4 = socket$inet(0x2, 0xc007, 0x4) getsockopt$sock_cred(r4, 0xffff, 0x1022, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000100)={{0x8, r1, r2, r3, r5, 0x20, 0x8}, 0x1, 0x20, 0x42d}) mlockall(0x3) mlockall(0x1) madvise(&(0x7f0000ff0000/0x3000)=nil, 0x3000, 0x6) 23:08:30 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000f72000), 0x0) 23:08:30 executing program 0: pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000000140)=[{&(0x7f0000000240)=""/83, 0x53}], 0x1) dup(r0) close(r0) execve(0x0, 0x0, 0x0) write(r1, &(0x7f0000000200)='R', 0x1) login: lock order reversal: 1st 0xfffffd807f00c720 vmmaplk (&map->lock) @ /syzkaller/managers/setuid/kernel/sys/uvm/uvm_fault.c:1442 2nd 0xfffffd806cf64d60 inode (&ip->i_lock) @ /syzkaller/managers/setuid/kernel/sys/ufs/ufs/ufs_vnops.c:1547 lock order "&ip->i_lock"(rrwlock) -> "&map->lock"(rwlock) first seen at: #0 witness_checkorder+0x6d8 #1 _rw_enter+0xbf #2 vm_map_lock_ln+0x14e #3 uvm_map+0x2e2 #4 km_alloc+0x19a #5 pool_multi_alloc_ni+0xe4 #6 pool_p_alloc+0x70 #7 pool_do_get+0x127 #8 pool_get+0x104 #9 ufsdirhash_build+0x40b #10 ufs_lookup+0x2a5 #11 VOP_LOOKUP+0x63 #12 vfs_lookup+0x552 #13 namei+0x4af #14 start_init+0xd6 lock order "&map->lock"(rwlock) -> "&ip->i_lock"(rrwlock) first seen at: #0 witness_checkorder+0x6d8 #1 _rw_enter+0xbf #2 _rrw_enter+0x5c #3 VOP_LOCK+0x55 #4 vn_lock+0x6e #5 uvn_io+0x2ca #6 uvn_get+0x206 #7 uvm_fault+0x12c1 #8 uvm_fault_wire+0x70 #9 uvm_map_pageable_wire+0x2fd #10 sys_mlockall+0x69 #11 syscall+0x5a0 #12 Xsyscall+0x128 Stopped at db_enter+0x18: addq $0x8,%rsp ddb{1}> ddb{1}> set $lines = 0 ddb{1}> show panic the kernel did not panic ddb{1}> trace db_enter() at db_enter+0x18 witness_checkorder(825ba27fd32d0607,81,fffffd806cf64d50,fffffd806cf64d50,0) at witness_checkorder+0x12f9 _rw_enter(a5955e97306ebd8d,60b,fffffd806cf64d50,ffffffff81edebdf) at _rw_enter+0xbf _rrw_enter(d10d3642559f21b5,fffffd8078d39d50,ffffffff8139fd50,0) at _rrw_enter+0x5c VOP_LOCK(4b1a629b2a50b4a9,fffffd8078d39d50) at VOP_LOCK+0x55 vn_lock(33c371ee4ffb8a18,7000) at vn_lock+0x6e uvn_io(6f3bf4359f5d2c89,0,0,fffffd806dd514d0,6000) at uvn_io+0x2ca uvn_get(333d7690d9359c41,ffffffff8146c190,fffffd806dd514d0,fffffd806ccb9550,6000,3) at uvn_get+0x206 uvm_fault(6f3bf4359fa9d8df,1b2fd20000,ffffffffffffa000,3) at uvm_fault+0x12c1 uvm_fault_wire(3513001c4c7f74c1,3,1b2fd20000,fffffd806ccb9550) at uvm_fault_wire+0x70 uvm_map_pageable_wire(4b1a629b2a79713e,3,ffff800020bbabd0,35371a0c488,2,10f0) at uvm_map_pageable_wire+0x2fd sys_mlockall(1fe676f032f8738f,10,ffff800020bbabd0) at sys_mlockall+0x69 syscall(1d3992d4a847559b) at syscall+0x5a0 Xsyscall(6,0,ffffffffffffffa2,0,1,3515d11c010) at Xsyscall+0x128 end of kernel end trace frame: 0x35371a0c510, count: -14 ddb{1}> show registers rdi 0x3 rsi 0x3ffff acpi_pdirpa+0x2be67 rbp 0xffff800020c94820 rbx 0x3 rdx 0x40000 acpi_pdirpa+0x2be68 rcx 0xffff800002b4b000 rax 0xffff800001946840 r8 0xffffffff817c727f witness_checkorder+0x12cf r9 0x5 r10 0xe2c66d2b29ad24af r11 0x96a320c53a255f94 r12 0xfffffd80025cdc30 r13 0xffffffff81ebbd52 cmd0646_9_tim_udma+0xc96d r14 0xffffffff8227a980 w_lodata+0x50390 r15 0xffffffff82280440 w_lodata+0x55e50 rip 0xffffffff81107618 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff800020c94810 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor1) pid=422194 stat=onproc flags process=10 proc=4000000 pri=86, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff800020bba270,0xffffffff82300be0 process=0xffff800020b94d30 user=0xffff800020c90000, vmspace=0xfffffd807f00c708 estcpu=36, cpticks=5, pctcpu=0.0 user=0, sys=5, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 19555 498892 58925 32767 7 0x10 syz-executor1 *19555 422194 58925 32767 7 0x4000010 syz-executor1 96530 261980 0 0 3 0x14200 bored sosplice 59053 500024 56007 32767 3 0x10 biowait syz-executor0 56007 113099 70961 0 3 0x82 wait syz-executor0 58925 233875 5937 32767 3 0x90 nanosleep syz-executor1 5937 124209 70961 0 3 0x82 wait syz-executor1 70961 155114 3025 0 3 0x82 thrsleep syz-fuzzer 70961 114510 3025 0 3 0x4000082 nanosleep syz-fuzzer 70961 92446 3025 0 3 0x4000082 thrsleep syz-fuzzer 70961 208728 3025 0 3 0x4000082 thrsleep syz-fuzzer 70961 43238 3025 0 3 0x4000082 thrsleep syz-fuzzer 70961 215407 3025 0 3 0x4000082 kqread syz-fuzzer 70961 311256 3025 0 3 0x4000082 thrsleep syz-fuzzer 70961 196278 3025 0 3 0x4000082 thrsleep syz-fuzzer 70961 208150 3025 0 3 0x4000082 thrsleep syz-fuzzer 70961 412456 3025 0 3 0x4000082 thrsleep syz-fuzzer 3025 433211 31735 0 3 0x10008a pause ksh 31735 331775 16934 0 3 0x92 select sshd 4452 92651 1 0 3 0x100083 ttyin getty 16934 58313 1 0 3 0x80 select sshd 81197 49729 27648 73 2 0x100090 syslogd 27648 479772 1 0 3 0x100082 netio syslogd 11493 270267 1 77 3 0x100090 poll dhclient 62441 403784 1 0 3 0x80 poll dhclient 17409 201203 0 0 2 0x14200 zerothread 59609 503547 0 0 3 0x14200 aiodoned aiodoned 3393 467401 0 0 3 0x14200 syncer update 92865 224898 0 0 3 0x14200 cleaner cleaner 81440 433683 0 0 3 0x14200 reaper reaper 38684 241773 0 0 3 0x14200 pgdaemon pagedaemon 50034 324560 0 0 3 0x14200 bored crynlk 64741 396957 0 0 3 0x14200 bored crypto 79237 257577 0 0 3 0x40014200 acpi0 acpi0 37151 189602 0 0 3 0x40014200 idle1 45014 255520 0 0 3 0x14200 bored softnet 34833 371501 0 0 3 0x14200 bored systqmp 37690 502942 0 0 3 0x14200 bored systq 51145 181738 0 0 3 0x40014200 bored softclock 2065 309536 0 0 3 0x40014200 idle0 1 329319 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper