x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:20 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getpeername(r0, 0x0, 0x0) 15:20:20 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x80000000002c00) 15:20:20 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:20 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x101000, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f00000000c0)=""/39, &(0x7f0000000100)=0x27) ftruncate(r1, 0x1000000) sendfile(r0, r1, 0x0, 0xeefffdef) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f0000000100013070000000000000000fe8000000000000000000000000000aa6b0d47772941cda071b29dab862938e400000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f00000833a9d4086a9e9071200000000000000ffffffffffff00000000000000000000dd000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000"], 0xf0}}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/snapshot\x00', 0x30240, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) splice(r6, 0x0, r7, 0x0, 0x4ffe0, 0x0) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r5, 0x84, 0x74, &(0x7f0000000480)=""/224, &(0x7f0000000280)=0xe0) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$VIDIOC_S_MODULATOR(r4, 0x40445637, &(0x7f0000000200)={0x4, "9768ab06859ecd696ce565b3f763d3dbd628f6e390d3650674585e13d4c3b16d", 0x2, 0x5, 0xa9, 0x8, 0x1}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r3, 0x40106614, &(0x7f0000000140)) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:20 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:20:20 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:20 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @empty}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getpeername(r0, 0x0, 0x0) 15:20:21 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 748.940205][T26427] ptrace attach of "/root/syz-executor.5"[26424] was attempted by "/root/syz-executor.5"[26427] 15:20:21 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:21 executing program 0: 15:20:21 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:21 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) tkill(0x0, 0x33) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 15:20:21 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:21 executing program 0: 15:20:21 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) tkill(0x0, 0x33) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 15:20:21 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0xfeebd26a7b5c2ab8) ftruncate(r1, 0x1000000) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$security_capability(r1, &(0x7f0000000080)='security.capability\x00', &(0x7f0000000180)=@v3={0x3000000, [{0x400, 0x8}, {0x4, 0x80000001}], r2}, 0x18, 0x3) sendfile(r0, r1, 0x0, 0xeefffdef) r3 = accept$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000240)=0x1c) syncfs(r3) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) [ 749.453341][T26451] ptrace attach of "/root/syz-executor.5"[26450] was attempted by "/root/syz-executor.5"[26451] 15:20:22 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:20:22 executing program 0: 15:20:22 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000080)='\\vmndt0?\'`@{,vmnet1em0us\xd1\xaf\x8d\x96|\xe6x\xce\xef`J\xf8\xd7\x14\x00\xd6\xb4\x03@T+\xe5)\x03\x8c\xbdN\x8f\x02~i\x02\x00\x00\x00\x00\x00\x00\x00y{=!\x00\x002\x9e\xab+\x12b\x06\xf7\xae\xed\xc4\aahf\x14<\x06\n\x83\x10\x81\x84\xd8Q\x03\xf0j\x15\x84\xb8\xae\xe0\xa1\xa7\x96n\x1e\xf2\xfc\xea\x05\xa9\xc4\xf0\xe3\xf4^\x97\x19\x8b\xef\xc6D\xf7\x06\xf4\xfe\xb3\xfb\x8b\x834\x19!N\xf7\xc9\x02\t\x85\x02\x80\xefncY\xfc1\xa1N/\x83u>\x9c\x9f@\x94>-\xb8N\x10~`\x02;\xbcPD\xa3\xb2E\x1e\xee8\x00\x00\x00\x00\x00', 0x0) ftruncate(r1, 0x1000000) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) recvfrom$unix(r2, &(0x7f0000000300)=""/43, 0x2b, 0x12000, &(0x7f0000000480)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) pipe(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x1, 0x4, 0x2, 0x1, 0x44, 0xffffffffffffffff, 0x58, [], 0x0, r4, 0x4, 0x3, 0x5}, 0x40) syz_genetlink_get_family_id$smc(&(0x7f00000002c0)='SMC_PNETID\x00') socket$inet_dccp(0x2, 0x6, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in6=@dev={0xfe, 0x80, [], 0x16}, {0xfffffffffffffffc}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) sendfile(r5, r6, 0x0, 0x1000) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$EBT_SO_SET_COUNTERS(r7, 0x0, 0x81, &(0x7f0000000200)=ANY=[@ANYBLOB="62726f7574650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="e7ffffff000000000000000003000000"], @ANYBLOB='\x00'/40], 0x98) 15:20:22 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) tkill(0x0, 0x33) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 15:20:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:22 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:22 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:22 executing program 0: [ 750.453935][T26475] ptrace attach of "/root/syz-executor.5"[26474] was attempted by "/root/syz-executor.5"[26475] 15:20:22 executing program 0: 15:20:22 executing program 0: 15:20:22 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:22 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:23 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:20:23 executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000080)='/dev/nbd#\x00', 0x0, 0x0) getpid() r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42000) r2 = socket(0x0, 0x1, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, r2) ioctl$NBD_DO_IT(r0, 0xab03) ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x8e0f) syz_open_dev$ndb(0x0, 0x0, 0x30) 15:20:23 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:23 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:23 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:23 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) setsockopt$netrom_NETROM_T2(r2, 0x103, 0x2, &(0x7f0000000140)=0xb8a9, 0x4) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) getpeername$unix(r2, &(0x7f0000000080), &(0x7f0000000100)=0x6e) ftruncate(r1, 0x1000000) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:23 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:24 executing program 3: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:24 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:24 executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000080)='/dev/nbd#\x00', 0x0, 0x0) prlimit64(0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) getpid() r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42000) r2 = socket(0x2, 0x1, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, r2) ioctl$NBD_DO_IT(r0, 0xab03) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x8e0f) syz_open_dev$ndb(0x0, 0x0, 0x30) 15:20:24 executing program 3: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 751.953160][T26524] ptrace attach of "/root/syz-executor.3"[26523] was attempted by "/root/syz-executor.3"[26524] 15:20:24 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 752.074061][T26532] ptrace attach of "/root/syz-executor.3"[26531] was attempted by "/root/syz-executor.3"[26532] [ 752.244587][T10522] block nbd0: Receive control failed (result -107) [ 752.293175][T26529] block nbd0: shutting down sockets [ 752.383920][T10522] block nbd0: Receive control failed (result -107) [ 752.384575][T26541] block nbd0: shutting down sockets 15:20:25 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:20:25 executing program 3: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:25 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:25 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:25 executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000080)='/dev/nbd#\x00', 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) getpid() r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42000) r2 = socket(0x2, 0x1, 0x0) ioctl$NBD_SET_SOCK(r0, 0xab00, r2) ioctl$NBD_DO_IT(r0, 0xab03) r3 = openat$nvram(0xffffffffffffff9c, 0x0, 0x40082, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(0xffffffffffffffff, &(0x7f0000001340)=[{0x0}], 0x1, 0x0) close(0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x100004800, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x8e0f) syz_open_dev$ndb(0x0, 0x0, 0x30) 15:20:25 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0x1000000) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) r4 = openat$cgroup_ro(r2, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r7}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) sendmsg$xdp(r4, &(0x7f0000000140)={&(0x7f00000000c0)={0x2c, 0x2, r7, 0x12}, 0x10, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x8040}, 0x801) 15:20:25 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:25 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 753.228876][T26556] ptrace attach of "/root/syz-executor.3"[26551] was attempted by "/root/syz-executor.3"[26556] [ 753.250771][T10522] block nbd0: Receive control failed (result -107) 15:20:25 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 753.311988][T26546] block nbd0: shutting down sockets 15:20:25 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:25 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRESOCT, @ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad38", @ANYPTR], 0x0, 0x156}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:25 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:26 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r1) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r2, r3, 0x0, 0x800000080004103) 15:20:26 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:26 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:26 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:26 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x1) ftruncate(r1, 0x1000000) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:26 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:26 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280), 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:26 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:26 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:26 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:28 executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x882, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000000)) writev(r1, &(0x7f0000000740)=[{&(0x7f0000000500)="939fdd1cb47e3eb80c0e5aa0a6569addb31ad1bed26358b1b7ec550989696955099a260b9a16cec4a2f6893a5eb345f3ef3ea7cb3055dc14647f98e96fac57c58ac9ce2dd52d3311f2afb05a626e9ba3a3cccf1e666601084430e6153bee2f2992110dcdad5f4bc5979c631b736b34400d99d1520179dc2e95f6290749aa315a297b745cd2bb6ac40b5956537acc988596cd9302e16395b9bba7f7a6e9f758fc8f8c52e3dbd84f7cc2c7f6f71f259a3b9202d3d80994f62fa28c480fea272c57", 0xc0}], 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) dup3(r0, r1, 0x0) 15:20:28 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:28 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:28 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:28 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0x1000000) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(r3, 0x0, r4, 0x0, 0x4ffe0, 0x0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000080)={0x90, '5{V'}, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f0000000050000000000000000000000fe8000000000000000000000000000aae000000200000000000000000000000000000000000000000a0000a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) sendfile(r2, r0, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:28 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r1) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r2, r3, 0x0, 0x800000080004103) 15:20:28 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:28 executing program 4: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x3, 0x2) r1 = memfd_create(&(0x7f0000000080)='\\ve`\x00mmA\xcf\xe70us', 0x0) ftruncate(r1, 0x1000000) sendfile(r0, r1, 0x0, 0xeefffdef) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sysvipc/sem\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={r3, 0x5, 0x6, r4}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f0000000040)={0x7, 0x0, 0x0, 0x4000}) 15:20:28 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:28 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:28 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:29 executing program 0: dup(0xffffffffffffffff) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x882, 0x0) ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000000)) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000240)="939fdd1cb47e3eb80c0e5ab7ec55099a260b9a16cec4a2f6893a5eb345f3ef3ea7cb3055dc14647f98e96fac57c5d1dbac6e2b83c213e9685d54bd148e336279", 0x40}, {&(0x7f0000000100)='f', 0x1}], 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, 0x0, 0x0) dup3(r0, r1, 0x0) 15:20:29 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:29 executing program 0: 15:20:29 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:29 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:29 executing program 0: 15:20:30 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r1) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r2, r3, 0x0, 0x800000080004103) 15:20:30 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:30 executing program 0: 15:20:30 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) ftruncate(r2, 0x5) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000680)=[@in={0x2, 0x0, @rand_addr=0x40}]}, &(0x7f0000000180)=0x10) r6 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r5, 0x84, 0x6d, &(0x7f0000000000)={r7, @in={{0x2, 0x0, @loopback}}}, &(0x7f0000000100)=0x59) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000000100)={r7, 0x19, "1db49ce551b8ded4b4a5cbb98ca46535eb53b671e12840abe8"}, &(0x7f0000000140)=0x21) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000200)={r8, 0x3}, &(0x7f0000000240)=0x8) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4800}) 15:20:30 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:32 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:32 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:32 executing program 0: 15:20:32 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:32 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0xa03) sendfile(r0, r1, 0x0, 0xeefffdef) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x100) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r2, 0xc10c5541, &(0x7f0000000200)={0x80000000, 0xfffffffe, 0x1}) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:32 executing program 2: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:20:32 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:32 executing program 0: 15:20:32 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:32 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0x1000000) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f0000000100013070000000000000000fe8000000000000000000000000000aae000000200000000000000000000000000000000000000000a0000a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff00000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r3, 0xc0406618, &(0x7f0000000140)={{0x2, 0x0, @reserved="2850819f9e333b4d62db5e27b476fa3c8e59bbd50d61627680345b70551e8494"}}) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@rand_addr=0x3, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) fsetxattr$trusted_overlay_redirect(r4, &(0x7f00000000c0)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x3) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000940)=ANY=[@ANYBLOB="f000000010001307000000000000000000000004000000000000000000000000e000000200000000000000000000000000000000000000000a0000a0000000004bc6e0fc87951aa618dc6089a948897f31a71eefa66e151b0ef145b823165d71b26576cf499d62417a33b55d207922620f9a0a9b2d6df192ae39aba32bd9dde6f231740b02", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) r7 = syz_open_dev$vbi(&(0x7f0000000600)='/dev/vbi#\x00', 0x3, 0x2) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000900)={0xf0, 0x0, &(0x7f00000007c0)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000240)={@fda={0x66646185, 0x3, 0x1, 0x22}, @flat=@weak_binder={0x77622a85, 0x100b}, @fd={0x66642a85, 0x0, r5}}, &(0x7f00000002c0)={0x0, 0x20, 0x38}}, 0x1000}, @acquire={0x40046305, 0x2}, @enter_looper, @increfs={0x40046304, 0x2}, @reply_sg={0x40486312, {0xbe, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000580)={@flat=@weak_binder={0x77622a85, 0x1, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000480)=""/237, 0xed, 0x2, 0x29}, @flat=@weak_handle}, &(0x7f0000000300)={0x0, 0x18, 0x40}}, 0x40}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000700)={@fd={0x66642a85, 0x0, r6}, @fd={0x66642a85, 0x0, r7}, @ptr={0x70742a85, 0x0, &(0x7f0000000640)=""/180, 0xb4, 0x0, 0x31}}, &(0x7f0000000780)={0x0, 0x18, 0x30}}}], 0x36, 0x0, &(0x7f00000008c0)="8f10a3456e8733998383512173657e2c643ff5508bf0fa8d2ecd0a8ce63b10b06782da4584b02188f706a0b97f67bef2bc8098bea4a4"}) ioctl$sock_inet_SIOCSIFPFLAGS(r2, 0x8934, &(0x7f0000000080)={'team_slave_1\x00'}) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:32 executing program 0: 15:20:32 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:35 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:35 executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r2}, 0x18) sendmsg$can_j1939(r0, &(0x7f0000000080)={&(0x7f0000000b40)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2}}, 0x18, &(0x7f0000000b80)={&(0x7f0000000000)='*', 0x11de1}}, 0x0) 15:20:35 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:35 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:35 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0x1000000) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x200000, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(r3, 0x0, r4, 0x0, 0x4ffe0, 0x0) ioctl$VIDIOC_G_FBUF(r3, 0x8030560a, &(0x7f0000000200)={0x4, 0x1, &(0x7f0000000100)="1779bbdad68a9d44318c0c4bd7cdb337832a68084ca39ca15970880a13d78abb31cebd0fd71d7258ddc55bdd604685b8283df22b00c511909bd79112956e656d995c05b09b644788a75464972ae93d186bc011687703961b3747b9ad45662d425a4cc167418b7a042671dfd2f0d8346b0fa4b9df403dd22086e7065f875c9a1b426196dae085e1c1b467d6342150d6f6b7bc822a6ea757734e2958", {0x7, 0x4, 0x4745504d, 0x2, 0x64c, 0x7fffffff, 0x9, 0x1000}}) ioctl$IMCTRLREQ(r2, 0x80044945, &(0x7f00000000c0)={0x4000, 0x8000, 0x80, 0x13f5}) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:35 executing program 2: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:20:35 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:35 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:35 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:36 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000200)='\\vmn\x06\x1dZ4\xf8R\xd8\x82\xb4\x97\xcet0?\'`C\xbd,vmneD\xff\xff\x81\x9b\xd6\x0e\xb0^\x01\xde\x93\x02p1dm0us\xe8n)\x1e&\x1a\x80\xba\xa9(\xa7\xeb\x03\xfe-j\xc8]\x17U\x12!\x9c\xd8\x90f\xab\xf4\xad\x12\xa1\xaf\x11\x9b\xa5S!Wdv\x15\x95YP\xaf\xd3\xa1\xfc\x00;\xb9\xe6\xc7\xae\xa4\x03\xef\x81\xbf\x8dM\x1c\x9c\xe9\x8e\xcbs\x85\x1bp\xdf\xc5\xaaN\v\x17G\xeam\xdb\xca\x1b{\xbeY\x04\xe0\xed\xbd\xedAj@\xba\xdd\xbf\xd6Y\xb3\x16\xdf2\x84~\xc23\x95\xca2\x1ez\x9d.=\x01\xb5>(\x06\xd5)\xc8.X\xd0h\xa3-\\\xc9FS\xdeM&\xc1\xd8)\x12Y\xc1\xb3p\x0e\x14\x82\xc4\x92\'\xc2\xd9/n8', 0x0) ftruncate(r1, 0x1000000) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x2, 0x3, 0x20000, 0x3, 0x4}) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000080)={0x400, 0x2, 0x1}) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:36 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:36 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) [ 764.313829][ C0] vcan0: j1939_tp_rxtimer: 0x000000008866430a: rx timeout, send abort [ 764.314037][ C0] vcan0: j1939_xtp_rx_abort_one: 0x000000008866430a: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 765.567318][ C0] vcan0: j1939_tp_rxtimer: 0x000000009bfa252a: rx timeout, send abort [ 765.575895][ C0] vcan0: j1939_xtp_rx_abort_one: 0x000000009bfa252a: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. 15:20:38 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:38 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:38 executing program 2: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:20:38 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0x1000000) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x9, 0x6, 0x8, 0x0, 0xae6}, 0x14) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:38 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:38 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:38 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:38 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:38 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:39 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:39 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0x1000000) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f0000000080)={0x3, 0x1, 0x1, 0x0, 0x0, 0x9, 0x5}) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_G_SLICED_VBI_CAP(r0, 0xc0745645, &(0x7f00000000c0)={0x5, [0x2, 0xd8, 0x9, 0xf7f5, 0x9, 0xffff, 0x7, 0x5, 0x1, 0x5, 0x5, 0x1000, 0x0, 0x7, 0xed6, 0x5, 0xdea, 0x8, 0xda, 0x2, 0x9, 0xfffd, 0x0, 0x6, 0x33, 0x401, 0x1, 0x80, 0x6, 0x8, 0x1, 0x2, 0x7, 0xffff, 0x7, 0x5, 0x39be, 0x6, 0x6, 0x40, 0xfff, 0x6, 0x0, 0x2, 0x8000, 0xa0, 0x1f], 0x4}) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:39 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:41 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:41 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:41 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:41 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:41 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:20:41 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0x1000000) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$CAIFSO_LINK_SELECT(r2, 0x116, 0x7f, &(0x7f0000000080)=0x1, 0x4) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(r3, 0x0, r4, 0x0, 0x4ffe0, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000100)={{0xa, 0x4e24, 0x7fffffff, @rand_addr="bf651d7bcd43035b51bcb40081a40f3c", 0x10}, {0xa, 0x4e22, 0xfffffffe, @loopback, 0x10000}, 0x6, [0x6, 0x9, 0x7, 0xf, 0x9, 0x2, 0x7fff, 0xbe60]}, 0x5c) 15:20:41 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:41 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:41 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:41 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:42 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = dup(r1) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)={0x50, 0x1404, 0x2, 0x70bd25, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x200040c0}, 0x804) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000003c0)=0x0) r5 = getpid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r5, 0x0, 0x0) rt_tgsigqueueinfo(r4, r5, 0x37, &(0x7f0000000400)={0x2a, 0x1, 0x3f}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f0000000080)="4171b0f342a7c39135b794f8f160ae271865988ff4f6066b53819a4b599ac35357fd9e974e3f50699d178883f9baa62c236eb0ab060297fbd45b0a2f0a652d9f8a46e4303a7a4fb01b7be41bcfc54ddc6e058807fd26") pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$VIDIOC_DBG_G_CHIP_INFO(r6, 0xc0c85666, &(0x7f0000000200)={{0x3, @addr=0x5}, "91292a1e2204e99a3d1a402f741c4de97b6183af9f5c2421ee8d60dfe44e16d2", 0x1}) r7 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r7, 0x1000000) sendfile(r0, r7, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0xa, 0x1, 0x0, 0x4000}) write$P9_RAUTH(r6, &(0x7f0000000100)={0x14, 0x67, 0x2, {0x0, 0x4, 0x1}}, 0x14) 15:20:42 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:44 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:44 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:44 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:44 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:44 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:20:44 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0x1000000) sendfile(r0, r1, 0x0, 0xecfffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:44 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:44 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:45 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:45 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:20:45 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:45 executing program 4: r0 = memfd_create(&(0x7f0000000080)='\\vmnep0?\x8c\x91\x86\xf6Zn\x91\xc5R\xc6\xfbL\x93`\xf21\xb2\xfe~\xe5\x00\x00\x00\x00\x04\x00\x04\x00\x00\x00\x00ne\x00\x00', 0x0) ftruncate(r0, 0x1000000) sendfile(0xffffffffffffffff, r0, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4000}) 15:20:45 executing program 4: r0 = syz_open_dev$vbi(&(0x7f00000001c0)='/dev/vbi#\x00', 0x1, 0x2) r1 = memfd_create(&(0x7f0000000000)='\\vmnet0?\'`@{,vmnet1em0user\x00', 0x0) ftruncate(r1, 0x1000000) sendfile(r0, r1, 0x0, 0xeefffdef) ioctl$VIDIOC_EXPBUF(r0, 0xc0405610, &(0x7f0000000040)={0x3, 0x4, 0x0, 0x4000}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000080)=0x9, 0x4) 15:20:45 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x80000000002c00) 15:20:47 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:47 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:20:47 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) dup(r3) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:47 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x80000000002c00) 15:20:47 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:20:47 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000000000009104"]) 15:20:47 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe847a071") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'rmd128\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000680), 0x4924924924925c6, 0x0) 15:20:47 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x80000000002c00) 15:20:47 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe847a071") r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt(r1, 0xff, 0x1, &(0x7f0000000080)="17", 0x1) 15:20:48 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0) chdir(&(0x7f0000000240)='./file0\x00') r0 = creat(&(0x7f0000000300)='./bus\x00', 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, [], [{0x0, 0x0, 0x0, 0x0, 0x2}]}) 15:20:48 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x0) 15:20:48 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x0) 15:20:50 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:50 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x0) 15:20:50 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x0) 15:20:50 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) dup(r3) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:50 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x2812, r0, 0x0) r1 = clone3(&(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1081}, r1, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 15:20:50 executing program 2: socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:20:50 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f0000000600)=@raw={'raw\x00', 0x2, 0x3, 0x288, 0x0, 0x0, 0xf8, 0xf8, 0xf8, 0x1f0, 0x1f0, 0x1f0, 0x1f0, 0x1f0, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x48], 0x0, 0x98, 0xf8, 0x0, {}, [@common=@unspec=@addrtype1={{0x28, 'addrtype\x00'}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, {0xffffffffffffffff}}}}, {{@ip={@remote, @loopback, 0x0, 0x0, '\x00', 'rose0\x00'}, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@SET={0x60, 'SET\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2e8) 15:20:50 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x3800) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, 0x0, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr="ff3e6808e90000008060e400"}, 0x1c) sendmmsg(r1, &(0x7f0000006d00)=[{{0x0, 0x1000000, 0x0}}], 0xc6, 0x24000000) [ 778.664066][T26992] SET target dimension over the limit! 15:20:50 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x0) 15:20:50 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) sendmmsg(r0, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) [ 778.784275][T26992] SET target dimension over the limit! 15:20:51 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x0) 15:20:51 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) dup(r3) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:53 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:53 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:20:53 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r2, &(0x7f0000000100)={{0x1b, 0x5b, 0x34, 0x39, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x106d, 0x40}, [{}]}, 0x78) 15:20:53 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:53 executing program 1: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f00000001c0)={@val, @void, @eth={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x6, 0x0, @multicast1, @broadcast}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}, {']'}}}}}}}, 0x3b) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) 15:20:53 executing program 2: socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:20:53 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 781.638400][T27038] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:20:53 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r2, 0x0) pkey_mprotect(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x6, 0xffffffffffffffff) 15:20:54 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) write(r1, &(0x7f0000000340), 0x41395527) fcntl$getflags(0xffffffffffffffff, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9, 0x5}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4, 0x0, 0x0, 0x9}, &(0x7f0000000080)={0x0, r3+30000000}, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 15:20:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 781.882402][ T27] audit: type=1804 audit(1585840854.065:203): pid=27047 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="bus" dev="sda1" ino=16754 res=1 [ 781.887251][ T27] audit: type=1804 audit(1585840854.065:204): pid=27047 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="bus" dev="sda1" ino=16754 res=1 [ 781.888402][ T27] audit: type=1804 audit(1585840854.065:205): pid=27048 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="bus" dev="sda1" ino=16754 res=1 15:20:54 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:20:56 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:56 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:20:56 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:56 executing program 5: syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000240)="0300050000000100001400000000000000006300edffffffffffffff050000000000420000000008000000000000000000003f000000000000000047000055aa", 0x40, 0x1c0}]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 15:20:56 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r2, 0x0, r5) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000500)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980200009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f73653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000003000000070000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) write$tun(r0, &(0x7f0000000200)={@void, @val={0x3}, @mpls={[], @ipv4=@dccp={{0x6, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x84, 0x0, @remote, @rand_addr=0xfffffff8, {[@ssrr={0x89, 0x3}]}}, {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, '\a\x00`'}}}}}, 0x32) 15:20:56 executing program 2: socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:20:56 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 784.669943][T27070] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables [ 784.731260][T27072] ldm_validate_privheads(): Disk read failed. 15:20:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:20:57 executing program 5: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f00000001c0)={@val, @void, @eth={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x6, 0x0, @multicast1, @broadcast}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}, {']'}}}}}}}, 0x3b) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 784.752184][T27072] loop5: p2 p4 [ 784.752255][T27072] loop5: partition table partially beyond EOD, truncated [ 784.758956][T27072] loop5: p2 start 4294967295 is beyond EOD, truncated [ 784.758972][T27072] loop5: p4 size 18176 extends beyond EOD, truncated 15:20:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:20:57 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 784.950076][T27072] ldm_validate_privheads(): Disk read failed. [ 784.950133][T27072] loop5: p2 p4 [ 784.950156][T27072] loop5: partition table partially beyond EOD, truncated [ 784.950390][T27072] loop5: p2 start 4294967295 is beyond EOD, truncated [ 784.950405][T27072] loop5: p4 size 18176 extends beyond EOD, truncated [ 785.082000][ T9707] __loop_clr_fd: partition scan of loop5 failed (rc=-16) [ 785.083786][T27092] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 15:20:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 785.084039][ T2623] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 785.084229][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.087861][ T2623] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 785.087878][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.088018][ T2623] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 785.088033][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.088179][ T2623] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 785.088194][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.088330][ T2623] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 785.088346][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.088482][ T2623] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 785.088497][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.088629][ T2623] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 785.088644][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.088944][ T2623] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 785.088959][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.089103][ T2623] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 785.089118][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.090081][ T2623] Buffer I/O error on dev loop5p4, logical block 0, async page read [ 785.356987][T27104] overlayfs: failed to resolve './file0': -2 [ 785.646239][T27114] overlayfs: failed to resolve './file0': -2 [ 787.213104][ T0] NOHZ: local_softirq_pending 08 15:20:59 executing program 5: r0 = socket(0x10, 0x800000000080003, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x13e, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="200000006a000308001f6ae6bf020000010000000000000008000100b1320a2d8ae87d184a737c7c8ab79e6da8fb412fa3680d2f87c6b9484bb678238859f6e3afe75370d15c6e7fe69580a09e6444015afdbe0ded64781d736246d1a588b2178fca1d8ce6243ec17a9b8bfee85e4c0582b53e2ede34cc419e19752dc80e5512a58d1ebf4e52778a359d5c749419f756ac03eb338a103fa192eb154ca9251d14badc4948fccf40e25f8c87f82e2d8491587cacc21fdcffd455db342d4a18949326a6faa63a719eb83c40ca76ac813cc5994431ae948ec112f1d08b71731b35dfad16ec946c310a57baf91c1e322281a3440020d06398c544045a67a108f4ee22e0996f27417dc862d574b33db1293ece8dbe4faf4b8a72c64d215155d23d38fc42ca91181ceaa0419a8776539fe5211c78ab75c345425169850ed2aef429470181f83fc146ebe46530be763c7ad166f476b6cdb20eaaaeeee62ceac8926c0000e69435ab974bd7f70c494cb457c09856009e8caff5cfdf5d0d4ed591258a19c7585c19c7795171a60c09b36f4fd42213451d95786526e18506c86454f8dd14866b46bd8d414e0056ac000000000000000000", @ANYRES32=0x0], 0x20}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0xd2efff7f00000000, &(0x7f0000000100), 0xa, &(0x7f0000000100)}], 0x492492492492805, 0x0) 15:20:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:20:59 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:20:59 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:20:59 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:20:59 executing program 1: r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 15:20:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180)='batadv\x00') sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)={0x24, r3, 0xf, 0x0, 0x0, {0xf}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x24}}, 0x0) [ 787.759325][T27126] overlayfs: failed to resolve './file0': -2 15:21:00 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0x6b) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x3c1, 0x3, 0x420, 0x0, 0x280, 0x0, 0x0, 0x0, 0x350, 0x350, 0x350, 0x350, 0x350, 0x3, 0x0, {[{{@ipv6={@remote, @mcast2, [], [], 'veth1_to_bond\x00', 'netpci0\x00'}, 0x0, 0x250, 0x280, 0x0, {}, [@common=@inet=@hashlimit2={{0x150, 'hashlimit\x00'}, {'team_slave_1\x00', {0x0, 0x4, 0x0, 0x0, 0x0, 0x1ab618fe, 0x800}}}, @common=@inet=@hashlimit1={{0x58, 'hashlimit\x00'}, {'syzkaller1\x00', {0x0, 0x0, 0x4, 0x0, 0x0, 0x5, 0xa6}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x480) syz_emit_ethernet(0x6a, &(0x7f0000000580)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "289200", 0x34, 0x6, 0x0, @dev, @mcast2, {[@fragment, @srh={0x0, 0x0, 0x4, 0x0, 0xdd}], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}, @mptcp=@add_addr={0x1e, 0xa, 0x0, 0xa, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}}}}}}}}, 0x0) 15:21:00 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:00 executing program 1: r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x11, 0x2, 0x0) bind(r1, &(0x7f0000000140)=@generic={0x11, "00000100000000000800449420eba71a4976e252922cb18f6e2e2aba000100012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b080000000049740000000000000025ad8e5ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0}, &(0x7f0000000340)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000002e000100004952000000000000000000", @ANYRES32=r2, @ANYBLOB="000000000000000000000600"], 0x24}}, 0x0) 15:21:00 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:00 executing program 1: pipe(&(0x7f0000000280)) r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)="2c0271ca8b080aae3300bfa4def38003c21c104094", 0xfd5c}], 0x1}, 0xc100) sendmsg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000700)="b10b938636ea69df7b5a9984bb1bc72ef58d96e56e11df900a707f4946b1637e2096c584b9a1b4e017163fbdb35160a56c11dfbe74df97d36d19ad6a91c6fb4ad19581b8cf707131830f7a22b1b263c9da0e44115e969ed6a0d3bc508bf75c3147447379f585759ceba0de5cda46291dc1b8f106a83e1cde43a862d95413ce2616b261ed9f79913ae781b3b843ea1b4429a750b8ccb1952a7b863d0bada9f61df6609fe368eaf47c0ce9e46a22b0d75b063deeaa94285d0c43353046e0a308296a76b0b0145f8af9aa0ed0e18bc50509eaef21c8e03842a97df3a462ea3f9d5f83bf1d4d2875f0d5b24e941483f863cd2ea7c769bd3e594fb173dd873c7d9a3fd20939ad1d5867881ed77a078007b4972aba36cae02004373a6a74d74cb15a52c5f8426cb6f235d38048fd91f5d6100fd58a335df10add227d804167ba191c7a035c5a2a916e7fef18a6003578820b3e0be26a22f2c149f40a0335cadcca64a5e44179e6ce4d7f7c16e8a96c5be7cdf66eef901cb8eeabc94bae30acca8c6fa02889c32311044dcbc9a2e02e0632f7f9aa96849abede543773745e4652fccc503003f10cd68ddab594969ad36cb622ed7ba22dc46a80fb63ac2c561a80ae5c10b295b9f75d9536ba1ac24b8e9ae217611ffe79cb9422158475c1a89a51547d13c03b68d75ffb5717a35f381774567871e9e4190272c97eafcfa0a07a751d0bc8eeb0c206e12b2cff1065a3d5622635fa44c0dcb0722ad4c97e6b7d5844b2e9bab9ba1d083fa2930a3ea267d7f15d817e2b2e055ccfbaf019292f6156efd3a9a13ea90ecf59fc1bf35c6626db1c6759a50ed84acefd3cdb3532da1f23a262055223e7a3a62f15eeb8060dc9cfa30e6783757ae2f0ac6ed75d3212591ccd", 0x27d}], 0x1}, 0x0) [ 788.041913][T27143] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING 15:21:00 executing program 5: 15:21:03 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:03 executing program 5: 15:21:03 executing program 1: 15:21:03 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:03 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:03 executing program 5: 15:21:03 executing program 1: 15:21:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:03 executing program 1: 15:21:03 executing program 5: 15:21:03 executing program 1: 15:21:06 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f", 0x1}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:06 executing program 5: 15:21:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:06 executing program 1: 15:21:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:06 executing program 1: 15:21:06 executing program 5: 15:21:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:06 executing program 5: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB="740000002400fbc700"/20, @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000080001007366710048000229c6090032d0ed64f3000000000032a0433c9d675ddc06dc890c0000000000000000000000000000000000000000000065a83b968368a3fc39c3a279d400000000000000000000000000000000000000000000000000000000000000000000004000687d9d747d065a6bfdaec4bca63df79386026dfded7903683a7a9ac26c"], 0x74}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000c00)=ANY=[@ANYBLOB="840000002c0001cdd63fe14b3b3d120000000000", @ANYRES32=r3, @ANYBLOB="0008008000000000030000000800010075333200580002001400050000000000000000000000000000000000400006003c0001000000000000000820898dde66057433b6ef3a41d22be225e0001b00000000000000000000000009000000000084e1a912c5998bcbf050000000000000798a3c067277da1a290b9613a33c575c36fad473382c8f5532ef0180000000000000bf3431a69f9b2ecb3291bed174245a962fe0484676958265e2988326a89851139d91fe4aee6ae7e745abdfc21a9f61f2035979c1e3e9fea5b3958bc14fce6e66a36d1ab3194534ba4e973684b27793bff837d3296fcb1d5e0f4d279bbe8edc2772e2452d2381fee71b69ea21849e4258021ab98803ae2d5637e7334470cd1f53defdc31b5461f1187c654480288aeeee932561a5aebf0dcd9310d5c7e3c07cd9724e67cfed14f3db615bbafc0c8c4732be0edcf95891dafe1011b6792aca94545f19c6a3834c41cb3c05283ebf5cacff00000000000000000000000000cc1e819620e000bda15123e9f200accc3f567855b1d091d1f228f8ab93f12d41e1f2bd1449269db17d07624798da0b210bd9cb218d1e6d3482f326d8654847cbef34971af2dd6b6c2fac3d3f7ceb040a9923b7cfff2bd93c2574e9"], 0x84}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0xfffffffffffffc72, 0x0) 15:21:06 executing program 1: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timerfd_create(0x8, 0x0) ioctl$KDSKBMETA(0xffffffffffffffff, 0x4b63, 0x0) 15:21:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:09 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f", 0x1}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:09 executing program 4: mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:09 executing program 1: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0185649, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) perf_event_open(&(0x7f000001d000)={0x1, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000001840)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r2}, 0x18) sendmsg$can_j1939(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x1d, 0x0, 0x0, {}, 0xfe}, 0x20000058, &(0x7f0000000080)={&(0x7f00000000c0)='4', 0x6fffff9}}, 0xee) 15:21:09 executing program 5: r0 = syz_open_dev$video(&(0x7f0000000340)='/dev/video#\x00', 0x7, 0x0) r1 = dup(r0) ioctl$VIDIOC_G_CROP(r1, 0xc014563b, &(0x7f0000000000)={0xa}) 15:21:09 executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:09 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:09 executing program 4: mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:09 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/5, 0x5}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x40042) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x16, 0x0, 0x0, 0x800e00849) shutdown(r1, 0x0) shutdown(0xffffffffffffffff, 0x0) r3 = socket(0x2, 0x1, 0x0) r4 = dup(r3) listen(r4, 0x0) accept$unix(r4, 0x0, 0x0) shutdown(r2, 0x0) [ 797.095393][T27219] overlayfs: failed to resolve './file1': -2 15:21:09 executing program 4: mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 797.242553][T27231] overlayfs: failed to resolve './file1': -2 15:21:09 executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:09 executing program 4: mkdir(0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 797.412231][T27237] overlayfs: failed to resolve './file1': -2 15:21:09 executing program 4: mkdir(0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 797.605891][T27243] overlayfs: failed to resolve './file1': -2 [ 797.721057][T27246] overlayfs: failed to resolve './file1': -2 [ 798.300769][ C1] vcan0: j1939_tp_rxtimer: 0x00000000576756b8: rx timeout, send abort [ 798.300945][ C1] vcan0: j1939_xtp_rx_abort_one: 0x00000000576756b8: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 799.560930][ C0] vcan0: j1939_tp_rxtimer: 0x0000000086bb9458: rx timeout, send abort [ 799.569352][ C0] vcan0: j1939_xtp_rx_abort_one: 0x0000000086bb9458: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. 15:21:12 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f", 0x1}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:12 executing program 4: mkdir(0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:12 executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:12 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:21:12 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:12 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:21:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 800.197407][T27260] overlayfs: failed to resolve './file1': -2 15:21:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:12 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000200)=r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:12 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000200)=r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:12 executing program 5: r0 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r0, 0x8914, &(0x7f0000000000)={'hsr0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r1, 0x8914, &(0x7f0000000000)={'hsr0\x00', 0x5dd}) [ 800.874517][T27283] device hsr0 entered promiscuous mode [ 800.931381][T27283] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 15:21:15 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:15 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:21:15 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000200)=r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:15 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(0x0, 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:15 executing program 5: r0 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r0, 0x8914, &(0x7f0000000000)={'hsr0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r1, 0x8914, &(0x7f0000000000)={'hsr0\x00', 0x5dd}) 15:21:15 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) [ 803.225029][T27289] device hsr0 left promiscuous mode 15:21:15 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(0x0, 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:15 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)=r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:15 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(0x0, 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 803.506688][T27297] device hsr0 entered promiscuous mode [ 803.544557][T27297] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 15:21:15 executing program 5: r0 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r0, 0x8914, &(0x7f0000000000)={'hsr0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r1, 0x8914, &(0x7f0000000000)={'hsr0\x00', 0x5dd}) 15:21:16 executing program 1: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10400, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:21:16 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0x0, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 803.842417][T27312] device hsr0 left promiscuous mode [ 804.083055][T27315] device hsr0 entered promiscuous mode [ 804.090735][T27315] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 15:21:18 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0x0, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:18 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)=r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:18 executing program 5: r0 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r0, 0x8914, &(0x7f0000000000)={'hsr0\x00'}) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r1, 0x8914, &(0x7f0000000000)={'hsr0\x00', 0x5dd}) 15:21:18 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) dup2(r2, r1) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x82, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000680)=[@in={0x2, 0x0, @rand_addr=0x40}]}, &(0x7f0000000180)=0x10) r5 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x6d, &(0x7f0000000000)={r6, @in={{0x2, 0x0, @loopback}}}, &(0x7f0000000100)=0x59) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000080)={r6, 0xf43d}, 0x8) write$cgroup_int(r0, &(0x7f00000002c0), 0xfffffedd) 15:21:18 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:21:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0x0, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 806.362267][T27328] device hsr0 left promiscuous mode 15:21:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:19 executing program 5: r0 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r0, 0x8914, &(0x7f0000000000)={'hsr0\x00'}) gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x11, 0x3, 0x0) ioctl$SIOCSIFMTU(r1, 0x8914, &(0x7f0000000000)={'hsr0\x00', 0x5dd}) [ 806.671965][T27335] device hsr0 entered promiscuous mode [ 806.702205][T27335] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 15:21:19 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 806.923968][T27344] device hsr0 left promiscuous mode [ 806.970304][T27346] overlayfs: failed to resolve './file0': -2 15:21:19 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 807.125423][T27350] overlayfs: failed to resolve './file0': -2 15:21:19 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)=r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 807.216444][T27347] device hsr0 entered promiscuous mode [ 807.238665][T27347] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 807.324633][T27353] overlayfs: failed to resolve './file0': -2 15:21:21 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:21 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f0000000100013070000000000000000fe8000000000000000000000000000aae000000200000000000000000000000000000000000000000a0000a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) splice(r3, &(0x7f0000000100)=0x7f, r4, &(0x7f0000000140)=0x8, 0x3f, 0x4) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) ioctl$SOUND_MIXER_INFO(r1, 0x805c4d65, &(0x7f0000000040)) write$cgroup_int(r0, &(0x7f00000002c0), 0xfffffedd) 15:21:21 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:21 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x8, 0x2010, r1, 0x69905000) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0), 0xfffffedd) 15:21:21 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:21 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:21:21 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:21 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:21 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:22 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:22 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:22 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x100000001, 0x1, &(0x7f0000000200)=[{&(0x7f0000000100)="7cc15d91e2578e81a648d44f71e9d6d75500a1d03cf6e6927b6b991d942f784f6abdca31efd81d1ea3567e466e7e02fb0dfa3557bb57210bc726b9039f6c3913636cd8a7b1978883ccbf7321494b0facaaaf829e3b79a3bdf58b9ffa", 0x5c, 0x3fff8000}], 0x28000, &(0x7f0000000300)={[{@nodecompose='nodecompose'}], [{@dont_hash='dont_hash'}, {@mask={'mask', 0x3d, 'MAY_READ'}}, {@subj_user={'subj_user', 0x3d, 'memory.events\x00'}}, {@hash='hash'}, {@pcr={'pcr', 0x3d, 0x1}}, {@smackfsroot={'smackfsroot', 0x3d, 'memory.events\x00'}}, {@appraise_type='appraise_type=imasig'}, {@obj_type={'obj_type', 0x3d, 'vboxnet0[:md5sum'}}]}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0), 0xfffffedd) 15:21:24 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:24 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x100000001, 0x1, &(0x7f0000000200)=[{&(0x7f0000000100)="7cc15d91e2578e81a648d44f71e9d6d75500a1d03cf6e6927b6b991d942f784f6abdca31efd81d1ea3567e466e7e02fb0dfa3557bb57210bc726b9039f6c3913636cd8a7b1978883ccbf7321494b0facaaaf829e3b79a3bdf58b9ffa", 0x5c, 0x3fff8000}], 0x28000, &(0x7f0000000300)={[{@nodecompose='nodecompose'}], [{@dont_hash='dont_hash'}, {@mask={'mask', 0x3d, 'MAY_READ'}}, {@subj_user={'subj_user', 0x3d, 'memory.events\x00'}}, {@hash='hash'}, {@pcr={'pcr', 0x3d, 0x1}}, {@smackfsroot={'smackfsroot', 0x3d, 'memory.events\x00'}}, {@appraise_type='appraise_type=imasig'}, {@obj_type={'obj_type', 0x3d, 'vboxnet0[:md5sum'}}]}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0), 0xfffffedd) 15:21:24 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:24 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:24 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0), 0xfffffedd) 15:21:24 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:21:24 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:24 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:25 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:25 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, 0x0) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:25 executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)=r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:25 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, 0x0) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 813.219213][T27438] overlayfs: missing 'lowerdir' [ 813.473773][T27443] overlayfs: missing 'lowerdir' 15:21:27 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:27 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0x90000000000000, 0xfffffedd) 15:21:27 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0xf4ffffff, 0xfffffedd) 15:21:27 executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)=r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:27 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, 0x0) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:27 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:27 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 815.634636][T27452] overlayfs: missing 'lowerdir' 15:21:28 executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)=r1) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:28 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 815.943720][T27462] overlayfs: unrecognized mount option "./bus" or missing value 15:21:28 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:28 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 816.259387][T27468] overlayfs: unrecognized mount option "./bus" or missing value 15:21:28 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0xf4ffffff, 0xfffffedd) [ 816.567024][T27474] overlayfs: unrecognized mount option "./bus" or missing value 15:21:30 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:30 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) sendmmsg$inet(r2, &(0x7f0000002640)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @loopback, @local}}}], 0x20}}], 0x1, 0x0) 15:21:30 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:30 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:30 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0xf000000, 0xfffffedd) 15:21:30 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:30 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:30 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) sendmmsg$inet(r2, &(0x7f0000002640)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @loopback, @local}}}], 0x20}}], 0x1, 0x0) [ 818.707744][T27485] overlayfs: unrecognized mount option "./bus" or missing value 15:21:31 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:31 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) sendmmsg$inet(r2, &(0x7f0000002640)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @loopback, @local}}}], 0x20}}], 0x1, 0x0) 15:21:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:31 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 819.032877][T27497] overlayfs: unrecognized mount option "./bus" or missing value [ 819.299567][T27505] overlayfs: unrecognized mount option "./bus" or missing value 15:21:33 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2"], 0x0, 0x13c}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:33 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:33 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:33 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:33 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0xf000000, 0xfffffedd) 15:21:33 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:33 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 821.830367][T27520] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 821.830400][T27520] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 15:21:34 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 822.065165][T27530] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 822.065197][T27530] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 822.280751][T27538] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 822.280783][T27538] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 15:21:36 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2"], 0x0, 0x13c}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:36 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:36 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:36 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:36 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0xf000000, 0xfffffedd) 15:21:36 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 824.885429][T27552] overlayfs: unrecognized mount option "upper" or missing value 15:21:37 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) ioctl$TUNSETIFINDEX(r1, 0x400454da, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 825.195886][T27560] overlayfs: unrecognized mount option "upper" or missing value [ 825.546346][T27569] overlayfs: unrecognized mount option "upper" or missing value 15:21:39 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2"], 0x0, 0x13c}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:39 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:39 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) ioctl$TUNSETIFINDEX(r1, 0x400454da, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:39 executing program 5: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @dev, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00', 0x8, 0x2b, 0x3, @local, @local, {[], {0x0, 0x0, 0x8}}}}}}, 0x0) 15:21:39 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:40 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0x2000000, 0xfffffedd) 15:21:40 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 827.965356][T27579] overlayfs: workdir and upperdir must be separate subtrees 15:21:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:40 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) ioctl$TUNSETIFINDEX(r1, 0x400454da, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 828.192380][T27593] overlayfs: workdir and upperdir must be separate subtrees 15:21:43 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYPTR], 0x0, 0xf4}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:43 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:43 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0x14000, 0xfffffedd) 15:21:43 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(0x0, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6(0xa, 0x800000000000002, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 831.038596][T27608] overlayfs: workdir and upperdir must be separate subtrees 15:21:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:43 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 831.356396][T27622] overlayfs: failed to resolve './fil': -2 [ 831.690515][T27630] overlayfs: failed to resolve './fil': -2 15:21:46 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYPTR], 0x0, 0xf4}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:46 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:46 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0x14000, 0xfffffedd) 15:21:46 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x0, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 834.146292][T27641] overlayfs: failed to resolve './fil': -2 15:21:46 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r2}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:46 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x0, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:46 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r2}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 834.519147][T27654] overlayfs: failed to resolve './file': -2 [ 834.855707][T27667] overlayfs: failed to resolve './file': -2 15:21:49 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYPTR], 0x0, 0xf4}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:49 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r2}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:49 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0x14000, 0xfffffedd) 15:21:49 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x0, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:49 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x0, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:49 executing program 1: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(0x0, 0x0, 0x0) [ 837.256963][T27681] overlayfs: failed to resolve './file': -2 15:21:49 executing program 1: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(0x0, 0x0, 0x0) 15:21:49 executing program 1: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:49 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x0, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(0x0, 0x0, 0x0) 15:21:52 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:52 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB, @ANYPTR], 0x0, 0xf4}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:52 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0xc000, 0xfffffedd) 15:21:52 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x0, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:52 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:52 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:52 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0x7000, 0xfffffedd) 15:21:52 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:52 executing program 1: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:52 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:53 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:53 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:53 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:55 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB, @ANYPTR], 0x0, 0xf4}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:55 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:55 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0x7000, 0xfffffedd) 15:21:55 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0x1500, 0xfffffedd) 15:21:55 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:55 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:55 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:55 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:55 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:55 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:56 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:56 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:58 executing program 5: syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @dev, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00', 0x8, 0x2b, 0x0, @local, @local, {[], {0x0, 0x0, 0x8}}}}}}, 0x0) 15:21:58 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB, @ANYPTR], 0x0, 0xf4}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:21:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:58 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:58 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x3}, 0x1c) connect$inet6(r2, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg$inet(r2, &(0x7f0000002640)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@ip_retopts={{0x24, 0x0, 0x7, {[@timestamp_addr={0x44, 0x14, 0xd, 0x1, 0x0, [{}, {@empty}]}]}}}], 0x28, 0x500}}], 0x1, 0x0) 15:21:58 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:21:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:58 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYRES32], 0x4) ioctl$TUNSETFILTEREBPF(r0, 0x6628, 0x0) write$cgroup_int(r0, &(0x7f00000002c0)=0x600, 0xfffffedd) [ 846.439552][T27807] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 15:21:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:58 executing program 4 (fault-call:5 fault-nth:0): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:21:58 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:21:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:21:59 executing program 4 (fault-call:5 fault-nth:1): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 846.955064][T27820] FAULT_INJECTION: forcing a failure. [ 846.955064][T27820] name failslab, interval 1, probability 0, space 0, times 0 [ 846.955086][T27820] CPU: 1 PID: 27820 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 846.955096][T27820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 846.955101][T27820] Call Trace: [ 846.955169][T27820] dump_stack+0x188/0x20d [ 846.955203][T27820] should_fail.cold+0x5/0x14 [ 846.955226][T27820] ? lock_downgrade+0x7f0/0x7f0 [ 846.955243][T27820] ? setup_fault_attr+0x1e0/0x1e0 [ 846.955283][T27820] should_failslab+0x5/0xf [ 846.955305][T27820] kmem_cache_alloc+0x29b/0x730 [ 846.955329][T27820] ? ksys_write+0x20c/0x250 [ 846.955361][T27820] getname_flags+0xd2/0x5b0 [ 846.955388][T27820] do_sys_openat2+0x3cf/0x740 [ 846.955411][T27820] ? file_open_root+0x3d0/0x3d0 [ 846.955449][T27820] ? __mutex_unlock_slowpath+0xe2/0x660 [ 846.955474][T27820] ? wait_for_completion+0x3c0/0x3c0 [ 846.955496][T27820] ? __this_cpu_preempt_check+0x28/0x190 [ 846.955515][T27820] ? __sb_end_write+0x101/0x1d0 [ 846.955541][T27820] do_sys_open+0xc3/0x140 [ 846.955562][T27820] ? filp_open+0x70/0x70 [ 846.955577][T27820] ? ksys_write+0x19f/0x250 [ 846.955603][T27820] ? __ia32_sys_clock_settime+0x260/0x260 [ 846.955633][T27820] ? trace_hardirqs_off_caller+0x55/0x230 [ 846.955673][T27820] do_syscall_64+0xf6/0x790 [ 846.955697][T27820] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 846.955711][T27820] RIP: 0033:0x45c849 [ 846.955727][T27820] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 846.955736][T27820] RSP: 002b:00007f5cc87ecc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 846.955751][T27820] RAX: ffffffffffffffda RBX: 00007f5cc87ed6d4 RCX: 000000000045c849 [ 846.955759][T27820] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 846.955768][T27820] RBP: 000000000076bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 846.955778][T27820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 846.955787][T27820] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000000 [ 847.257678][T27826] FAULT_INJECTION: forcing a failure. [ 847.257678][T27826] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 847.257700][T27826] CPU: 1 PID: 27826 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 847.257709][T27826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 847.257714][T27826] Call Trace: [ 847.257738][T27826] dump_stack+0x188/0x20d [ 847.257765][T27826] should_fail.cold+0x5/0x14 [ 847.257786][T27826] ? setup_fault_attr+0x1e0/0x1e0 [ 847.257805][T27826] ? __lock_acquire+0x18c3/0x5270 [ 847.257854][T27826] __alloc_pages_nodemask+0x17a/0x820 [ 847.257879][T27826] ? __alloc_pages_slowpath+0x26a0/0x26a0 [ 847.257895][T27826] ? find_held_lock+0x2d/0x110 [ 847.257919][T27826] ? kstrtouint+0x11e/0x180 [ 847.257938][T27826] ? lock_downgrade+0x7f0/0x7f0 [ 847.257963][T27826] cache_grow_begin+0x8c/0xc10 [ 847.257983][T27826] ? cache_alloc_pfmemalloc+0x1e/0x140 [ 847.258008][T27826] kmem_cache_alloc+0x66a/0x730 [ 847.258027][T27826] ? ksys_write+0x20c/0x250 [ 847.258058][T27826] getname_flags+0xd2/0x5b0 [ 847.258093][T27826] do_sys_openat2+0x3cf/0x740 [ 847.258117][T27826] ? file_open_root+0x3d0/0x3d0 [ 847.258135][T27826] ? __mutex_unlock_slowpath+0xe2/0x660 [ 847.258159][T27826] ? wait_for_completion+0x3c0/0x3c0 [ 847.258176][T27826] ? __this_cpu_preempt_check+0x28/0x190 [ 847.258197][T27826] ? __sb_end_write+0x101/0x1d0 [ 847.258220][T27826] do_sys_open+0xc3/0x140 [ 847.258238][T27826] ? filp_open+0x70/0x70 [ 847.258250][T27826] ? ksys_write+0x19f/0x250 [ 847.258269][T27826] ? __ia32_sys_clock_settime+0x260/0x260 [ 847.258286][T27826] ? trace_hardirqs_off_caller+0x55/0x230 [ 847.258317][T27826] do_syscall_64+0xf6/0x790 [ 847.258346][T27826] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 847.258358][T27826] RIP: 0033:0x45c849 [ 847.258375][T27826] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 847.258384][T27826] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 847.258398][T27826] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 847.258407][T27826] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 847.258415][T27826] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 847.258424][T27826] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 847.258432][T27826] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000001 15:22:01 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556b", @ANYPTR], 0x0, 0x11c}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:01 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:01 executing program 4 (fault-call:5 fault-nth:2): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:22:01 executing program 5 (fault-call:9 fault-nth:0): prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:01 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:01 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:01 executing program 4 (fault-call:5 fault-nth:3): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 849.483769][T27843] FAULT_INJECTION: forcing a failure. [ 849.483769][T27843] name failslab, interval 1, probability 0, space 0, times 0 [ 849.500222][T27843] CPU: 0 PID: 27843 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 849.510144][T27843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 849.520274][T27843] Call Trace: [ 849.520303][T27843] dump_stack+0x188/0x20d [ 849.520331][T27843] should_fail.cold+0x5/0x14 [ 849.520349][T27843] ? lock_downgrade+0x7f0/0x7f0 [ 849.520365][T27843] ? setup_fault_attr+0x1e0/0x1e0 [ 849.520399][T27843] should_failslab+0x5/0xf [ 849.520415][T27843] kmem_cache_alloc+0x29b/0x730 15:22:01 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 849.520437][T27843] ? kmem_cache_alloc+0x358/0x730 [ 849.520462][T27843] security_file_alloc+0x34/0x160 [ 849.520488][T27843] __alloc_file+0xd8/0x340 [ 849.520509][T27843] alloc_empty_file+0x6d/0x170 [ 849.520532][T27843] path_openat+0xef/0x3230 15:22:01 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 849.520549][T27843] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 849.520562][T27843] ? kmem_cache_alloc+0x11b/0x730 [ 849.520577][T27843] ? getname_flags+0xd2/0x5b0 [ 849.520592][T27843] ? do_sys_openat2+0x3cf/0x740 [ 849.520606][T27843] ? do_sys_open+0xc3/0x140 [ 849.520622][T27843] ? do_syscall_64+0xf6/0x790 [ 849.520638][T27843] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 849.520661][T27843] ? mark_lock+0xbc/0x1220 [ 849.520686][T27843] ? path_mountpoint.isra.0+0x370/0x370 [ 849.520705][T27843] ? __lock_acquire+0x18c3/0x5270 [ 849.520740][T27843] do_filp_open+0x192/0x260 [ 849.520761][T27843] ? may_open_dev+0xf0/0xf0 [ 849.520786][T27843] ? __alloc_fd+0x46d/0x600 [ 849.520811][T27843] ? lock_downgrade+0x7f0/0x7f0 [ 849.520828][T27843] ? do_raw_spin_lock+0x129/0x2e0 [ 849.520862][T27843] ? _raw_spin_unlock+0x24/0x40 [ 849.520875][T27843] ? __alloc_fd+0x46d/0x600 [ 849.520905][T27843] do_sys_openat2+0x54c/0x740 [ 849.520927][T27843] ? file_open_root+0x3d0/0x3d0 [ 849.520943][T27843] ? __mutex_unlock_slowpath+0xe2/0x660 [ 849.520965][T27843] ? wait_for_completion+0x3c0/0x3c0 [ 849.520979][T27843] ? __this_cpu_preempt_check+0x28/0x190 [ 849.520996][T27843] ? __sb_end_write+0x101/0x1d0 [ 849.521023][T27843] do_sys_open+0xc3/0x140 [ 849.521042][T27843] ? filp_open+0x70/0x70 [ 849.521054][T27843] ? ksys_write+0x19f/0x250 [ 849.521082][T27843] ? __ia32_sys_clock_settime+0x260/0x260 [ 849.521101][T27843] ? trace_hardirqs_off_caller+0x55/0x230 [ 849.521129][T27843] do_syscall_64+0xf6/0x790 [ 849.521153][T27843] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 849.521166][T27843] RIP: 0033:0x45c849 [ 849.521183][T27843] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 849.521191][T27843] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 849.521206][T27843] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 849.521215][T27843] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 849.521223][T27843] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 849.521232][T27843] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 849.521241][T27843] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000002 [ 849.751560][T27851] FAULT_INJECTION: forcing a failure. [ 849.751560][T27851] name failslab, interval 1, probability 0, space 0, times 0 15:22:02 executing program 4 (fault-call:5 fault-nth:4): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:22:02 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:02 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r2 = pidfd_getfd(r1, 0xffffffffffffffff, 0x0) ioctl$RTC_IRQP_SET(r2, 0x4008700c, 0x1bb4) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 849.971428][T27851] CPU: 0 PID: 27851 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 849.971437][T27851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 849.971442][T27851] Call Trace: [ 849.971465][T27851] dump_stack+0x188/0x20d [ 849.971490][T27851] should_fail.cold+0x5/0x14 [ 849.971506][T27851] ? lock_downgrade+0x7f0/0x7f0 [ 849.971521][T27851] ? setup_fault_attr+0x1e0/0x1e0 [ 849.971551][T27851] should_failslab+0x5/0xf [ 849.971566][T27851] kmem_cache_alloc+0x29b/0x730 [ 849.971586][T27851] ? kmem_cache_alloc+0x358/0x730 [ 849.971610][T27851] security_file_alloc+0x34/0x160 [ 849.971631][T27851] __alloc_file+0xd8/0x340 [ 849.971649][T27851] alloc_empty_file+0x6d/0x170 [ 849.971669][T27851] path_openat+0xef/0x3230 [ 849.971684][T27851] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 849.971698][T27851] ? kmem_cache_alloc+0x11b/0x730 [ 849.971719][T27851] ? getname_flags+0xd2/0x5b0 [ 849.971738][T27851] ? do_sys_openat2+0x3cf/0x740 [ 849.971751][T27851] ? do_sys_open+0xc3/0x140 [ 849.971766][T27851] ? do_syscall_64+0xf6/0x790 [ 849.971780][T27851] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 849.971794][T27851] ? __lock_acquire+0x18c3/0x5270 [ 849.971811][T27851] ? mark_lock+0xbc/0x1220 [ 849.971829][T27851] ? path_mountpoint.isra.0+0x370/0x370 [ 849.971848][T27851] ? __lock_acquire+0x18c3/0x5270 [ 849.971881][T27851] do_filp_open+0x192/0x260 [ 849.971901][T27851] ? may_open_dev+0xf0/0xf0 [ 849.971913][T27851] ? __alloc_fd+0x46d/0x600 [ 849.971936][T27851] ? lock_downgrade+0x7f0/0x7f0 [ 849.971953][T27851] ? do_raw_spin_lock+0x129/0x2e0 [ 849.971986][T27851] ? _raw_spin_unlock+0x24/0x40 [ 849.971999][T27851] ? __alloc_fd+0x46d/0x600 [ 849.972030][T27851] do_sys_openat2+0x54c/0x740 [ 849.972053][T27851] ? file_open_root+0x3d0/0x3d0 [ 849.972069][T27851] ? __mutex_unlock_slowpath+0xe2/0x660 [ 849.972089][T27851] ? wait_for_completion+0x3c0/0x3c0 [ 849.972103][T27851] ? __this_cpu_preempt_check+0x28/0x190 [ 849.972119][T27851] ? __sb_end_write+0x101/0x1d0 [ 849.972140][T27851] do_sys_open+0xc3/0x140 [ 849.972156][T27851] ? filp_open+0x70/0x70 [ 849.972167][T27851] ? ksys_write+0x19f/0x250 [ 849.972201][T27851] ? fpregs_mark_activate+0x320/0x320 [ 849.972217][T27851] ? trace_hardirqs_off_caller+0x55/0x230 [ 849.972243][T27851] do_syscall_64+0xf6/0x790 [ 849.972263][T27851] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 849.972275][T27851] RIP: 0033:0x45c849 [ 849.972289][T27851] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 849.972296][T27851] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 849.972310][T27851] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 849.972318][T27851] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 849.972326][T27851] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 849.972334][T27851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 849.972342][T27851] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000003 [ 850.236879][T27866] FAULT_INJECTION: forcing a failure. [ 850.236879][T27866] name failslab, interval 1, probability 0, space 0, times 0 [ 850.236939][T27866] CPU: 0 PID: 27866 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 850.236944][T27866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 850.236948][T27866] Call Trace: [ 850.236963][T27866] dump_stack+0x188/0x20d [ 850.236979][T27866] should_fail.cold+0x5/0x14 [ 850.236998][T27866] ? setup_fault_attr+0x1e0/0x1e0 [ 850.237034][T27866] should_failslab+0x5/0xf [ 850.237050][T27866] kmem_cache_alloc+0x29b/0x730 [ 850.237083][T27866] __d_alloc+0x2b/0x8d0 [ 850.237120][T27866] d_alloc+0x4a/0x240 [ 850.237146][T27866] d_alloc_parallel+0xe8/0x1b10 [ 850.237164][T27866] ? mark_lock+0xbc/0x1220 [ 850.237192][T27866] ? __lock_acquire+0x827/0x5270 [ 850.237221][T27866] ? __d_lookup_rcu+0x6c0/0x6c0 [ 850.237253][T27866] ? lockdep_init_map+0x1b0/0x6c0 [ 850.237270][T27866] ? lockdep_init_map+0x1b0/0x6c0 [ 850.237295][T27866] __lookup_slow+0x18d/0x480 [ 850.237314][T27866] ? vfs_unlink+0x620/0x620 [ 850.237370][T27866] ? d_lookup+0x18f/0x250 [ 850.237401][T27866] lookup_one_len_unlocked+0x120/0x140 [ 850.237418][T27866] ? lookup_one_len+0x190/0x190 [ 850.237438][T27866] ? mark_lock+0xbc/0x1220 [ 850.237461][T27866] lookup_positive_unlocked+0x22/0xc0 [ 850.237532][T27866] ovl_lookup_single+0x60/0x8f0 [ 850.237556][T27866] ovl_lookup_layer+0x3ce/0x480 [ 850.237582][T27866] ? ovl_lookup_single+0x8f0/0x8f0 [ 850.237601][T27866] ? d_alloc_parallel+0x785/0x1b10 [ 850.237624][T27866] ovl_lookup+0x43d/0x1a50 [ 850.237660][T27866] ? d_alloc_parallel+0x9ea/0x1b10 [ 850.237676][T27866] ? ovl_path_next+0x2d0/0x2d0 [ 850.237712][T27866] ? rcu_read_lock_held_common+0x130/0x130 [ 850.237739][T27866] ? __d_lookup+0x422/0x740 [ 850.237758][T27866] ? mark_held_locks+0x9f/0xe0 [ 850.237774][T27866] ? d_lookup+0xec/0x250 [ 850.237795][T27866] ? d_lookup+0x18f/0x250 [ 850.237814][T27866] ? ovl_path_next+0x2d0/0x2d0 [ 850.237830][T27866] lookup_open+0x681/0x1970 [ 850.237861][T27866] ? trailing_symlink+0x930/0x930 [ 850.237905][T27866] ? percpu_counter_add_batch+0x60/0x180 [ 850.237937][T27866] path_openat+0x1b4f/0x3230 [ 850.237976][T27866] ? path_mountpoint.isra.0+0x370/0x370 [ 850.237995][T27866] ? __lock_acquire+0x18c3/0x5270 [ 850.238031][T27866] do_filp_open+0x192/0x260 [ 850.238050][T27866] ? may_open_dev+0xf0/0xf0 [ 850.238081][T27866] ? do_raw_spin_lock+0x129/0x2e0 [ 850.238125][T27866] ? _raw_spin_unlock+0x24/0x40 [ 850.238139][T27866] ? __alloc_fd+0x46d/0x600 [ 850.238171][T27866] do_sys_openat2+0x54c/0x740 [ 850.238195][T27866] ? file_open_root+0x3d0/0x3d0 [ 850.238211][T27866] ? __mutex_unlock_slowpath+0xe2/0x660 [ 850.238233][T27866] ? wait_for_completion+0x3c0/0x3c0 [ 850.238250][T27866] ? __this_cpu_preempt_check+0x28/0x190 [ 850.238267][T27866] ? __sb_end_write+0x101/0x1d0 [ 850.238292][T27866] do_sys_open+0xc3/0x140 [ 850.238310][T27866] ? filp_open+0x70/0x70 [ 850.238322][T27866] ? ksys_write+0x19f/0x250 [ 850.238340][T27866] ? __ia32_sys_clock_settime+0x260/0x260 [ 850.238358][T27866] ? trace_hardirqs_off_caller+0x55/0x230 [ 850.238389][T27866] do_syscall_64+0xf6/0x790 [ 850.238412][T27866] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 850.238424][T27866] RIP: 0033:0x45c849 [ 850.238439][T27866] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 850.238448][T27866] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 850.238462][T27866] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 850.238471][T27866] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 850.238480][T27866] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 850.238489][T27866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 850.238497][T27866] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000004 15:22:04 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556b", @ANYPTR], 0x0, 0x11c}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:04 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:04 executing program 4 (fault-call:5 fault-nth:5): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:22:04 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000040)) r0 = gettid() setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x14, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, &(0x7f0000000100)) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x80000000002c00) 15:22:04 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:04 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) socket(0x10, 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:22:04 executing program 5: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) ioctl$KVM_SET_MP_STATE(r0, 0x4004ae99, &(0x7f0000000040)=0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000100)) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x200000000000013, &(0x7f0000000080)=0x5, 0x4) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_buf(r3, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r4, 0x0, 0x0) fcntl$setstatus(r3, 0x4, 0x80000000002c00) 15:22:04 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:04 executing program 4 (fault-call:5 fault-nth:6): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 852.542324][T27877] FAULT_INJECTION: forcing a failure. [ 852.542324][T27877] name failslab, interval 1, probability 0, space 0, times 0 [ 852.542346][T27877] CPU: 0 PID: 27877 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 852.542354][T27877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 15:22:04 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 852.542360][T27877] Call Trace: [ 852.542383][T27877] dump_stack+0x188/0x20d [ 852.542410][T27877] should_fail.cold+0x5/0x14 [ 852.542430][T27877] ? setup_fault_attr+0x1e0/0x1e0 [ 852.542464][T27877] should_failslab+0x5/0xf [ 852.542480][T27877] kmem_cache_alloc+0x29b/0x730 [ 852.542513][T27877] __d_alloc+0x2b/0x8d0 [ 852.542535][T27877] d_alloc+0x4a/0x240 [ 852.542559][T27877] d_alloc_parallel+0xe8/0x1b10 [ 852.542578][T27877] ? mark_lock+0xbc/0x1220 [ 852.542602][T27877] ? __lock_acquire+0x827/0x5270 [ 852.542629][T27877] ? __d_lookup_rcu+0x6c0/0x6c0 15:22:05 executing program 4 (fault-call:5 fault-nth:7): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:22:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 852.542659][T27877] ? lockdep_init_map+0x1b0/0x6c0 [ 852.542676][T27877] ? lockdep_init_map+0x1b0/0x6c0 [ 852.542700][T27877] __lookup_slow+0x18d/0x480 [ 852.542718][T27877] ? vfs_unlink+0x620/0x620 [ 852.542764][T27877] ? d_lookup+0x18f/0x250 [ 852.542793][T27877] lookup_one_len_unlocked+0x120/0x140 [ 852.542810][T27877] ? lookup_one_len+0x190/0x190 [ 852.542829][T27877] ? mark_lock+0xbc/0x1220 [ 852.542852][T27877] lookup_positive_unlocked+0x22/0xc0 [ 852.542872][T27877] ovl_lookup_single+0x60/0x8f0 [ 852.542895][T27877] ovl_lookup_layer+0x3ce/0x480 [ 852.542920][T27877] ? ovl_lookup_single+0x8f0/0x8f0 [ 852.542938][T27877] ? d_alloc_parallel+0x785/0x1b10 [ 852.542964][T27877] ovl_lookup+0x43d/0x1a50 [ 852.542997][T27877] ? d_alloc_parallel+0x9ea/0x1b10 [ 852.543014][T27877] ? ovl_path_next+0x2d0/0x2d0 [ 852.543045][T27877] ? rcu_read_lock_held_common+0x130/0x130 [ 852.543083][T27877] ? __d_lookup+0x422/0x740 [ 852.543104][T27877] ? mark_held_locks+0x9f/0xe0 [ 852.543120][T27877] ? d_lookup+0xec/0x250 [ 852.543143][T27877] ? d_lookup+0x18f/0x250 [ 852.543164][T27877] ? ovl_path_next+0x2d0/0x2d0 [ 852.543181][T27877] lookup_open+0x681/0x1970 [ 852.543214][T27877] ? trailing_symlink+0x930/0x930 [ 852.543266][T27877] ? percpu_counter_add_batch+0x60/0x180 [ 852.543298][T27877] path_openat+0x1b4f/0x3230 [ 852.543324][T27877] ? __lock_acquire+0x18c3/0x5270 [ 852.543351][T27877] ? path_mountpoint.isra.0+0x370/0x370 [ 852.543371][T27877] ? __lock_acquire+0x18c3/0x5270 [ 852.543406][T27877] do_filp_open+0x192/0x260 [ 852.543426][T27877] ? may_open_dev+0xf0/0xf0 [ 852.543457][T27877] ? do_raw_spin_lock+0x129/0x2e0 [ 852.543490][T27877] ? _raw_spin_unlock+0x24/0x40 [ 852.543504][T27877] ? __alloc_fd+0x46d/0x600 [ 852.543536][T27877] do_sys_openat2+0x54c/0x740 [ 852.543558][T27877] ? file_open_root+0x3d0/0x3d0 [ 852.543575][T27877] ? __mutex_unlock_slowpath+0xe2/0x660 [ 852.543598][T27877] ? wait_for_completion+0x3c0/0x3c0 [ 852.543614][T27877] ? __this_cpu_preempt_check+0x28/0x190 [ 852.543631][T27877] ? __sb_end_write+0x101/0x1d0 [ 852.543657][T27877] do_sys_open+0xc3/0x140 [ 852.543676][T27877] ? filp_open+0x70/0x70 [ 852.543688][T27877] ? ksys_write+0x19f/0x250 [ 852.543706][T27877] ? __ia32_sys_clock_settime+0x260/0x260 [ 852.543723][T27877] ? trace_hardirqs_off_caller+0x55/0x230 [ 852.543753][T27877] do_syscall_64+0xf6/0x790 [ 852.543774][T27877] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 852.543786][T27877] RIP: 0033:0x45c849 [ 852.543801][T27877] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 852.543810][T27877] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 852.543823][T27877] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 852.543831][T27877] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 852.543839][T27877] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 852.543847][T27877] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 852.543855][T27877] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000005 [ 852.576626][T27886] cgroup: fork rejected by pids controller in /syz5 [ 852.804213][T27998] FAULT_INJECTION: forcing a failure. [ 852.804213][T27998] name failslab, interval 1, probability 0, space 0, times 0 [ 852.804297][T27998] CPU: 1 PID: 27998 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 852.804306][T27998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 852.804319][T27998] Call Trace: [ 852.804341][T27998] dump_stack+0x188/0x20d [ 852.804364][T27998] should_fail.cold+0x5/0x14 [ 852.804383][T27998] ? setup_fault_attr+0x1e0/0x1e0 [ 852.804414][T27998] should_failslab+0x5/0xf [ 852.804428][T27998] __kmalloc+0x2d9/0x7a0 [ 852.804441][T27998] ? ovl_lookup_single+0x8f0/0x8f0 [ 852.804453][T27998] ? ovl_lookup+0xc2e/0x1a50 [ 852.804471][T27998] ? d_alloc_parallel+0x785/0x1b10 [ 852.804495][T27998] ovl_lookup+0xc2e/0x1a50 [ 852.804527][T27998] ? d_alloc_parallel+0x9ea/0x1b10 [ 852.804542][T27998] ? ovl_path_next+0x2d0/0x2d0 [ 852.804569][T27998] ? rcu_read_lock_held_common+0x130/0x130 [ 852.804595][T27998] ? __d_lookup+0x422/0x740 [ 852.804615][T27998] ? mark_held_locks+0x9f/0xe0 [ 852.804629][T27998] ? d_lookup+0xec/0x250 [ 852.804649][T27998] ? d_lookup+0x18f/0x250 [ 852.804666][T27998] ? ovl_path_next+0x2d0/0x2d0 [ 852.804684][T27998] lookup_open+0x681/0x1970 [ 852.804715][T27998] ? trailing_symlink+0x930/0x930 [ 852.804763][T27998] ? percpu_counter_add_batch+0x60/0x180 [ 852.804793][T27998] path_openat+0x1b4f/0x3230 [ 852.804888][T27998] ? __lock_acquire+0x18c3/0x5270 [ 852.804916][T27998] ? path_mountpoint.isra.0+0x370/0x370 [ 852.804934][T27998] ? __lock_acquire+0x18c3/0x5270 [ 852.804968][T27998] do_filp_open+0x192/0x260 [ 852.804988][T27998] ? may_open_dev+0xf0/0xf0 [ 852.805018][T27998] ? do_raw_spin_lock+0x129/0x2e0 [ 852.805052][T27998] ? _raw_spin_unlock+0x24/0x40 [ 852.805067][T27998] ? __alloc_fd+0x46d/0x600 [ 852.805099][T27998] do_sys_openat2+0x54c/0x740 [ 852.805121][T27998] ? file_open_root+0x3d0/0x3d0 [ 852.805135][T27998] ? __mutex_unlock_slowpath+0xe2/0x660 [ 852.805157][T27998] ? wait_for_completion+0x3c0/0x3c0 [ 852.805171][T27998] ? __this_cpu_preempt_check+0x28/0x190 [ 852.805187][T27998] ? __sb_end_write+0x101/0x1d0 [ 852.805210][T27998] do_sys_open+0xc3/0x140 [ 852.805227][T27998] ? filp_open+0x70/0x70 [ 852.805239][T27998] ? ksys_write+0x19f/0x250 [ 852.805257][T27998] ? __ia32_sys_clock_settime+0x260/0x260 [ 852.805273][T27998] ? trace_hardirqs_off_caller+0x55/0x230 [ 852.805303][T27998] do_syscall_64+0xf6/0x790 [ 852.805324][T27998] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 852.805337][T27998] RIP: 0033:0x45c849 [ 852.805352][T27998] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 852.805360][T27998] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 852.805374][T27998] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 852.805381][T27998] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 852.805389][T27998] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 852.805397][T27998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 852.805406][T27998] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000006 [ 853.008078][T28005] FAULT_INJECTION: forcing a failure. [ 853.008078][T28005] name failslab, interval 1, probability 0, space 0, times 0 [ 853.573450][T28005] CPU: 1 PID: 28005 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 853.573459][T28005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 853.573465][T28005] Call Trace: [ 853.573489][T28005] dump_stack+0x188/0x20d [ 853.573513][T28005] should_fail.cold+0x5/0x14 [ 853.573531][T28005] ? setup_fault_attr+0x1e0/0x1e0 [ 853.573563][T28005] should_failslab+0x5/0xf [ 853.573585][T28005] __kmalloc+0x2d9/0x7a0 [ 853.573601][T28005] ? ovl_get_index_name_fh+0x51/0x180 [ 853.573664][T28005] ? ovl_encode_real_fh+0x302/0x420 [ 853.573684][T28005] ? ovl_set_attr+0x220/0x220 [ 853.573699][T28005] ? ovl_check_metacopy_xattr+0x73/0x130 [ 853.573718][T28005] ovl_get_index_name_fh+0x51/0x180 [ 853.573736][T28005] ovl_get_index_name+0x43/0x70 [ 853.573751][T28005] ovl_lookup_index+0xc8/0x540 [ 853.573770][T28005] ? ovl_get_index_fh+0x1b0/0x1b0 [ 853.573782][T28005] ? ovl_lookup+0xc2e/0x1a50 [ 853.573798][T28005] ? d_alloc_parallel+0x785/0x1b10 [ 853.573823][T28005] ovl_lookup+0x762/0x1a50 [ 853.573859][T28005] ? ovl_path_next+0x2d0/0x2d0 [ 853.573897][T28005] ? __d_lookup+0x422/0x740 [ 853.573916][T28005] ? mark_held_locks+0x9f/0xe0 [ 853.573931][T28005] ? d_lookup+0xec/0x250 [ 853.573951][T28005] ? d_lookup+0x18f/0x250 [ 853.573969][T28005] ? ovl_path_next+0x2d0/0x2d0 [ 853.573985][T28005] lookup_open+0x681/0x1970 [ 853.574014][T28005] ? trailing_symlink+0x930/0x930 [ 853.574056][T28005] ? percpu_counter_add_batch+0x60/0x180 [ 853.574086][T28005] path_openat+0x1b4f/0x3230 [ 853.574123][T28005] ? path_mountpoint.isra.0+0x370/0x370 [ 853.574142][T28005] ? __lock_acquire+0x18c3/0x5270 [ 853.574175][T28005] do_filp_open+0x192/0x260 [ 853.574193][T28005] ? may_open_dev+0xf0/0xf0 [ 853.574222][T28005] ? do_raw_spin_lock+0x129/0x2e0 [ 853.574256][T28005] ? _raw_spin_unlock+0x24/0x40 [ 853.574269][T28005] ? __alloc_fd+0x46d/0x600 [ 853.574299][T28005] do_sys_openat2+0x54c/0x740 [ 853.574322][T28005] ? file_open_root+0x3d0/0x3d0 [ 853.574336][T28005] ? __mutex_unlock_slowpath+0xe2/0x660 [ 853.574358][T28005] ? wait_for_completion+0x3c0/0x3c0 [ 853.574373][T28005] ? __this_cpu_preempt_check+0x28/0x190 [ 853.574389][T28005] ? __sb_end_write+0x101/0x1d0 [ 853.574412][T28005] do_sys_open+0xc3/0x140 [ 853.574428][T28005] ? filp_open+0x70/0x70 [ 853.574440][T28005] ? ksys_write+0x19f/0x250 [ 853.574457][T28005] ? __ia32_sys_clock_settime+0x260/0x260 [ 853.574472][T28005] ? trace_hardirqs_off_caller+0x55/0x230 [ 853.574500][T28005] do_syscall_64+0xf6/0x790 [ 853.574521][T28005] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 853.574533][T28005] RIP: 0033:0x45c849 [ 853.574548][T28005] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 853.574556][T28005] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 853.574576][T28005] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 853.574584][T28005] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 853.574592][T28005] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 853.574599][T28005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 853.574607][T28005] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000007 15:22:07 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556b", @ANYPTR], 0x0, 0x11c}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:07 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() socket(0x4, 0x5, 0x1ff) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001300)='/dev/autofs\x00', 0x10100, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x14, r6, 0x605, 0x0, 0x0, {0xf}}, 0x14}}, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x88, r6, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'caif0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x41}}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'nr0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x5}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x80020}, 0x80) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:07 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:07 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:07 executing program 4 (fault-call:5 fault-nth:8): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:22:07 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) socket(0x10, 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:22:07 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:07 executing program 4 (fault-call:5 fault-nth:9): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 855.639802][T28014] FAULT_INJECTION: forcing a failure. [ 855.639802][T28014] name failslab, interval 1, probability 0, space 0, times 0 [ 855.639890][T28014] CPU: 1 PID: 28014 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 855.639901][T28014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 855.639906][T28014] Call Trace: [ 855.639933][T28014] dump_stack+0x188/0x20d 15:22:08 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:08 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 855.639961][T28014] should_fail.cold+0x5/0x14 [ 855.639991][T28014] ? setup_fault_attr+0x1e0/0x1e0 [ 855.640029][T28014] should_failslab+0x5/0xf [ 855.640049][T28014] kmem_cache_alloc+0x29b/0x730 [ 855.640083][T28014] __d_alloc+0x2b/0x8d0 [ 855.640119][T28014] d_alloc+0x4a/0x240 [ 855.640143][T28014] d_alloc_parallel+0xe8/0x1b10 [ 855.640160][T28014] ? mark_lock+0xbc/0x1220 [ 855.640186][T28014] ? __lock_acquire+0x827/0x5270 [ 855.640211][T28014] ? __d_lookup_rcu+0x6c0/0x6c0 [ 855.640241][T28014] ? lockdep_init_map+0x1b0/0x6c0 [ 855.640257][T28014] ? lockdep_init_map+0x1b0/0x6c0 [ 855.640282][T28014] __lookup_slow+0x18d/0x480 [ 855.640301][T28014] ? vfs_unlink+0x620/0x620 [ 855.640348][T28014] ? d_lookup+0x18f/0x250 [ 855.640377][T28014] lookup_one_len_unlocked+0x120/0x140 [ 855.640393][T28014] ? lookup_one_len+0x190/0x190 [ 855.640412][T28014] ? kfree+0x1eb/0x2b0 [ 855.640426][T28014] ? ovl_get_index_name+0x4e/0x70 [ 855.640449][T28014] lookup_positive_unlocked+0x22/0xc0 [ 855.640467][T28014] ovl_lookup_index+0x156/0x540 [ 855.640486][T28014] ? ovl_get_index_fh+0x1b0/0x1b0 [ 855.640498][T28014] ? ovl_lookup+0xc2e/0x1a50 [ 855.640514][T28014] ? d_alloc_parallel+0x785/0x1b10 [ 855.640540][T28014] ovl_lookup+0x762/0x1a50 [ 855.640584][T28014] ? ovl_path_next+0x2d0/0x2d0 15:22:08 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(0xffffffffffffffff, 0xc040564b, &(0x7f0000000040)={0x7f, 0x0, 0x1009, 0x7, 0x5, {0x3, 0xdd4}, 0x1}) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 855.640630][T28014] ? __d_lookup+0x422/0x740 [ 855.640650][T28014] ? mark_held_locks+0x9f/0xe0 [ 855.640666][T28014] ? d_lookup+0xec/0x250 [ 855.640688][T28014] ? d_lookup+0x18f/0x250 [ 855.640707][T28014] ? ovl_path_next+0x2d0/0x2d0 [ 855.640722][T28014] lookup_open+0x681/0x1970 [ 855.640753][T28014] ? trailing_symlink+0x930/0x930 [ 855.640807][T28014] ? percpu_counter_add_batch+0x60/0x180 [ 855.640840][T28014] path_openat+0x1b4f/0x3230 [ 855.640881][T28014] ? path_mountpoint.isra.0+0x370/0x370 [ 855.640901][T28014] ? __lock_acquire+0x18c3/0x5270 [ 855.640937][T28014] do_filp_open+0x192/0x260 [ 855.640958][T28014] ? may_open_dev+0xf0/0xf0 [ 855.640991][T28014] ? do_raw_spin_lock+0x129/0x2e0 [ 855.641031][T28014] ? _raw_spin_unlock+0x24/0x40 [ 855.641046][T28014] ? __alloc_fd+0x46d/0x600 [ 855.641080][T28014] do_sys_openat2+0x54c/0x740 [ 855.641113][T28014] ? file_open_root+0x3d0/0x3d0 [ 855.641131][T28014] ? __mutex_unlock_slowpath+0xe2/0x660 [ 855.641154][T28014] ? wait_for_completion+0x3c0/0x3c0 [ 855.641168][T28014] ? __this_cpu_preempt_check+0x28/0x190 [ 855.641187][T28014] ? __sb_end_write+0x101/0x1d0 [ 855.641211][T28014] do_sys_open+0xc3/0x140 [ 855.641228][T28014] ? filp_open+0x70/0x70 [ 855.641240][T28014] ? ksys_write+0x19f/0x250 [ 855.641259][T28014] ? __ia32_sys_clock_settime+0x260/0x260 [ 855.641276][T28014] ? trace_hardirqs_off_caller+0x55/0x230 [ 855.641307][T28014] do_syscall_64+0xf6/0x790 [ 855.641330][T28014] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 855.641342][T28014] RIP: 0033:0x45c849 [ 855.641358][T28014] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 855.641366][T28014] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 855.641381][T28014] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 855.641389][T28014] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 855.641398][T28014] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 855.641407][T28014] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 855.641416][T28014] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000008 [ 855.646848][T28014] overlayfs: failed inode index lookup (ino=16993, key=00fb1d00019a680d7ee2194783bf7022ff1ab2d2986142000065324be2, err=-12); [ 855.646848][T28014] overlayfs: mount with '-o index=off' to disable inodes index. [ 855.996300][T28035] FAULT_INJECTION: forcing a failure. [ 855.996300][T28035] name failslab, interval 1, probability 0, space 0, times 0 15:22:08 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 856.531953][T28035] CPU: 1 PID: 28035 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 856.531962][T28035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 856.531968][T28035] Call Trace: [ 856.531991][T28035] dump_stack+0x188/0x20d [ 856.532016][T28035] should_fail.cold+0x5/0x14 [ 856.532035][T28035] ? setup_fault_attr+0x1e0/0x1e0 [ 856.532064][T28035] should_failslab+0x5/0xf [ 856.532078][T28035] __kmalloc+0x2d9/0x7a0 [ 856.532092][T28035] ? __d_alloc+0x60d/0x8d0 [ 856.532106][T28035] ? lock_downgrade+0x7f0/0x7f0 [ 856.532123][T28035] ? lock_acquire+0x197/0x420 [ 856.532137][T28035] ? bpf_image_alloc+0x10/0x10 [ 856.532156][T28035] __d_alloc+0x60d/0x8d0 [ 856.532176][T28035] d_alloc+0x4a/0x240 [ 856.532197][T28035] d_alloc_parallel+0xe8/0x1b10 [ 856.532212][T28035] ? mark_lock+0xbc/0x1220 [ 856.532225][T28035] ? arch_stack_walk+0x84/0xd0 [ 856.532247][T28035] ? __lock_acquire+0x827/0x5270 [ 856.532268][T28035] ? __d_lookup_rcu+0x6c0/0x6c0 [ 856.532294][T28035] ? lockdep_init_map+0x1b0/0x6c0 [ 856.532310][T28035] ? lockdep_init_map+0x1b0/0x6c0 [ 856.532334][T28035] __lookup_slow+0x18d/0x480 [ 856.532352][T28035] ? vfs_unlink+0x620/0x620 [ 856.532396][T28035] ? d_lookup+0x18f/0x250 [ 856.532424][T28035] lookup_one_len_unlocked+0x120/0x140 [ 856.532440][T28035] ? lookup_one_len+0x190/0x190 [ 856.532457][T28035] ? kfree+0x1eb/0x2b0 [ 856.532471][T28035] ? ovl_get_index_name+0x4e/0x70 [ 856.532493][T28035] lookup_positive_unlocked+0x22/0xc0 [ 856.532510][T28035] ovl_lookup_index+0x156/0x540 [ 856.532530][T28035] ? ovl_get_index_fh+0x1b0/0x1b0 [ 856.532541][T28035] ? ovl_lookup+0xc2e/0x1a50 [ 856.532556][T28035] ? d_alloc_parallel+0x785/0x1b10 [ 856.532589][T28035] ovl_lookup+0x762/0x1a50 [ 856.532631][T28035] ? ovl_path_next+0x2d0/0x2d0 [ 856.532670][T28035] ? __d_lookup+0x422/0x740 [ 856.532688][T28035] ? mark_held_locks+0x9f/0xe0 [ 856.532703][T28035] ? d_lookup+0xec/0x250 [ 856.532722][T28035] ? d_lookup+0x18f/0x250 [ 856.532740][T28035] ? ovl_path_next+0x2d0/0x2d0 [ 856.532756][T28035] lookup_open+0x681/0x1970 [ 856.532785][T28035] ? trailing_symlink+0x930/0x930 [ 856.532827][T28035] ? percpu_counter_add_batch+0x60/0x180 [ 856.532858][T28035] path_openat+0x1b4f/0x3230 [ 856.532895][T28035] ? path_mountpoint.isra.0+0x370/0x370 [ 856.532913][T28035] ? __lock_acquire+0x18c3/0x5270 [ 856.532948][T28035] do_filp_open+0x192/0x260 [ 856.532967][T28035] ? may_open_dev+0xf0/0xf0 [ 856.532996][T28035] ? do_raw_spin_lock+0x129/0x2e0 [ 856.533030][T28035] ? _raw_spin_unlock+0x24/0x40 [ 856.533043][T28035] ? __alloc_fd+0x46d/0x600 [ 856.533074][T28035] do_sys_openat2+0x54c/0x740 [ 856.533094][T28035] ? file_open_root+0x3d0/0x3d0 [ 856.533109][T28035] ? __mutex_unlock_slowpath+0xe2/0x660 [ 856.533131][T28035] ? wait_for_completion+0x3c0/0x3c0 [ 856.533145][T28035] ? __this_cpu_preempt_check+0x28/0x190 [ 856.533162][T28035] ? __sb_end_write+0x101/0x1d0 [ 856.533184][T28035] do_sys_open+0xc3/0x140 [ 856.533200][T28035] ? filp_open+0x70/0x70 [ 856.533211][T28035] ? ksys_write+0x19f/0x250 [ 856.533227][T28035] ? __ia32_sys_clock_settime+0x260/0x260 [ 856.533246][T28035] ? trace_hardirqs_off_caller+0x55/0x230 [ 856.533275][T28035] do_syscall_64+0xf6/0x790 [ 856.533296][T28035] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 856.533307][T28035] RIP: 0033:0x45c849 [ 856.533321][T28035] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 856.533329][T28035] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 856.533342][T28035] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 856.533350][T28035] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 856.533358][T28035] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 856.533366][T28035] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 856.533374][T28035] R13: 0000000000000771 R14: 000000000050435f R15: 0000000000000009 [ 856.533604][T28035] overlayfs: failed inode index lookup (ino=16738, key=00fb1d00019a680d7ee2194783bf7022ff1ab2d298624100001a544b83, err=-12); [ 856.533604][T28035] overlayfs: mount with '-o index=off' to disable inodes index. 15:22:10 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c5", @ANYPTR], 0x0, 0x130}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:10 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:10 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:10 executing program 4 (fault-call:5 fault-nth:10): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:22:10 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) getsockopt$SO_J1939_PROMISC(r1, 0x6b, 0x2, &(0x7f0000000040), &(0x7f00000002c0)=0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x10880, 0x0) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x8, 0x0, @empty}, 0x1c) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000100)={0x7fffffff, 0xc, 0x3, "61ddf39698ca5f35493c7b2d2b0bfe1b1958cc2fb303ae300cc1743e89da4b1b", 0x39565559}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x40042409, 0x1) setsockopt$inet6_buf(r2, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x2000, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x80000000002c00) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, 0x17, 0xa, 0x302, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x405c850}, 0x4) 15:22:10 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) socket(0x10, 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:22:10 executing program 4 (fault-call:5 fault-nth:11): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 858.673093][T28256] FAULT_INJECTION: forcing a failure. [ 858.673093][T28256] name failslab, interval 1, probability 0, space 0, times 0 [ 858.673113][T28256] CPU: 1 PID: 28256 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 858.673121][T28256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 858.673127][T28256] Call Trace: [ 858.673150][T28256] dump_stack+0x188/0x20d [ 858.673175][T28256] should_fail.cold+0x5/0x14 15:22:11 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:11 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 858.673195][T28256] ? setup_fault_attr+0x1e0/0x1e0 [ 858.673227][T28256] should_failslab+0x5/0xf [ 858.673241][T28256] __kmalloc+0x2d9/0x7a0 [ 858.673257][T28256] ? __d_alloc+0x60d/0x8d0 15:22:11 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x200001, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x0) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r3 = syz_open_procfs(r2, &(0x7f0000000080)='net/mcfilter\x00') ioctl$KVM_ASSIGN_SET_MSIX_NR(r3, 0x4008ae73, &(0x7f0000000100)={0x3, 0x3}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) splice(r4, 0x0, r5, 0x0, 0x4ffe0, 0x0) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r4, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="50000000020701010000000000000000070000030c00064000000000000000090900010073797a30000000002400078008000140000000111bfd07e2e095a4e59cc80908000240000000010800024000"], 0x50}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 858.673270][T28256] ? lock_downgrade+0x7f0/0x7f0 [ 858.673288][T28256] ? lock_acquire+0x197/0x420 15:22:11 executing program 4 (fault-call:5 fault-nth:12): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 858.673302][T28256] ? bpf_image_alloc+0x10/0x10 15:22:11 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 858.673323][T28256] __d_alloc+0x60d/0x8d0 [ 858.673354][T28256] d_alloc+0x4a/0x240 [ 858.673379][T28256] d_alloc_parallel+0xe8/0x1b10 [ 858.673394][T28256] ? mark_lock+0xbc/0x1220 [ 858.673408][T28256] ? arch_stack_walk+0x84/0xd0 [ 858.673432][T28256] ? __lock_acquire+0x827/0x5270 [ 858.673456][T28256] ? __d_lookup_rcu+0x6c0/0x6c0 [ 858.673487][T28256] ? lockdep_init_map+0x1b0/0x6c0 [ 858.673504][T28256] ? lockdep_init_map+0x1b0/0x6c0 [ 858.673531][T28256] __lookup_slow+0x18d/0x480 [ 858.673551][T28256] ? vfs_unlink+0x620/0x620 [ 858.673609][T28256] ? d_lookup+0x18f/0x250 [ 858.673639][T28256] lookup_one_len_unlocked+0x120/0x140 [ 858.673656][T28256] ? lookup_one_len+0x190/0x190 [ 858.673674][T28256] ? kfree+0x1eb/0x2b0 [ 858.673689][T28256] ? ovl_get_index_name+0x4e/0x70 [ 858.673712][T28256] lookup_positive_unlocked+0x22/0xc0 [ 858.673730][T28256] ovl_lookup_index+0x156/0x540 [ 858.673750][T28256] ? ovl_get_index_fh+0x1b0/0x1b0 [ 858.673762][T28256] ? ovl_lookup+0xc2e/0x1a50 [ 858.673778][T28256] ? d_alloc_parallel+0x785/0x1b10 [ 858.673804][T28256] ovl_lookup+0x762/0x1a50 [ 858.673843][T28256] ? ovl_path_next+0x2d0/0x2d0 [ 858.673884][T28256] ? __d_lookup+0x422/0x740 [ 858.673903][T28256] ? mark_held_locks+0x9f/0xe0 [ 858.673919][T28256] ? d_lookup+0xec/0x250 [ 858.673940][T28256] ? d_lookup+0x18f/0x250 [ 858.673958][T28256] ? ovl_path_next+0x2d0/0x2d0 [ 858.673974][T28256] lookup_open+0x681/0x1970 [ 858.674005][T28256] ? trailing_symlink+0x930/0x930 [ 858.674050][T28256] ? percpu_counter_add_batch+0x60/0x180 [ 858.674080][T28256] path_openat+0x1b4f/0x3230 [ 858.674105][T28256] ? __lock_acquire+0x18c3/0x5270 [ 858.674132][T28256] ? path_mountpoint.isra.0+0x370/0x370 [ 858.674152][T28256] ? __lock_acquire+0x18c3/0x5270 [ 858.674186][T28256] do_filp_open+0x192/0x260 [ 858.674207][T28256] ? may_open_dev+0xf0/0xf0 [ 858.674240][T28256] ? do_raw_spin_lock+0x129/0x2e0 [ 858.674276][T28256] ? _raw_spin_unlock+0x24/0x40 [ 858.674289][T28256] ? __alloc_fd+0x46d/0x600 [ 858.674323][T28256] do_sys_openat2+0x54c/0x740 [ 858.674346][T28256] ? file_open_root+0x3d0/0x3d0 [ 858.674362][T28256] ? __mutex_unlock_slowpath+0xe2/0x660 [ 858.674385][T28256] ? wait_for_completion+0x3c0/0x3c0 [ 858.674399][T28256] ? __this_cpu_preempt_check+0x28/0x190 [ 858.674416][T28256] ? __sb_end_write+0x101/0x1d0 [ 858.674439][T28256] do_sys_open+0xc3/0x140 [ 858.674456][T28256] ? filp_open+0x70/0x70 [ 858.674468][T28256] ? ksys_write+0x19f/0x250 [ 858.674485][T28256] ? __ia32_sys_clock_settime+0x260/0x260 [ 858.674501][T28256] ? trace_hardirqs_off_caller+0x55/0x230 [ 858.674530][T28256] do_syscall_64+0xf6/0x790 [ 858.674552][T28256] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 858.674571][T28256] RIP: 0033:0x45c849 [ 858.674587][T28256] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 858.674595][T28256] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 858.674610][T28256] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 858.674618][T28256] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 858.674626][T28256] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 858.674634][T28256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 858.674643][T28256] R13: 0000000000000771 R14: 000000000050435f R15: 000000000000000a [ 858.674876][T28256] overlayfs: failed inode index lookup (ino=16947, key=00fb1d00019a680d7ee2194783bf7022ff1ab2d298334200005cd42d02, err=-12); [ 858.674876][T28256] overlayfs: mount with '-o index=off' to disable inodes index. [ 858.904193][T28366] FAULT_INJECTION: forcing a failure. [ 858.904193][T28366] name failslab, interval 1, probability 0, space 0, times 0 [ 858.904214][T28366] CPU: 1 PID: 28366 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 858.904223][T28366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 858.904229][T28366] Call Trace: [ 858.904252][T28366] dump_stack+0x188/0x20d [ 858.904278][T28366] should_fail.cold+0x5/0x14 [ 858.904300][T28366] ? setup_fault_attr+0x1e0/0x1e0 [ 858.904334][T28366] should_failslab+0x5/0xf [ 858.904350][T28366] __kmalloc+0x2d9/0x7a0 [ 858.904366][T28366] ? ovl_alloc_entry+0x21/0x70 [ 858.904380][T28366] ? ovl_get_index_fh+0x1b0/0x1b0 [ 858.904393][T28366] ? ovl_lookup+0xc2e/0x1a50 [ 858.904423][T28366] ? d_alloc_parallel+0x785/0x1b10 [ 858.904448][T28366] ovl_alloc_entry+0x21/0x70 [ 858.904464][T28366] ovl_lookup+0x791/0x1a50 [ 858.904502][T28366] ? ovl_path_next+0x2d0/0x2d0 [ 858.904544][T28366] ? __d_lookup+0x422/0x740 [ 858.904566][T28366] ? mark_held_locks+0x9f/0xe0 [ 858.904592][T28366] ? d_lookup+0xec/0x250 [ 858.904614][T28366] ? d_lookup+0x18f/0x250 [ 858.904635][T28366] ? ovl_path_next+0x2d0/0x2d0 [ 858.904653][T28366] lookup_open+0x681/0x1970 [ 858.904684][T28366] ? trailing_symlink+0x930/0x930 [ 858.904737][T28366] ? percpu_counter_add_batch+0x60/0x180 [ 858.904772][T28366] path_openat+0x1b4f/0x3230 [ 858.904798][T28366] ? __lock_acquire+0x18c3/0x5270 [ 858.904873][T28366] ? path_mountpoint.isra.0+0x370/0x370 [ 858.904900][T28366] ? __lock_acquire+0x18c3/0x5270 [ 858.904938][T28366] do_filp_open+0x192/0x260 [ 858.904957][T28366] ? may_open_dev+0xf0/0xf0 [ 858.904989][T28366] ? do_raw_spin_lock+0x129/0x2e0 [ 858.905023][T28366] ? _raw_spin_unlock+0x24/0x40 [ 858.905038][T28366] ? __alloc_fd+0x46d/0x600 [ 858.905075][T28366] do_sys_openat2+0x54c/0x740 [ 858.905101][T28366] ? file_open_root+0x3d0/0x3d0 [ 858.905119][T28366] ? __mutex_unlock_slowpath+0xe2/0x660 [ 858.905147][T28366] ? wait_for_completion+0x3c0/0x3c0 [ 858.905164][T28366] ? __this_cpu_preempt_check+0x28/0x190 [ 858.905183][T28366] ? __sb_end_write+0x101/0x1d0 [ 858.905207][T28366] do_sys_open+0xc3/0x140 [ 858.905223][T28366] ? filp_open+0x70/0x70 [ 858.905235][T28366] ? ksys_write+0x19f/0x250 [ 858.905267][T28366] ? __ia32_sys_clock_settime+0x260/0x260 [ 858.905286][T28366] ? trace_hardirqs_off_caller+0x55/0x230 [ 858.905317][T28366] do_syscall_64+0xf6/0x790 [ 858.905340][T28366] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 858.905352][T28366] RIP: 0033:0x45c849 [ 858.905369][T28366] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 858.905378][T28366] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 858.905393][T28366] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 858.905402][T28366] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 858.905410][T28366] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 858.905419][T28366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 858.905429][T28366] R13: 0000000000000771 R14: 000000000050435f R15: 000000000000000b [ 859.178074][T28480] FAULT_INJECTION: forcing a failure. [ 859.178074][T28480] name failslab, interval 1, probability 0, space 0, times 0 [ 859.745248][T28480] CPU: 0 PID: 28480 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 859.745257][T28480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 859.745263][T28480] Call Trace: [ 859.745287][T28480] dump_stack+0x188/0x20d [ 859.745312][T28480] should_fail.cold+0x5/0x14 [ 859.745331][T28480] ? setup_fault_attr+0x1e0/0x1e0 [ 859.745361][T28480] ? ovl_destroy_inode+0x110/0x110 [ 859.745377][T28480] ? ovl_inode_test+0x50/0x50 [ 859.745390][T28480] should_failslab+0x5/0xf [ 859.745405][T28480] kmem_cache_alloc+0x29b/0x730 [ 859.745422][T28480] ? _raw_spin_unlock+0x24/0x40 [ 859.745439][T28480] ? ilookup5_nowait+0xa5/0xc0 [ 859.745452][T28480] ? ovl_get_redirect_xattr.cold+0x25/0x25 [ 859.745470][T28480] ? ovl_destroy_inode+0x110/0x110 [ 859.745485][T28480] ? ovl_get_redirect_xattr.cold+0x25/0x25 [ 859.745497][T28480] ? ovl_inode_test+0x50/0x50 [ 859.745510][T28480] ovl_alloc_inode+0x18/0x190 [ 859.745524][T28480] ? ovl_destroy_inode+0x110/0x110 [ 859.745537][T28480] alloc_inode+0x61/0x1e0 [ 859.745555][T28480] iget5_locked+0x57/0xd0 [ 859.745576][T28480] ovl_get_inode+0x9a7/0xcdd [ 859.745611][T28480] ovl_lookup+0x911/0x1a50 [ 859.745650][T28480] ? ovl_path_next+0x2d0/0x2d0 [ 859.745691][T28480] ? __d_lookup+0x422/0x740 [ 859.745723][T28480] ? d_lookup+0x18f/0x250 [ 859.745742][T28480] ? ovl_path_next+0x2d0/0x2d0 [ 859.745758][T28480] lookup_open+0x681/0x1970 [ 859.745789][T28480] ? trailing_symlink+0x930/0x930 [ 859.745834][T28480] ? percpu_counter_add_batch+0x60/0x180 [ 859.745866][T28480] path_openat+0x1b4f/0x3230 [ 859.745891][T28480] ? __lock_acquire+0x18c3/0x5270 [ 859.745917][T28480] ? path_mountpoint.isra.0+0x370/0x370 [ 859.745936][T28480] ? __lock_acquire+0x18c3/0x5270 [ 859.745972][T28480] do_filp_open+0x192/0x260 [ 859.745991][T28480] ? may_open_dev+0xf0/0xf0 [ 859.746021][T28480] ? do_raw_spin_lock+0x129/0x2e0 [ 859.746054][T28480] ? _raw_spin_unlock+0x24/0x40 [ 859.746067][T28480] ? __alloc_fd+0x46d/0x600 [ 859.746098][T28480] do_sys_openat2+0x54c/0x740 [ 859.746120][T28480] ? file_open_root+0x3d0/0x3d0 [ 859.746135][T28480] ? __mutex_unlock_slowpath+0xe2/0x660 [ 859.746157][T28480] ? wait_for_completion+0x3c0/0x3c0 [ 859.746172][T28480] ? __this_cpu_preempt_check+0x28/0x190 [ 859.746188][T28480] ? __sb_end_write+0x101/0x1d0 [ 859.746217][T28480] do_sys_open+0xc3/0x140 [ 859.746234][T28480] ? filp_open+0x70/0x70 [ 859.746246][T28480] ? ksys_write+0x19f/0x250 [ 859.746263][T28480] ? __ia32_sys_clock_settime+0x260/0x260 [ 859.746279][T28480] ? trace_hardirqs_off_caller+0x55/0x230 [ 859.746309][T28480] do_syscall_64+0xf6/0x790 [ 859.746329][T28480] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 859.746341][T28480] RIP: 0033:0x45c849 [ 859.746355][T28480] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 859.746364][T28480] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 859.746378][T28480] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 859.746386][T28480] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 859.746395][T28480] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 859.746403][T28480] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 859.746411][T28480] R13: 0000000000000771 R14: 000000000050435f R15: 000000000000000c [ 859.746732][T28480] overlayfs: failed to get inode (-12) 15:22:13 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c5", @ANYPTR], 0x0, 0x130}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:13 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x10, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20000, 0x0) recvmsg$can_j1939(r2, &(0x7f0000000400)={&(0x7f0000000080)=@isdn, 0x80, &(0x7f0000000340)=[{&(0x7f0000000100)=""/116, 0x74}, {&(0x7f0000000180)=""/253, 0xfd}, {&(0x7f00000002c0)=""/117, 0x75}], 0x3, &(0x7f0000000380)=""/95, 0x5f}, 0x40010000) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:13 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:13 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:13 executing program 4 (fault-call:5 fault-nth:13): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:22:13 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, &(0x7f0000cab000)) setregid(0x0, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:22:13 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 861.753698][T28547] FAULT_INJECTION: forcing a failure. [ 861.753698][T28547] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 861.766949][T28547] CPU: 1 PID: 28547 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 15:22:14 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000100)={0x0, 0x0}) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$inet_icmp_ICMP_FILTER(r3, 0x1, 0x1, &(0x7f0000000040)={0x306}, 0x4) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:14 executing program 4 (fault-call:5 fault-nth:14): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 861.776857][T28547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 861.776863][T28547] Call Trace: [ 861.776889][T28547] dump_stack+0x188/0x20d [ 861.776917][T28547] should_fail.cold+0x5/0x14 [ 861.776937][T28547] ? setup_fault_attr+0x1e0/0x1e0 [ 861.776960][T28547] ? find_held_lock+0x2d/0x110 15:22:14 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:14 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 861.776986][T28547] __alloc_pages_nodemask+0x17a/0x820 [ 861.777004][T28547] ? lock_downgrade+0x7f0/0x7f0 [ 861.777021][T28547] ? __alloc_pages_slowpath+0x26a0/0x26a0 [ 861.777035][T28547] ? lock_acquire+0x197/0x420 [ 861.777086][T28547] cache_grow_begin+0x8c/0xc10 [ 861.777107][T28547] ? cache_alloc_pfmemalloc+0x1e/0x140 [ 861.777130][T28547] kmem_cache_alloc+0x66a/0x730 15:22:14 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 861.777155][T28547] ? ilookup5_nowait+0xa5/0xc0 [ 861.777171][T28547] ? ovl_get_redirect_xattr.cold+0x25/0x25 [ 861.777189][T28547] ? ovl_destroy_inode+0x110/0x110 [ 861.777204][T28547] ? ovl_get_redirect_xattr.cold+0x25/0x25 [ 861.777217][T28547] ? ovl_inode_test+0x50/0x50 [ 861.777232][T28547] ovl_alloc_inode+0x18/0x190 [ 861.777248][T28547] ? ovl_destroy_inode+0x110/0x110 [ 861.777264][T28547] alloc_inode+0x61/0x1e0 [ 861.777285][T28547] iget5_locked+0x57/0xd0 [ 861.777310][T28547] ovl_get_inode+0x9a7/0xcdd [ 861.777339][T28547] ovl_lookup+0x911/0x1a50 [ 861.777379][T28547] ? ovl_path_next+0x2d0/0x2d0 [ 861.777423][T28547] ? __d_lookup+0x422/0x740 [ 861.777458][T28547] ? d_lookup+0x18f/0x250 [ 861.777478][T28547] ? ovl_path_next+0x2d0/0x2d0 [ 861.777496][T28547] lookup_open+0x681/0x1970 [ 861.777528][T28547] ? trailing_symlink+0x930/0x930 [ 861.777572][T28547] ? percpu_counter_add_batch+0x60/0x180 [ 861.777603][T28547] path_openat+0x1b4f/0x3230 [ 861.777629][T28547] ? __lock_acquire+0x18c3/0x5270 [ 861.777655][T28547] ? path_mountpoint.isra.0+0x370/0x370 [ 861.777676][T28547] ? __lock_acquire+0x18c3/0x5270 [ 861.777711][T28547] do_filp_open+0x192/0x260 [ 861.777729][T28547] ? may_open_dev+0xf0/0xf0 [ 861.777759][T28547] ? do_raw_spin_lock+0x129/0x2e0 [ 861.777793][T28547] ? _raw_spin_unlock+0x24/0x40 [ 861.777808][T28547] ? __alloc_fd+0x46d/0x600 [ 861.777842][T28547] do_sys_openat2+0x54c/0x740 [ 861.777865][T28547] ? file_open_root+0x3d0/0x3d0 [ 861.777879][T28547] ? __mutex_unlock_slowpath+0xe2/0x660 [ 861.777902][T28547] ? wait_for_completion+0x3c0/0x3c0 [ 861.777916][T28547] ? __this_cpu_preempt_check+0x28/0x190 [ 861.777933][T28547] ? __sb_end_write+0x101/0x1d0 [ 861.777956][T28547] do_sys_open+0xc3/0x140 [ 861.777974][T28547] ? filp_open+0x70/0x70 [ 861.777986][T28547] ? ksys_write+0x19f/0x250 [ 861.778004][T28547] ? __ia32_sys_clock_settime+0x260/0x260 [ 861.778021][T28547] ? trace_hardirqs_off_caller+0x55/0x230 [ 861.778050][T28547] do_syscall_64+0xf6/0x790 [ 861.778083][T28547] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 861.778096][T28547] RIP: 0033:0x45c849 [ 861.778113][T28547] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 861.778121][T28547] RSP: 002b:00007f5cc87ecc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 861.778137][T28547] RAX: ffffffffffffffda RBX: 00007f5cc87ed6d4 RCX: 000000000045c849 [ 861.778146][T28547] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 861.778155][T28547] RBP: 000000000076bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 861.778164][T28547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 861.778173][T28547] R13: 0000000000000771 R14: 000000000050435f R15: 000000000000000d [ 862.112980][T28650] FAULT_INJECTION: forcing a failure. [ 862.112980][T28650] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 862.113001][T28650] CPU: 1 PID: 28650 Comm: syz-executor.4 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 862.113010][T28650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 862.113015][T28650] Call Trace: [ 862.113039][T28650] dump_stack+0x188/0x20d [ 862.113064][T28650] should_fail.cold+0x5/0x14 [ 862.113094][T28650] ? setup_fault_attr+0x1e0/0x1e0 [ 862.113129][T28650] __alloc_pages_nodemask+0x17a/0x820 [ 862.113146][T28650] ? lockdep_hardirqs_on+0x417/0x5d0 [ 862.113165][T28650] ? __alloc_pages_slowpath+0x26a0/0x26a0 [ 862.113179][T28650] ? mark_lock+0xbc/0x1220 [ 862.113207][T28650] ? __lock_acquire+0x827/0x5270 [ 862.113236][T28650] cache_grow_begin+0x8c/0xc10 [ 862.113254][T28650] ? cache_alloc_pfmemalloc+0x1e/0x140 [ 862.113275][T28650] __kmalloc+0x6d6/0x7a0 [ 862.113309][T28650] ? tomoyo_realpath_from_path+0xc2/0x620 [ 862.113342][T28650] tomoyo_realpath_from_path+0xc2/0x620 [ 862.113380][T28650] tomoyo_check_open_permission+0x26d/0x370 [ 862.113400][T28650] ? tomoyo_path_number_perm+0x4d0/0x4d0 [ 862.113472][T28650] ? lock_downgrade+0x7f0/0x7f0 [ 862.113486][T28650] ? do_raw_spin_lock+0x129/0x2e0 [ 862.113506][T28650] ? rwlock_bug.part.0+0x90/0x90 [ 862.113529][T28650] tomoyo_file_open+0x9d/0xc0 [ 862.113551][T28650] security_file_open+0x6a/0x2e0 [ 862.113579][T28650] do_dentry_open+0x346/0x1250 [ 862.113609][T28650] ? security_inode_permission+0xc4/0xf0 [ 862.113628][T28650] ? chown_common+0x550/0x550 [ 862.113646][T28650] ? inode_permission+0xab/0x500 [ 862.113675][T28650] path_openat+0x122a/0x3230 [ 862.113717][T28650] ? path_mountpoint.isra.0+0x370/0x370 [ 862.113761][T28650] do_filp_open+0x192/0x260 [ 862.113779][T28650] ? may_open_dev+0xf0/0xf0 [ 862.113811][T28650] ? do_raw_spin_lock+0x129/0x2e0 [ 862.113849][T28650] ? _raw_spin_unlock+0x24/0x40 [ 862.113865][T28650] ? __alloc_fd+0x46d/0x600 [ 862.113899][T28650] do_sys_openat2+0x54c/0x740 [ 862.113922][T28650] ? file_open_root+0x3d0/0x3d0 [ 862.113938][T28650] ? __mutex_unlock_slowpath+0xe2/0x660 [ 862.113962][T28650] ? wait_for_completion+0x3c0/0x3c0 [ 862.113976][T28650] ? __this_cpu_preempt_check+0x28/0x190 [ 862.113992][T28650] ? __sb_end_write+0x101/0x1d0 [ 862.114016][T28650] do_sys_open+0xc3/0x140 [ 862.114033][T28650] ? filp_open+0x70/0x70 [ 862.114045][T28650] ? ksys_write+0x19f/0x250 [ 862.114062][T28650] ? __ia32_sys_clock_settime+0x260/0x260 [ 862.114087][T28650] ? trace_hardirqs_off_caller+0x55/0x230 [ 862.114118][T28650] do_syscall_64+0xf6/0x790 [ 862.114140][T28650] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 862.114152][T28650] RIP: 0033:0x45c849 [ 862.114167][T28650] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 862.114175][T28650] RSP: 002b:00007f5cc880dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 862.114191][T28650] RAX: ffffffffffffffda RBX: 00007f5cc880e6d4 RCX: 000000000045c849 [ 862.114200][T28650] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200001c0 [ 862.114209][T28650] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 862.114218][T28650] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 862.114226][T28650] R13: 0000000000000771 R14: 000000000050435f R15: 000000000000000e 15:22:16 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c5", @ANYPTR], 0x0, 0x130}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:16 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00'}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:16 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:16 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, &(0x7f0000cab000)) setregid(0x0, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:22:16 executing program 4 (fault-call:5 fault-nth:15): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:22:16 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x8000, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r2, 0xc0305602, &(0x7f0000000080)={0x0, 0x9, 0x2021, 0x1}) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:17 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:22:17 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, 0x0, 0x0) 15:22:17 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00'}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:17 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, 0x0, 0x0) 15:22:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x2, 0x0) [ 865.546328][T28850] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 865.937436][ T0] NOHZ: local_softirq_pending 08 15:22:20 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d", @ANYPTR], 0x0, 0x13a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:20 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00'}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:20 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, 0x0, 0x0) 15:22:20 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x600401, 0x0) ioctl$RTC_UIE_OFF(r0, 0x7004) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$inet_udp_int(r2, 0x11, 0xa, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(r3, 0x0, r4, 0x0, 0x4ffe0, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(r3, 0xc040563e, &(0x7f0000000080)={0x1, 0x0, 0x1, 0x2, {0x4, 0x7ff, 0x0, 0x1}}) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_buf(r1, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r5, 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x80000000002c00) 15:22:20 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x3, 0x0) 15:22:20 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, &(0x7f0000cab000)) setregid(0x0, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:22:20 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 15:22:20 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x4, 0x0) 15:22:20 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000080)=[@timestamp, @window={0x3, 0x20, 0x8000}, @mss={0x2, 0x3a500}, @timestamp, @window={0x3, 0x200, 0x6}], 0x5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 868.009112][T28921] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:20 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 15:22:20 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:20 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x5, 0x0) [ 868.282848][T29026] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 868.456817][T29088] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:23 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d", @ANYPTR], 0x0, 0x13a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:23 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 15:22:23 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x100, 0x5, @mcast1, 0x8000}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) ioctl$SNDCTL_DSP_GETIPTR(r1, 0x800c5011, &(0x7f0000000040)) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() ioctl$TCSETXW(r1, 0x5435, &(0x7f0000000080)={0x5, 0x2, [0x1, 0xffff, 0x3, 0x3, 0x6], 0x1}) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) write$binfmt_elf32(r4, &(0x7f0000000100)={{0x7f, 0x45, 0x4c, 0x46, 0x9, 0x7, 0x9, 0x7, 0x36, 0x3, 0x3, 0x4, 0x2b6, 0x38, 0x85, 0x6, 0xe403, 0x20, 0x1, 0x3ff, 0x40, 0x6}, [{0x4, 0x40, 0x0, 0x641, 0x2, 0x7, 0x20, 0xffff}], "11d3583025d8a413c0525d9f9e87fce9038d98ea29f15a1bd886477540c90aafd40910613afa803b33e1afe308d758db49b82f57e8025fde3f13fc3404537d9a4bbe6489d1379e7507ec086a0eb933a74227356322d3f861d65aac1b4c1c01edef4d049ffea119bf06abb658b222bc77974dcbd033afe79bd98f69c9fef237a8423e30bf4e334a39551a4033414e85e075302e491b5b934d414c851b1a8d1d7f19e1adb6e7b576c1d146289d531ea083bd0022336dd4dfe775466aa191fb5b17fae610c67b530e9d4e0b056e923671718cd65f27fc0e13"}, 0x12f) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:23 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:23 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x6, 0x0) 15:22:23 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, 0x0) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:23 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) 15:22:23 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x7, 0x0) 15:22:23 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$X25_QBITINCL(r2, 0x106, 0x1, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 871.100945][T29137] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:23 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:23 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) 15:22:23 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) [ 871.392483][T29246] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:26 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d", @ANYPTR], 0x0, 0x13a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:26 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x8, 0x0) 15:22:26 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) 15:22:26 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x0, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:26 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="f0000000100013070000000000000000fe8000000000000000000000000000aae00000020000000000000000000000000a0000a000000000f79cd2cfb2df5deda6fb1e8a3126c03b5d3c74e683ce8eefcc96d731cd59725dcd0d38f88dd738d2530c0eef695a7e6344664613352e608959127ea21e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) ioctl$VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000080)={0x0, 0xc, 0x4, 0x2000, 0x8, {r4, r5/1000+30000}, {0x1, 0x2, 0x1, 0x40, 0x7, 0x8, "8aa1c314"}, 0x9, 0x1, @userptr, 0x7, 0x0, r6}) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r7, 0xc0045520, &(0x7f0000000100)=0x9) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:26 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, 0x0) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:26 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x0, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:26 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xc, 0x0) 15:22:26 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) [ 874.270018][T29386] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:26 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x0, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:26 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}]}, 0x28}}, 0x0) 15:22:26 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x12, 0x0) [ 874.544313][T29455] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 874.771012][T29462] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:29 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad38", @ANYPTR], 0x0, 0x13f}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:29 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) 15:22:29 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}]}, 0x28}}, 0x0) 15:22:29 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) openat$capi20(0xffffffffffffff9c, &(0x7f0000000040)='/dev/capi20\x00', 0x46040, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:29 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xc0, 0x0) 15:22:29 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, 0x0) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:29 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}]}, 0x28}}, 0x0) 15:22:29 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xf0, 0x0) [ 877.336683][T29524] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:29 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) 15:22:29 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x34}}, 0x0) 15:22:29 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x34}}, 0x0) 15:22:29 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x300, 0x0) [ 877.672042][T29593] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 877.947466][T29602] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:32 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad38", @ANYPTR], 0x0, 0x13f}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:32 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x34}}, 0x0) 15:22:32 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) 15:22:32 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x500, 0x0) 15:22:32 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r2 = getpid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="850000000700000035000000000034008500000008000000950000000000000018d11c1c1f61ac44640091fa5be1a52d392cc2b941db86d50ad2150ab0565c24fea89999717718057c6ca96e58fd6a2f8c17e768e2a052ff599a29362cc47476790dd2eb1304db8fb7e6cbcf2f4a82807783aa8f9fc6dd189455283c0264a57761e5230b046dc7186924b25431abc43adfca6a17375dfc75e110ddb5ac34a7f6eb25c76894c70c4c568edebbe7460006c119abcdba8ed5e3f6daa38a60dd1e3727f124d78fcbab2ab6327b9ca170ae2b0d70cced3bf2969e"], &(0x7f0000000140)='GPL\x00', 0x0, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffc1a}, 0x15) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000080)={r3, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r4}, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r2, 0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000100)='mime_type%\\\\+\\\x00', r4}, 0x30) r6 = getpid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r6, 0x0, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000180)={{0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8}, 0x0, 0x0, 0x6, 0x100000000, 0xffffffffffff49cc, 0x20, 0x3, 0x800, 0x1, 0xc34, r5, r6}) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:32 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) setregid(0x0, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) 15:22:32 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:32 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x600, 0x0) [ 880.400115][T29630] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:32 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) 15:22:32 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:32 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x700, 0x0) [ 880.696116][T29731] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:33 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 880.946783][T29739] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:35 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad38", @ANYPTR], 0x0, 0x13f}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:35 executing program 0 (fault-call:8 fault-nth:0): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:35 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:35 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xc00, 0x0) 15:22:35 executing program 1 (fault-call:7 fault-nth:0): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:35 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) setregid(0x0, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) [ 883.409893][T29756] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 883.413925][T29751] FAULT_INJECTION: forcing a failure. [ 883.413925][T29751] name failslab, interval 1, probability 0, space 0, times 0 15:22:35 executing program 1 (fault-call:7 fault-nth:1): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:35 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x1200, 0x0) 15:22:35 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) ioctl$MON_IOCX_GET(r1, 0x40189206, &(0x7f0000000180)={&(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000080)=""/231, 0xe7}) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 883.481024][T29751] CPU: 0 PID: 29751 Comm: syz-executor.1 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 883.481034][T29751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 883.481039][T29751] Call Trace: [ 883.481061][T29751] dump_stack+0x188/0x20d [ 883.481092][T29751] should_fail.cold+0x5/0x14 [ 883.481108][T29751] ? lock_downgrade+0x7f0/0x7f0 15:22:35 executing program 1 (fault-call:7 fault-nth:2): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 883.481123][T29751] ? setup_fault_attr+0x1e0/0x1e0 [ 883.481154][T29751] should_failslab+0x5/0xf [ 883.481168][T29751] kmem_cache_alloc_node+0x25c/0x760 [ 883.481224][T29751] __alloc_skb+0xba/0x5a0 [ 883.481243][T29751] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 883.481269][T29751] ? netlink_autobind.isra.0+0x21b/0x300 [ 883.481291][T29751] netlink_sendmsg+0x97b/0xe10 [ 883.481319][T29751] ? aa_af_perm+0x260/0x260 15:22:35 executing program 1 (fault-call:7 fault-nth:3): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 883.481333][T29751] ? netlink_unicast+0x740/0x740 [ 883.481361][T29751] ? netlink_unicast+0x740/0x740 [ 883.481379][T29751] sock_sendmsg+0xcf/0x120 [ 883.481398][T29751] ____sys_sendmsg+0x6b9/0x7d0 [ 883.481419][T29751] ? kernel_sendmsg+0x50/0x50 [ 883.481456][T29751] ___sys_sendmsg+0x100/0x170 [ 883.481477][T29751] ? sendmsg_copy_msghdr+0x70/0x70 [ 883.481516][T29751] ? __fget_files+0x329/0x4f0 [ 883.481541][T29751] ? do_dup2+0x520/0x520 [ 883.481571][T29751] ? __fget_light+0x208/0x270 [ 883.481594][T29751] __sys_sendmsg+0xec/0x1b0 [ 883.481607][T29751] ? __sys_sendmsg_sock+0xb0/0xb0 [ 883.481622][T29751] ? vfs_write+0x15b/0x5c0 [ 883.481654][T29751] ? trace_hardirqs_off_caller+0x55/0x230 [ 883.481675][T29751] ? do_syscall_64+0x21/0x790 [ 883.481696][T29751] do_syscall_64+0xf6/0x790 [ 883.481718][T29751] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 883.481729][T29751] RIP: 0033:0x45c849 [ 883.481743][T29751] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 883.481750][T29751] RSP: 002b:00007f718be25c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 883.481762][T29751] RAX: ffffffffffffffda RBX: 00007f718be266d4 RCX: 000000000045c849 [ 883.481770][T29751] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 [ 883.481777][T29751] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 883.481784][T29751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 883.481791][T29751] R13: 00000000000009fc R14: 00000000004ccb3c R15: 0000000000000000 [ 883.497739][T29831] FAULT_INJECTION: forcing a failure. [ 883.497739][T29831] name failslab, interval 1, probability 0, space 0, times 0 [ 883.497767][T29831] CPU: 0 PID: 29831 Comm: syz-executor.0 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 883.497776][T29831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 883.497781][T29831] Call Trace: [ 883.497804][T29831] dump_stack+0x188/0x20d [ 883.497829][T29831] should_fail.cold+0x5/0x14 [ 883.497848][T29831] ? setup_fault_attr+0x1e0/0x1e0 [ 883.497880][T29831] should_failslab+0x5/0xf [ 883.497894][T29831] __kmalloc+0x2d9/0x7a0 [ 883.497909][T29831] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 883.497922][T29831] ? tomoyo_realpath_from_path+0xc2/0x620 [ 883.497937][T29831] ? lockdep_hardirqs_on+0x417/0x5d0 [ 883.497953][T29831] ? _raw_spin_unlock_irq+0x55/0x80 [ 883.498025][T29831] ? finish_task_switch+0x147/0x750 [ 883.498048][T29831] tomoyo_realpath_from_path+0xc2/0x620 [ 883.498065][T29831] ? tomoyo_path_number_perm+0x17a/0x4d0 [ 883.498093][T29831] tomoyo_path_number_perm+0x1c2/0x4d0 [ 883.498108][T29831] ? tomoyo_path_number_perm+0x17a/0x4d0 [ 883.498128][T29831] ? tomoyo_execute_permission+0x470/0x470 [ 883.498146][T29831] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 883.498177][T29831] ? __fget_files+0x307/0x4f0 [ 883.498225][T29831] ? __fget_files+0x329/0x4f0 15:22:36 executing program 0 (fault-call:8 fault-nth:1): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 883.498247][T29831] ? do_dup2+0x520/0x520 [ 883.498264][T29831] ? vfs_write+0x15b/0x5c0 [ 883.498288][T29831] security_file_ioctl+0x6c/0xb0 [ 883.498308][T29831] ksys_ioctl+0x50/0x180 [ 883.498334][T29831] __x64_sys_ioctl+0x6f/0xb0 [ 883.498347][T29831] ? lockdep_hardirqs_on+0x417/0x5d0 [ 883.498363][T29831] do_syscall_64+0xf6/0x790 [ 883.498384][T29831] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 883.498396][T29831] RIP: 0033:0x45c849 [ 883.498410][T29831] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 883.498418][T29831] RSP: 002b:00007f40d6feec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 883.498431][T29831] RAX: ffffffffffffffda RBX: 00007f40d6fef6d4 RCX: 000000000045c849 [ 883.498440][T29831] RDX: 00000000200000c0 RSI: 00000000400454ca RDI: 0000000000000004 [ 883.498448][T29831] RBP: 000000000076bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 883.498456][T29831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 883.498465][T29831] R13: 00000000000005a1 R14: 00000000004c83a9 R15: 0000000000000000 [ 883.498572][T29831] ERROR: Out of memory at tomoyo_realpath_from_path. [ 883.612615][T29862] FAULT_INJECTION: forcing a failure. [ 883.612615][T29862] name failslab, interval 1, probability 0, space 0, times 0 [ 883.612634][T29862] CPU: 0 PID: 29862 Comm: syz-executor.1 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 883.612642][T29862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 883.612647][T29862] Call Trace: [ 883.612669][T29862] dump_stack+0x188/0x20d [ 883.612694][T29862] should_fail.cold+0x5/0x14 [ 883.612710][T29862] ? lock_downgrade+0x7f0/0x7f0 [ 883.612725][T29862] ? setup_fault_attr+0x1e0/0x1e0 [ 883.612757][T29862] should_failslab+0x5/0xf [ 883.612773][T29862] kmem_cache_alloc_node_trace+0x27c/0x790 [ 883.612790][T29862] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 883.612821][T29862] __kmalloc_node_track_caller+0x38/0x60 [ 883.612842][T29862] __kmalloc_reserve.isra.0+0x39/0xe0 [ 883.612864][T29862] __alloc_skb+0xef/0x5a0 [ 883.612883][T29862] ? __kmalloc_reserve.isra.0+0xe0/0xe0 [ 883.612904][T29862] ? netlink_autobind.isra.0+0x21b/0x300 [ 883.612925][T29862] netlink_sendmsg+0x97b/0xe10 [ 883.612950][T29862] ? aa_af_perm+0x260/0x260 [ 883.612965][T29862] ? netlink_unicast+0x740/0x740 [ 883.612995][T29862] ? netlink_unicast+0x740/0x740 [ 883.613012][T29862] sock_sendmsg+0xcf/0x120 [ 883.613031][T29862] ____sys_sendmsg+0x6b9/0x7d0 [ 883.613062][T29862] ? kernel_sendmsg+0x50/0x50 [ 883.613103][T29862] ___sys_sendmsg+0x100/0x170 [ 883.613123][T29862] ? sendmsg_copy_msghdr+0x70/0x70 [ 883.613156][T29862] ? __fget_files+0x329/0x4f0 [ 883.613179][T29862] ? do_dup2+0x520/0x520 [ 883.613209][T29862] ? __fget_light+0x208/0x270 [ 883.613235][T29862] __sys_sendmsg+0xec/0x1b0 [ 883.613250][T29862] ? __sys_sendmsg_sock+0xb0/0xb0 [ 883.613265][T29862] ? vfs_write+0x15b/0x5c0 [ 883.613296][T29862] ? trace_hardirqs_off_caller+0x55/0x230 [ 883.613316][T29862] ? do_syscall_64+0x21/0x790 [ 883.613337][T29862] do_syscall_64+0xf6/0x790 [ 883.613358][T29862] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 883.613370][T29862] RIP: 0033:0x45c849 [ 883.613392][T29862] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 883.613400][T29862] RSP: 002b:00007f718be25c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 883.613414][T29862] RAX: ffffffffffffffda RBX: 00007f718be266d4 RCX: 000000000045c849 [ 883.613422][T29862] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 [ 883.613431][T29862] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 883.613439][T29862] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 883.613447][T29862] R13: 00000000000009fc R14: 00000000004ccb3c R15: 0000000000000001 [ 883.726187][T29868] FAULT_INJECTION: forcing a failure. [ 883.726187][T29868] name failslab, interval 1, probability 0, space 0, times 0 [ 883.726207][T29868] CPU: 0 PID: 29868 Comm: syz-executor.1 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 883.726215][T29868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 883.726221][T29868] Call Trace: [ 883.726245][T29868] dump_stack+0x188/0x20d [ 883.726272][T29868] should_fail.cold+0x5/0x14 [ 883.726292][T29868] ? setup_fault_attr+0x1e0/0x1e0 [ 883.726316][T29868] ? mark_held_locks+0xe0/0xe0 [ 883.726340][T29868] should_failslab+0x5/0xf [ 883.726355][T29868] kmem_cache_alloc+0x44/0x730 [ 883.726376][T29868] ? lock_acquire+0x197/0x420 [ 883.726398][T29868] skb_clone+0x14d/0x3c0 [ 883.726421][T29868] netlink_deliver_tap+0x91c/0xb50 [ 883.726452][T29868] netlink_unicast+0x5e9/0x740 [ 883.726479][T29868] ? netlink_attachskb+0x810/0x810 [ 883.726494][T29868] ? _copy_from_iter_full+0x25c/0x870 [ 883.726563][T29868] ? __phys_addr_symbol+0x2c/0x70 [ 883.726581][T29868] ? __check_object_size+0x171/0x437 [ 883.726607][T29868] netlink_sendmsg+0x882/0xe10 [ 883.726634][T29868] ? aa_af_perm+0x260/0x260 [ 883.726649][T29868] ? netlink_unicast+0x740/0x740 [ 883.726680][T29868] ? netlink_unicast+0x740/0x740 [ 883.726698][T29868] sock_sendmsg+0xcf/0x120 [ 883.726718][T29868] ____sys_sendmsg+0x6b9/0x7d0 [ 883.726741][T29868] ? kernel_sendmsg+0x50/0x50 [ 883.726783][T29868] ___sys_sendmsg+0x100/0x170 [ 883.726805][T29868] ? sendmsg_copy_msghdr+0x70/0x70 [ 883.726841][T29868] ? __fget_files+0x329/0x4f0 [ 883.726866][T29868] ? do_dup2+0x520/0x520 [ 883.726899][T29868] ? __fget_light+0x208/0x270 [ 883.726936][T29868] __sys_sendmsg+0xec/0x1b0 [ 883.726953][T29868] ? __sys_sendmsg_sock+0xb0/0xb0 [ 883.726968][T29868] ? vfs_write+0x15b/0x5c0 [ 883.727002][T29868] ? trace_hardirqs_off_caller+0x55/0x230 [ 883.727023][T29868] ? do_syscall_64+0x21/0x790 [ 883.727044][T29868] do_syscall_64+0xf6/0x790 [ 883.727066][T29868] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 883.727079][T29868] RIP: 0033:0x45c849 [ 883.727094][T29868] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 883.727112][T29868] RSP: 002b:00007f718be25c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 883.727127][T29868] RAX: ffffffffffffffda RBX: 00007f718be266d4 RCX: 000000000045c849 [ 883.727136][T29868] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 [ 883.727146][T29868] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 883.727155][T29868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 883.727163][T29868] R13: 00000000000009fc R14: 00000000004ccb3c R15: 0000000000000002 [ 883.764691][T29900] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 883.829927][T29902] FAULT_INJECTION: forcing a failure. [ 883.829927][T29902] name failslab, interval 1, probability 0, space 0, times 0 [ 884.284089][T29978] FAULT_INJECTION: forcing a failure. [ 884.284089][T29978] name failslab, interval 1, probability 0, space 0, times 0 [ 884.289739][T29902] CPU: 0 PID: 29902 Comm: syz-executor.1 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 884.750957][T29902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 884.750964][T29902] Call Trace: [ 884.750993][T29902] dump_stack+0x188/0x20d [ 884.751018][T29902] should_fail.cold+0x5/0x14 [ 884.751037][T29902] ? setup_fault_attr+0x1e0/0x1e0 [ 884.751068][T29902] should_failslab+0x5/0xf [ 884.751092][T29902] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 884.751178][T29902] ? rtnetlink_rcv_msg+0x1d6/0xad0 [ 884.751202][T29902] rtnl_newlink+0x46/0xa0 [ 884.751217][T29902] ? __rtnl_newlink+0x1590/0x1590 [ 884.751233][T29902] rtnetlink_rcv_msg+0x44e/0xad0 [ 884.751255][T29902] ? rtnl_bridge_getlink+0x880/0x880 [ 884.751278][T29902] ? netdev_core_pick_tx+0x2e0/0x2e0 [ 884.751297][T29902] ? __copy_skb_header+0x290/0x5b0 [ 884.751314][T29902] ? skb_splice_bits+0x1a0/0x1a0 [ 884.751327][T29902] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 884.751339][T29902] ? kmem_cache_alloc+0x261/0x730 [ 884.751362][T29902] netlink_rcv_skb+0x15a/0x410 [ 884.751380][T29902] ? rtnl_bridge_getlink+0x880/0x880 [ 884.751397][T29902] ? netlink_ack+0xa80/0xa80 [ 884.751438][T29902] netlink_unicast+0x537/0x740 [ 884.751461][T29902] ? netlink_attachskb+0x810/0x810 [ 884.751474][T29902] ? _copy_from_iter_full+0x25c/0x870 [ 884.751490][T29902] ? __phys_addr_symbol+0x2c/0x70 [ 884.751505][T29902] ? __check_object_size+0x171/0x437 [ 884.751527][T29902] netlink_sendmsg+0x882/0xe10 [ 884.751552][T29902] ? aa_af_perm+0x260/0x260 [ 884.751566][T29902] ? netlink_unicast+0x740/0x740 [ 884.751596][T29902] ? netlink_unicast+0x740/0x740 [ 884.751613][T29902] sock_sendmsg+0xcf/0x120 [ 884.751632][T29902] ____sys_sendmsg+0x6b9/0x7d0 [ 884.751653][T29902] ? kernel_sendmsg+0x50/0x50 [ 884.751693][T29902] ___sys_sendmsg+0x100/0x170 [ 884.751713][T29902] ? sendmsg_copy_msghdr+0x70/0x70 [ 884.751744][T29902] ? __fget_files+0x329/0x4f0 [ 884.751767][T29902] ? do_dup2+0x520/0x520 [ 884.751798][T29902] ? __fget_light+0x208/0x270 [ 884.751823][T29902] __sys_sendmsg+0xec/0x1b0 [ 884.751837][T29902] ? __sys_sendmsg_sock+0xb0/0xb0 [ 884.751852][T29902] ? vfs_write+0x15b/0x5c0 [ 884.751883][T29902] ? trace_hardirqs_off_caller+0x55/0x230 [ 884.751903][T29902] ? do_syscall_64+0x21/0x790 [ 884.751923][T29902] do_syscall_64+0xf6/0x790 [ 884.751945][T29902] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 884.751957][T29902] RIP: 0033:0x45c849 [ 884.751971][T29902] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 884.751979][T29902] RSP: 002b:00007f718be25c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 884.751992][T29902] RAX: ffffffffffffffda RBX: 00007f718be266d4 RCX: 000000000045c849 [ 884.752000][T29902] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 [ 884.752007][T29902] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 884.752015][T29902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 884.752029][T29902] R13: 00000000000009fc R14: 00000000004ccb3c R15: 0000000000000003 [ 884.760540][T29978] CPU: 1 PID: 29978 Comm: syz-executor.0 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 885.055457][T29978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 885.065691][T29978] Call Trace: [ 885.069003][T29978] dump_stack+0x188/0x20d [ 885.073361][T29978] should_fail.cold+0x5/0x14 [ 885.078065][T29978] ? setup_fault_attr+0x1e0/0x1e0 [ 885.083109][T29978] should_failslab+0x5/0xf [ 885.087869][T29978] __kmalloc+0x2d9/0x7a0 [ 885.092125][T29978] ? tomoyo_encode2.part.0+0xec/0x3b0 [ 885.097587][T29978] ? d_absolute_path+0x10c/0x160 [ 885.102530][T29978] ? __d_path+0x140/0x140 [ 885.106896][T29978] tomoyo_encode2.part.0+0xec/0x3b0 [ 885.112107][T29978] tomoyo_encode+0x28/0x50 [ 885.116533][T29978] tomoyo_realpath_from_path+0x184/0x620 [ 885.122186][T29978] tomoyo_path_number_perm+0x1c2/0x4d0 [ 885.127638][T29978] ? tomoyo_path_number_perm+0x17a/0x4d0 [ 885.133279][T29978] ? tomoyo_execute_permission+0x470/0x470 [ 885.139103][T29978] ? get_pid_task+0x116/0x200 [ 885.143800][T29978] ? __fget_files+0x307/0x4f0 [ 885.148504][T29978] ? __fget_files+0x329/0x4f0 [ 885.153185][T29978] ? do_dup2+0x520/0x520 [ 885.157426][T29978] ? __sb_end_write+0x101/0x1d0 [ 885.162276][T29978] ? vfs_write+0x15b/0x5c0 [ 885.166708][T29978] security_file_ioctl+0x6c/0xb0 [ 885.171653][T29978] ksys_ioctl+0x50/0x180 [ 885.175898][T29978] __x64_sys_ioctl+0x6f/0xb0 [ 885.180486][T29978] ? lockdep_hardirqs_on+0x417/0x5d0 [ 885.186641][T29978] do_syscall_64+0xf6/0x790 [ 885.191149][T29978] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 885.197039][T29978] RIP: 0033:0x45c849 [ 885.200929][T29978] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 885.220537][T29978] RSP: 002b:00007f40d6facc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 885.228959][T29978] RAX: ffffffffffffffda RBX: 00007f40d6fad6d4 RCX: 000000000045c849 [ 885.236943][T29978] RDX: 00000000200000c0 RSI: 00000000400454ca RDI: 0000000000000004 [ 885.244915][T29978] RBP: 000000000076c0e0 R08: 0000000000000000 R09: 0000000000000000 [ 885.252898][T29978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 885.260871][T29978] R13: 00000000000005a1 R14: 00000000004c83a9 R15: 0000000000000001 [ 885.315253][T29978] ERROR: Out of memory at tomoyo_realpath_from_path. 15:22:38 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad38786408", @ANYPTR], 0x0, 0x142}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:38 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x2635, 0x0) 15:22:38 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) 15:22:38 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:38 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:38 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) setregid(0x0, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) [ 886.411998][ T0] NOHZ: local_softirq_pending 08 15:22:38 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:38 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x2639, 0x0) [ 886.651289][T30095] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:39 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) close(0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000140)) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000100)=0x80000001, 0x4) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f00000001000130700000000000000008be000000200000000000000000000000000000000000000000a0000a000000000000000000000000000ff0000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) ioctl$VIDIOC_QUERYBUF(r0, 0xc0585609, &(0x7f0000000040)={0x1, 0x7, 0x4, 0x40, 0xfffffffd, {0x77359400}, {0x5, 0x2, 0x7f, 0xf7, 0x3, 0x5, "2a03a253"}, 0x2, 0x4, @offset=0x9, 0x7fff, 0x0, r3}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f00000000c0)) 15:22:39 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x2, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x3526, 0x0) 15:22:39 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x2, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 886.957886][T30105] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 887.307390][T30214] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 888.334218][ T0] NOHZ: local_softirq_pending 08 15:22:41 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad38786408", @ANYPTR], 0x0, 0x142}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:41 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x3926, 0x0) 15:22:41 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x14, r2, 0x605, 0x0, 0x0, {0xf}}, 0x14}}, 0x0) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r2, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_buf(r3, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r4, 0x3, 0x0) fcntl$setstatus(r3, 0x4, 0x80000000002c00) 15:22:41 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x3, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:41 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x10, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:41 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, 0x0, &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:41 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x4, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:41 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) socketpair(0xf, 0x80000, 0x6, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:41 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x3f00, 0x0) [ 889.724031][T30318] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:42 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x541b, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:42 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x6, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:42 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xc000, 0x0) [ 889.937885][T30408] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 890.145635][T30457] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:44 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad38786408", @ANYPTR], 0x0, 0x142}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:44 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000100)=@int=0x200, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000080)) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r3, 0xc008551b, &(0x7f0000000040)={0x5, 0x4, [0x5]}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x4102000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_buf(r2, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r4, 0x0, 0x0) fcntl$setstatus(r2, 0x4, 0x80000000002c00) 15:22:44 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xf000, 0x0) 15:22:44 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x9, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:44 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x5421, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:44 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, 0x0, &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:44 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xff00, 0x0) 15:22:44 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000240)=[@timestamp, @window={0x3, 0x2, 0x8}, @sack_perm, @sack_perm, @window={0x3, 0x2}], 0x5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r3}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, 0x0, 0x10, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x34}, 0x1, 0x0, 0x0, 0x50}, 0x4004000) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 892.722053][T30560] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:45 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xa, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:45 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xf0ffff, 0x0) [ 892.907813][T30636] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:45 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x5450, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:45 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000040)) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 893.084276][T30694] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:47 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848", @ANYPTR], 0x0, 0x143}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:47 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xc, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:47 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x1000000, 0x0) 15:22:47 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) fcntl$setstatus(r2, 0x4, 0x80000000006c00) 15:22:47 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x5451, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:47 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, 0x0, &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:48 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x2000000, 0x0) [ 895.848063][T30861] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:48 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x5452, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:48 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x3000000, 0x0) 15:22:48 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xe, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:48 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) prctl$PR_GET_NO_NEW_PRIVS(0x27) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x6) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) wait4(r2, 0x0, 0x0, &(0x7f0000000040)) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {0x0, 0x0, 0x0, 0x7}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) fcntl$setstatus(r4, 0x4, 0x0) [ 896.067017][T30925] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:48 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x4000000, 0x0) [ 896.334649][T31016] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 896.513696][T31042] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 896.655642][ T0] NOHZ: local_softirq_pending 08 15:22:50 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848", @ANYPTR], 0x0, 0x143}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:50 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xf, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:50 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280)=0xc001, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000140), 0x0) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYRES16, @ANYRES16, @ANYPTR=&(0x7f0000000140)=ANY=[@ANYRES16=0x0, @ANYRESDEC, @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYPTR, @ANYRES32, @ANYRES16, @ANYRESHEX=r0, @ANYRESOCT, @ANYRESDEC, @ANYPTR64]], @ANYBLOB="7a27002abfcc35d1ce66f68b4d21df405ccea9deaf9450c03a30cd55aa4c2e5c792572a1828a57eeed07be2bc6d54c8d0fcc34b862419434ac98ed829abe1f863eee90bfd0755a6e924712ea08", @ANYBLOB="f1523176142ed675a58c5f1a774d07e094451e5bd4661be78ae5f34f5682f66b96caad010ce6a8e2ad5e2374455e4c01a294fb2e81aadacf39ac6eb2e327d95aae28ec9fc30486ca4b0aedbf5392cabbb52a55e36256db7155938797cc40b36d4f8fd5b00a1d8d7e200fb81f7bdb9a76a5c48ffcfe8d996bed8f79a9dde15cb3e506ebb1b75e0b0e6d906bdc878f9e05cd57b7ce30b8274feb7d9cfa0a9a833ca5904ec67e1246bdff9d32eba8cb81dfb59a03b0b1c8386200e6a54925dd97ff327db14c9cc9922d8753cb3ce06007b827b1", @ANYRES32, @ANYRESOCT=0x0, @ANYRESHEX], 0x158) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x4ffe0, 0x0) ioctl$CAPI_CLR_FLAGS(0xffffffffffffffff, 0x80044325, &(0x7f0000000100)) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000040)={0x0, 0xfffffffc}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f00000000c0)={r5, 0x7}, 0x8) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:50 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x5460, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:50 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x5000000, 0x0) 15:22:51 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:51 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x6000000, 0x0) [ 898.875581][T31062] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:51 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:51 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x8933, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:51 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x7000000, 0x0) 15:22:51 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x60, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 899.156225][T31210] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 899.360593][T31285] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:54 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848", @ANYPTR], 0x0, 0x143}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x8000000, 0x0) 15:22:54 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xf0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:54 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$inet6_tcp_int(r1, 0x6, 0xa, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:54 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x894c, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:54 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:54 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x300, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xc000000, 0x0) [ 901.957741][T31304] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:54 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x600, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x12000000, 0x0) 15:22:54 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = semget$private(0x0, 0x4, 0x0) semctl$IPC_RMID(r4, 0x0, 0x10) semtimedop(r4, &(0x7f0000000080)=[{0x2, 0x101, 0x800}, {0x4, 0x880, 0x1000}], 0x2, &(0x7f0000000100)={0x0, 0x989680}) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)) sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000180)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="88000000", @ANYRES16=0x0, @ANYBLOB="010028bd7000fbdbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008c0004000000080001007063690011000200303030303a30303a31302e300000000008006b93a000f2fb34cf727e787778abd6208c00040000000e0001006ee57464657673696d0000000f0002006e657464657673696d30000008008b0069e7aa4383e9b6be624f168cab0071b6d8f95d649d7a78e2edfd0331440f36d09c4fd781fd251e8eb2f6be1357f9f59fa446aa85e867a488fc39ca58c77db9df853ab465fe9556fca0d40e175e12ed57505a5167728a38fccbb03bc777d869be3977d45575c28774cbb11fbdd7173ec47d5f4e85c782441c7bf61e7a6c42dc81a7df831d9760b3cd0dba9c41ed5b1c2d0b03175d3daec2b75adf56e426be9a3d58e204c743d87a4b62d7c566bada6a1f8a4160eef2f95465c59920890378552674bad9e262addb0108b86fbf8b764187356ed6324a530d7f4be9e8f1f449f4aae3a54dcb9825f393ec6e4fcbe0f9e8abb9d91c16eae3c6205c0aea3a71f296e5f2d5ed857742ef48c981e03ce2993d55346e040bfa3ee4d5c419d8fb174f4a2e6b998cf7edecaa4284a06c2dad310e8a763153bce0a82d155fcfa63dc702c060b037abd49342d0ebcfcc88dd5557ddf3a284234fbfa785327271d43245a4d7b901177e92af18d306045874", @ANYRES32=r3, @ANYBLOB="d3fe675ee82724b1bdff6985898f0a0ce76dd69ae069bce54d2326a61147b98a764fcc0512f0a36e7d81a9cdc0dcc1e80f16d05abc6976b67af34d11e854c98fe08a54fda9565854f06c8336ae77e98416117e63a840ac5de905cc1b12e72f734353aa82533c7d5d09ab9f7ddf909e9a71aabad584149b3109991d840f6e9e89c4e6db570d695a6cbdec48b6170007ebdac79ad32aac12b02dec86a1339870f6fab18b4321eb3909b32808ab798ee5c06e4c318c9279dc61977c940d9f69faffffe3716c4423ab4e7448ee309c97"], 0x5}}, 0x8) ioctl$DRM_IOCTL_INFO_BUFS(0xffffffffffffffff, 0xc0106418, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfffffff8, 0x4, 0x200}) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:54 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454c9, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 902.158186][T31414] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 902.423578][T31499] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:57 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x5a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:22:57 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x900, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x35260000, 0x0) 15:22:57 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setxattr$trusted_overlay_origin(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='trusted.overlay.origin\x00', &(0x7f0000000300)='y\x00', 0x2, 0x3) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xa0202220}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xec, r3, 0x208, 0x70bd29, 0x25dfdbff, {}, [@NL80211_ATTR_TX_RATES={0xd4, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x4c, 0x2, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x7, 0x2, "02e26d"}, @NL80211_TXRATE_HT={0x22, 0x2, "790428264c6d90ad032548a41a39e789c535b98ee1c3bad61fb634d01237"}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x1000, 0x493, 0x7, 0x1ff, 0x4, 0x6, 0xfffd]}}]}, @NL80211_BAND_2GHZ={0x60, 0x0, [@NL80211_TXRATE_HT={0x7, 0x2, "7a8329"}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x4a, 0x2, "4ffa8f21fec54ff7b4027bfce87763a0007b1100be750663adf05f88ff504375c0f3750870cc40675b06d9000c425aa1081d2eea959d197f2e7e95958a6cf4457ea34b35f8f2"}]}, @NL80211_BAND_60GHZ={0x24, 0x2, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}]}, @NL80211_ATTR_HANDLE_DFS={0x4}]}, 0xec}, 0x1, 0x0, 0x0, 0x10}, 0x1) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:22:57 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454cb, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:57 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:22:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x39260000, 0x0) [ 904.936564][T31538] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:57 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xa00, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:57 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454d9, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:22:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x3f000000, 0x0) [ 905.257074][T31655] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:22:57 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xb2a, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:22:57 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 905.500324][T31670] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:00 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x5a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:00 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xb2e, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:00 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xc0000000, 0x0) 15:23:00 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x40049409, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:00 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = getpid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="850000000700000035000000000034008500000008000000950000000000000018d11c1c1f61ac44640091fa5be1a52d392cc6b941db86d50ad2150ab0565c24fea89999719518057c6ca96e58fd6a2f8c17e768e2a052ff599a29362cc47476790dd2eb1304db8fb7e60000000082807783aa8f9fc6dd189455283c0264a57761e5230b046dc7186924b25431abc43adfca6a17375dfc75e110ddb5ac34a7f6eb25c76894c70c4c568edebbe7460006c119abcdba8ed5e3f6daa30507001e3727f124d78fcbab2ab6327b9ca170ae2b0d70cced3bf2969e0d2a8cd9837144bc92e4694ac542b32a29e42a8864ba27d917441cd9cbfa9f3adc1f1e4b0f8d7ffe546c677f7f54120bc4a9c006aae3bf5be71e8cf3d189c95d55e2140ca4dbdaa3337d4e64f1ba2f285e9021c8ffcb5d28ffbbdb6bbb91d8a5445823f70a78470cab7baa8add8095557410173e930b49580f4a97cd13fabd2ae0ec997bc133c1bde78c9c58d00f45edec5fb8dc499cdc17274e"], &(0x7f0000000140)='GPL\x00', 0x0, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffc1a}, 0x15) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r2}, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000040)='wlan0\x00', r2}, 0x30) ptrace$cont(0x1f, r3, 0x3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_buf(r4, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r5, 0x0, 0x0) fcntl$setstatus(r4, 0x4, 0x80000000002c00) 15:23:00 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:23:00 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xf6ffffff, 0x0) 15:23:00 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) recvfrom$netrom(r2, &(0x7f0000000040)=""/110, 0x6e, 0x100, &(0x7f00000000c0)={{0x3, @default, 0x2}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) r4 = getpid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r4, 0x0, 0x0) tkill(r4, 0x1a) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 908.122917][T31830] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:00 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xc00, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:00 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x40186366, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:00 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xfeffffff, 0x0) 15:23:00 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xe00, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 908.386112][T31945] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 908.700118][T32011] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 910.093121][ T0] NOHZ: local_softirq_pending 08 15:23:03 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x5a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:03 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xf00, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xff000000, 0x0) 15:23:03 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0xffffffffffffffdf, 0x5c) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:03 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x4020940d, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:03 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, 0x0) sendfile(r4, r5, 0x0, 0x800000080004103) 15:23:03 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, 0x0) sendfile(r4, r5, 0x0, 0x800000080004103) 15:23:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xfffff000, 0x0) [ 911.225897][T32044] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:03 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x2a0b, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:03 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, 0x0) sendfile(r4, r5, 0x0, 0x800000080004103) 15:23:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xfffffff6, 0x0) 15:23:03 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x800454cf, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 911.435986][T32140] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 911.655030][T32152] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:06 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB, @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x5a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:06 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x2e0b, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(0xffffffffffffffff, r4, 0x0, 0x800000080004103) 15:23:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xfffffffe, 0x0) 15:23:06 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x24, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000052000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/seq\x00', 0x22c4c1) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r3, 0xc0105303, &(0x7f0000000080)={0x9, 0x7e, 0x2}) r4 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r4, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x80086301, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:06 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x4000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(0xffffffffffffffff, r4, 0x0, 0x800000080004103) 15:23:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x1000000000000, 0x0) [ 914.312120][T32197] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:06 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) ioctl(r4, 0xa4, &(0x7f0000000080)="bc949d3fd92825cddd31709825a3c2e9f707f9fb0db5b41da9f9f8a3") splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r3, 0x0, 0x48f, &(0x7f0000000040)={0x6, @empty, 0x4e20, 0x3, 'nq\x00', 0x26, 0x8001, 0x50}, 0x2c) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xf0ffffffffffff, 0x0) [ 914.476810][T32281] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0xc0045878, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 914.715666][T32391] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:09 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(0xffffffffffffffff, r4, 0x0, 0x800000080004103) 15:23:09 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB, @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x5a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:09 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x100000000000000, 0x0) 15:23:09 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x5865, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:09 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$inet6_tcp_int(r1, 0x6, 0x4, &(0x7f0000000280)=0x7fffffff, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040)='/dev/bsg\x00', 0x8002, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000080)=[@window={0x3, 0x3ff}, @window={0x3, 0xffff, 0x800}], 0x2) clone(0x200000000b245780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) 15:23:09 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0xc0045878, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:09 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x6000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:09 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, 0xffffffffffffffff, 0x0, 0x800000080004103) 15:23:09 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x200000000000000, 0x0) [ 917.433342][T32435] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:09 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000080)=[@mss={0x2, 0x400007}, @mss={0x2, 0x8}, @timestamp, @sack_perm, @timestamp, @sack_perm, @window={0x3, 0x1, 0x6}], 0x7) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:09 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, 0xffffffffffffffff, 0x0, 0x800000080004103) 15:23:09 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0xc0189436, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:09 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x300000000000000, 0x0) [ 917.628852][T32536] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 917.857289][T32636] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:12 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB, @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x5a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:12 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, 0xffffffffffffffff, 0x0, 0x800000080004103) 15:23:12 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x6558, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:12 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x4000, 0x0) write$P9_RMKDIR(r1, &(0x7f0000000080)={0x14, 0x49, 0x2, {0xa3, 0x2}}, 0x14) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) splice(r4, 0x0, r5, 0x0, 0x4ffe0, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r4, 0x112, 0xa, &(0x7f0000000100)=0x7, 0x4) setsockopt$inet6_buf(r3, 0x29, 0x3d, 0x0, 0x4b) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0xc00) 15:23:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x400000000000000, 0x0) 15:23:12 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0xc020660b, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 920.439633][T32647] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:12 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x0) 15:23:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x500000000000000, 0x0) 15:23:12 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x8100, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:12 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x0) [ 920.738753][T32763] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:13 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x600000000000000, 0x0) 15:23:13 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4}) [ 921.000413][ T307] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:15 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b58", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0xcf}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:15 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:15 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xf000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:15 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x0) 15:23:15 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x700000000000000, 0x0) 15:23:15 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x5002}) 15:23:15 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x800000000000000, 0x0) 15:23:15 executing program 2 (fault-call:10 fault-nth:0): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) [ 923.617312][ T332] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:15 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xf0ffff, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 923.811456][ T431] FAULT_INJECTION: forcing a failure. [ 923.811456][ T431] name failslab, interval 1, probability 0, space 0, times 0 [ 923.847676][ T431] CPU: 0 PID: 431 Comm: syz-executor.2 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 923.857443][ T431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 923.867632][ T431] Call Trace: [ 923.870943][ T431] dump_stack+0x188/0x20d [ 923.871152][ T438] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 923.875297][ T431] should_fail.cold+0x5/0x14 [ 923.875316][ T431] ? lock_downgrade+0x7f0/0x7f0 [ 923.875333][ T431] ? setup_fault_attr+0x1e0/0x1e0 [ 923.875364][ T431] should_failslab+0x5/0xf [ 923.875387][ T431] kmem_cache_alloc_trace+0x2d0/0x7d0 [ 923.914132][ T431] ? aa_file_perm+0x5d2/0x14d0 [ 923.919003][ T431] alloc_pipe_info+0x111/0x510 [ 923.923789][ T431] splice_direct_to_actor+0x771/0x980 [ 923.929173][ T431] ? apparmor_path_rmdir+0x30/0x30 [ 923.934309][ T431] ? generic_pipe_buf_nosteal+0x10/0x10 [ 923.939863][ T431] ? lock_downgrade+0x7f0/0x7f0 [ 923.944728][ T431] ? do_splice_to+0x160/0x160 [ 923.949408][ T431] ? security_file_permission+0x8a/0x370 [ 923.955070][ T431] do_splice_direct+0x1a8/0x270 [ 923.959930][ T431] ? splice_direct_to_actor+0x980/0x980 [ 923.965493][ T431] ? security_file_permission+0x8a/0x370 [ 923.971145][ T431] do_sendfile+0x549/0xc40 [ 923.975580][ T431] ? do_compat_pwritev64+0x1b0/0x1b0 [ 923.980884][ T431] ? wait_for_completion+0x3c0/0x3c0 [ 923.986190][ T431] ? __sb_end_write+0x101/0x1d0 [ 923.991058][ T431] ? vfs_write+0x15b/0x5c0 [ 923.995494][ T431] __x64_sys_sendfile64+0x1cc/0x210 [ 924.000698][ T431] ? ksys_write+0x19f/0x250 [ 924.005207][ T431] ? __ia32_sys_sendfile+0x220/0x220 [ 924.010513][ T431] ? __ia32_sys_clock_settime+0x260/0x260 [ 924.016244][ T431] ? trace_hardirqs_off_caller+0x55/0x230 [ 924.021989][ T431] do_syscall_64+0xf6/0x790 [ 924.026510][ T431] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 924.032502][ T431] RIP: 0033:0x45c849 [ 924.036405][ T431] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 15:23:16 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) getsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="c1159c26", @ANYRES16=r4, @ANYBLOB="67a60000000000000000010000000000000008410000004c00180000000065746800"/98], 0x68}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x1c, r4, 0x800, 0x70bd2a, 0x25dfdbfc, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40400c5) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r4, 0x2, 0x70bd27, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}}, 0x20000000) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:16 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xc00000000000000, 0x0) 15:23:16 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x1000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 924.056016][ T431] RSP: 002b:00007f1abfcd8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 924.064464][ T431] RAX: ffffffffffffffda RBX: 00007f1abfcd96d4 RCX: 000000000045c849 [ 924.072444][ T431] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000007 [ 924.080786][ T431] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 924.088765][ T431] R10: 0800000080004103 R11: 0000000000000246 R12: 0000000000000009 [ 924.097087][ T431] R13: 00000000000008d4 R14: 00000000004cb786 R15: 0000000000000000 [ 924.248482][ T547] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:18 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b58", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0xcf}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:18 executing program 2 (fault-call:10 fault-nth:1): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:23:18 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x2000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x1200000000000000, 0x0) 15:23:18 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) ioctl$sock_inet_SIOCGARP(r3, 0x8954, &(0x7f0000000080)={{0x2, 0x4e24, @local}, {0x1, @broadcast}, 0x12, {0x2, 0x4e22, @broadcast}, 'syzkaller0\x00'}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r4, 0x10e, 0x5, &(0x7f0000000040)=0xa90, 0x4) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:18 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x5003}) 15:23:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x3526000000000000, 0x0) [ 926.665509][ T561] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 926.728726][ T564] FAULT_INJECTION: forcing a failure. [ 926.728726][ T564] name failslab, interval 1, probability 0, space 0, times 0 [ 926.742539][ T564] CPU: 1 PID: 564 Comm: syz-executor.2 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 926.752288][ T564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 926.762356][ T564] Call Trace: [ 926.765663][ T564] dump_stack+0x188/0x20d [ 926.770010][ T564] should_fail.cold+0x5/0x14 [ 926.774607][ T564] ? lock_downgrade+0x7f0/0x7f0 [ 926.779460][ T564] ? setup_fault_attr+0x1e0/0x1e0 [ 926.784503][ T564] should_failslab+0x5/0xf [ 926.788919][ T564] __kmalloc+0x2d9/0x7a0 [ 926.793162][ T564] ? kmem_cache_alloc_trace+0x390/0x7d0 [ 926.798708][ T564] ? alloc_pipe_info+0x1d5/0x510 [ 926.803665][ T564] ? aa_file_perm+0x5d2/0x14d0 [ 926.808452][ T564] alloc_pipe_info+0x1d5/0x510 [ 926.813235][ T564] splice_direct_to_actor+0x771/0x980 [ 926.818625][ T564] ? apparmor_path_rmdir+0x30/0x30 [ 926.823750][ T564] ? generic_pipe_buf_nosteal+0x10/0x10 [ 926.829315][ T564] ? lock_downgrade+0x7f0/0x7f0 [ 926.834175][ T564] ? do_splice_to+0x160/0x160 [ 926.838855][ T564] ? security_file_permission+0x8a/0x370 [ 926.844896][ T564] do_splice_direct+0x1a8/0x270 [ 926.849810][ T564] ? splice_direct_to_actor+0x980/0x980 [ 926.855381][ T564] ? security_file_permission+0x8a/0x370 [ 926.861034][ T564] do_sendfile+0x549/0xc40 [ 926.865482][ T564] ? do_compat_pwritev64+0x1b0/0x1b0 [ 926.870777][ T564] ? wait_for_completion+0x3c0/0x3c0 [ 926.876075][ T564] ? __sb_end_write+0x101/0x1d0 [ 926.880921][ T564] ? vfs_write+0x15b/0x5c0 [ 926.885322][ T564] __x64_sys_sendfile64+0x1cc/0x210 [ 926.890502][ T564] ? ksys_write+0x19f/0x250 [ 926.894995][ T564] ? __ia32_sys_sendfile+0x220/0x220 [ 926.900276][ T564] ? __ia32_sys_clock_settime+0x260/0x260 [ 926.905984][ T564] ? trace_hardirqs_off_caller+0x55/0x230 [ 926.911693][ T564] do_syscall_64+0xf6/0x790 [ 926.916199][ T564] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 926.922099][ T564] RIP: 0033:0x45c849 [ 926.926007][ T564] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 926.945614][ T564] RSP: 002b:00007f1abfcb7c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 926.954024][ T564] RAX: ffffffffffffffda RBX: 00007f1abfcb86d4 RCX: 000000000045c849 [ 926.961997][ T564] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000007 [ 926.969970][ T564] RBP: 000000000076bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 926.977932][ T564] R10: 0800000080004103 R11: 0000000000000246 R12: 0000000000000009 [ 926.985894][ T564] R13: 00000000000008d4 R14: 00000000004cb786 R15: 0000000000000001 15:23:19 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x3926000000000000, 0x0) 15:23:19 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x3000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:19 executing program 2 (fault-call:10 fault-nth:2): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:23:19 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$inet6_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x40, 0x0) write$P9_RGETLOCK(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="2e00000037020002cfa4fffffffffffffcffffffffffffff", @ANYRES32=r2, @ANYBLOB="633b882f63e22d4d722d01ccc74308111a11304a25ed3f8921ba55119d3aa4ada4a73d665442532e3db820"], 0x2e) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 927.095115][ T651] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 927.251631][ T677] FAULT_INJECTION: forcing a failure. [ 927.251631][ T677] name failslab, interval 1, probability 0, space 0, times 0 [ 927.280069][ T677] CPU: 0 PID: 677 Comm: syz-executor.2 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 927.289827][ T677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 15:23:19 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x3f00000000000000, 0x0) [ 927.300157][ T677] Call Trace: [ 927.303497][ T677] dump_stack+0x188/0x20d [ 927.307827][ T677] should_fail.cold+0x5/0x14 [ 927.312402][ T677] ? lock_downgrade+0x7f0/0x7f0 [ 927.317257][ T677] ? setup_fault_attr+0x1e0/0x1e0 [ 927.322298][ T677] should_failslab+0x5/0xf [ 927.326738][ T677] kmem_cache_alloc_node_trace+0x27c/0x790 [ 927.328853][ T683] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 927.332565][ T677] ? __lock_acquire+0x827/0x5270 [ 927.332588][ T677] __kmalloc_node+0x38/0x60 [ 927.332664][ T677] kvmalloc_node+0x61/0xf0 [ 927.332687][ T677] iov_iter_get_pages_alloc+0x841/0x1420 [ 927.366400][ T677] ? aa_file_perm+0x5a8/0x14d0 [ 927.371177][ T677] ? iov_iter_for_each_range+0x750/0x750 [ 927.376846][ T677] ? lock_downgrade+0x7f0/0x7f0 [ 927.381754][ T677] default_file_splice_read+0x1d5/0xa20 [ 927.387299][ T677] ? aa_file_perm+0x5d2/0x14d0 [ 927.392048][ T677] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 927.398098][ T677] ? iter_file_splice_write+0xb00/0xb00 [ 927.403662][ T677] ? aa_path_link+0x300/0x300 [ 927.408428][ T677] ? rcu_read_unlock+0x12/0x60 [ 927.413193][ T677] ? find_held_lock+0x2d/0x110 [ 927.417982][ T677] ? fsnotify+0x770/0xb10 [ 927.422304][ T677] ? __fsnotify_parent+0xd1/0x370 [ 927.427315][ T677] ? fsnotify_first_mark+0x200/0x200 [ 927.432627][ T677] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 927.438612][ T677] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 927.444405][ T677] ? security_file_permission+0x8a/0x370 [ 927.450025][ T677] ? iter_file_splice_write+0xb00/0xb00 [ 927.455557][ T677] do_splice_to+0x10e/0x160 [ 927.460140][ T677] splice_direct_to_actor+0x307/0x980 [ 927.465499][ T677] ? generic_pipe_buf_nosteal+0x10/0x10 [ 927.471041][ T677] ? do_splice_to+0x160/0x160 [ 927.475725][ T677] ? security_file_permission+0x8a/0x370 [ 927.481469][ T677] do_splice_direct+0x1a8/0x270 [ 927.486327][ T677] ? splice_direct_to_actor+0x980/0x980 [ 927.491885][ T677] ? security_file_permission+0x8a/0x370 [ 927.497518][ T677] do_sendfile+0x549/0xc40 [ 927.501926][ T677] ? do_compat_pwritev64+0x1b0/0x1b0 [ 927.507197][ T677] ? wait_for_completion+0x3c0/0x3c0 [ 927.512468][ T677] ? __sb_end_write+0x101/0x1d0 [ 927.517301][ T677] ? vfs_write+0x15b/0x5c0 [ 927.521718][ T677] __x64_sys_sendfile64+0x1cc/0x210 [ 927.526907][ T677] ? ksys_write+0x19f/0x250 [ 927.531407][ T677] ? __ia32_sys_sendfile+0x220/0x220 [ 927.536683][ T677] ? __ia32_sys_clock_settime+0x260/0x260 [ 927.542398][ T677] ? trace_hardirqs_off_caller+0x55/0x230 [ 927.548105][ T677] do_syscall_64+0xf6/0x790 [ 927.552594][ T677] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 927.558467][ T677] RIP: 0033:0x45c849 [ 927.562357][ T677] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 927.581948][ T677] RSP: 002b:00007f1abfcd8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 927.590359][ T677] RAX: ffffffffffffffda RBX: 00007f1abfcd96d4 RCX: 000000000045c849 [ 927.598316][ T677] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000007 [ 927.606290][ T677] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 927.614249][ T677] R10: 0800000080004103 R11: 0000000000000246 R12: 0000000000000009 [ 927.622216][ T677] R13: 00000000000008d4 R14: 00000000004cb786 R15: 0000000000000002 [ 927.753414][ T787] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:21 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b58", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0xcf}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:21 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x4000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:21 executing program 2 (fault-call:10 fault-nth:3): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:23:21 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x4, 0x1, 0x201, 0x0, 0x0, {0xc}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x2048000}, 0x4000009) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:21 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xc000000000000000, 0x0) 15:23:21 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x5005}) [ 929.778321][ T796] FAULT_INJECTION: forcing a failure. [ 929.778321][ T796] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 929.788185][ T804] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 929.827025][ T796] CPU: 0 PID: 796 Comm: syz-executor.2 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 929.836803][ T796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 929.846873][ T796] Call Trace: [ 929.850183][ T796] dump_stack+0x188/0x20d [ 929.854534][ T796] should_fail.cold+0x5/0x14 [ 929.859145][ T796] ? setup_fault_attr+0x1e0/0x1e0 [ 929.864198][ T796] __alloc_pages_nodemask+0x17a/0x820 [ 929.869579][ T796] ? __alloc_pages_slowpath+0x26a0/0x26a0 [ 929.875305][ T796] ? __kmalloc_node+0x38/0x60 [ 929.879994][ T796] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 929.885816][ T796] alloc_pages_current+0xff/0x200 [ 929.890857][ T796] push_pipe+0x2af/0x690 [ 929.895150][ T796] iov_iter_get_pages_alloc+0x8cc/0x1420 [ 929.900799][ T796] ? iov_iter_for_each_range+0x750/0x750 [ 929.906439][ T796] ? lock_downgrade+0x7f0/0x7f0 [ 929.911318][ T796] default_file_splice_read+0x1d5/0xa20 [ 929.916881][ T796] ? aa_file_perm+0x5d2/0x14d0 [ 929.921655][ T796] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe 15:23:22 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000042302700, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 929.927751][ T796] ? iter_file_splice_write+0xb00/0xb00 [ 929.933310][ T796] ? aa_path_link+0x300/0x300 [ 929.937998][ T796] ? rcu_read_unlock+0x12/0x60 [ 929.942793][ T796] ? find_held_lock+0x2d/0x110 [ 929.947564][ T796] ? fsnotify+0x770/0xb10 [ 929.951906][ T796] ? __fsnotify_parent+0xd1/0x370 [ 929.956970][ T796] ? fsnotify_first_mark+0x200/0x200 [ 929.962265][ T796] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 929.968250][ T796] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 929.974073][ T796] ? security_file_permission+0x8a/0x370 [ 929.979803][ T796] ? iter_file_splice_write+0xb00/0xb00 [ 929.985363][ T796] do_splice_to+0x10e/0x160 [ 929.989874][ T796] splice_direct_to_actor+0x307/0x980 [ 929.995953][ T796] ? generic_pipe_buf_nosteal+0x10/0x10 [ 930.001512][ T796] ? do_splice_to+0x160/0x160 [ 930.006204][ T796] ? security_file_permission+0x8a/0x370 [ 930.011857][ T796] do_splice_direct+0x1a8/0x270 [ 930.016720][ T796] ? splice_direct_to_actor+0x980/0x980 [ 930.022279][ T796] ? security_file_permission+0x8a/0x370 [ 930.027932][ T796] do_sendfile+0x549/0xc40 [ 930.032372][ T796] ? do_compat_pwritev64+0x1b0/0x1b0 [ 930.037674][ T796] ? wait_for_completion+0x3c0/0x3c0 [ 930.042971][ T796] ? __sb_end_write+0x101/0x1d0 [ 930.047828][ T796] ? vfs_write+0x15b/0x5c0 [ 930.052288][ T796] __x64_sys_sendfile64+0x1cc/0x210 [ 930.057500][ T796] ? ksys_write+0x19f/0x250 [ 930.062194][ T796] ? __ia32_sys_sendfile+0x220/0x220 [ 930.067498][ T796] ? __ia32_sys_clock_settime+0x260/0x260 [ 930.073250][ T796] ? trace_hardirqs_off_caller+0x55/0x230 [ 930.079000][ T796] do_syscall_64+0xf6/0x790 [ 930.083535][ T796] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 930.089632][ T796] RIP: 0033:0x45c849 [ 930.093539][ T796] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 930.113556][ T796] RSP: 002b:00007f1abfcd8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 930.121988][ T796] RAX: ffffffffffffffda RBX: 00007f1abfcd96d4 RCX: 000000000045c849 15:23:22 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xf6ffffff00000000, 0x0) 15:23:22 executing program 2 (fault-call:10 fault-nth:4): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) [ 930.129967][ T796] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000007 [ 930.138061][ T796] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 930.146044][ T796] R10: 0800000080004103 R11: 0000000000000246 R12: 0000000000000009 [ 930.154026][ T796] R13: 00000000000008d4 R14: 00000000004cb786 R15: 0000000000000003 15:23:22 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x6000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:22 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000500)=ANY=[@ANYBLOB="000000fe8000000000000000000000000000aae000000200000000000000000000000000000000000000000a0000a000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000b89f3acbb4073c56c8641a1d7ab5a0a6ba6516fdeec840ac28e1b8599ae816811742d179258e4bf2a3a6c8b4e874273b02ebce541b81761ef7ff0cf209784fecd16c5d8c9815ea7d9b7360b18110334802f3fc43322ca85b40d3c5af98209d37e49d93bea2bdbe05c82a3b2f0e53ed143415df4613897b29d82c5ca15"], 0xf0}}, 0x0) dup3(r1, r0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0, 0x32, 0x0, 0xee00}, {@in6=@ipv4={[0xfffffff0], [], @rand_addr=0x2}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000140)={0xa20000, 0x80, 0x950, r2, 0x0, &(0x7f0000000100)={0x9b0940, 0x2, [], @p_u16=&(0x7f0000000080)=0x4}}) ioctl$UFFDIO_WAKE(r3, 0x8010aa02, &(0x7f00000001c0)={&(0x7f0000fed000/0x13000)=nil, 0x13000}) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r4, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x4240a2a0) open_tree(r5, &(0x7f0000000040)='./file0\x00', 0x1) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:22 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x9000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 930.342133][ T1015] FAULT_INJECTION: forcing a failure. [ 930.342133][ T1015] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 930.368882][ T1018] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 930.398025][ T1015] CPU: 1 PID: 1015 Comm: syz-executor.2 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 [ 930.407991][ T1015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 930.418055][ T1015] Call Trace: [ 930.421365][ T1015] dump_stack+0x188/0x20d [ 930.425725][ T1015] should_fail.cold+0x5/0x14 [ 930.430340][ T1015] ? setup_fault_attr+0x1e0/0x1e0 [ 930.435413][ T1015] __alloc_pages_nodemask+0x17a/0x820 [ 930.440824][ T1015] ? __alloc_pages_slowpath+0x26a0/0x26a0 [ 930.446551][ T1015] ? __kmalloc_node+0x38/0x60 [ 930.451255][ T1015] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 930.457087][ T1015] alloc_pages_current+0xff/0x200 [ 930.462130][ T1015] push_pipe+0x2af/0x690 [ 930.466402][ T1015] iov_iter_get_pages_alloc+0x8cc/0x1420 [ 930.472062][ T1015] ? iov_iter_for_each_range+0x750/0x750 [ 930.479198][ T1015] ? lock_downgrade+0x7f0/0x7f0 [ 930.484074][ T1015] default_file_splice_read+0x1d5/0xa20 [ 930.489647][ T1015] ? aa_file_perm+0x5d2/0x14d0 [ 930.494434][ T1015] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 930.500511][ T1015] ? iter_file_splice_write+0xb00/0xb00 [ 930.506071][ T1015] ? aa_path_link+0x300/0x300 [ 930.510794][ T1015] ? rcu_read_unlock+0x12/0x60 [ 930.515584][ T1015] ? find_held_lock+0x2d/0x110 [ 930.520361][ T1015] ? fsnotify+0x770/0xb10 [ 930.524700][ T1015] ? __fsnotify_parent+0xd1/0x370 [ 930.529739][ T1015] ? fsnotify_first_mark+0x200/0x200 [ 930.535042][ T1015] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 930.541029][ T1015] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 930.546851][ T1015] ? security_file_permission+0x8a/0x370 [ 930.552496][ T1015] ? iter_file_splice_write+0xb00/0xb00 [ 930.558054][ T1015] do_splice_to+0x10e/0x160 [ 930.562574][ T1015] splice_direct_to_actor+0x307/0x980 [ 930.568123][ T1015] ? generic_pipe_buf_nosteal+0x10/0x10 [ 930.574028][ T1015] ? do_splice_to+0x160/0x160 [ 930.578716][ T1015] ? security_file_permission+0x8a/0x370 [ 930.584457][ T1015] do_splice_direct+0x1a8/0x270 [ 930.589345][ T1015] ? splice_direct_to_actor+0x980/0x980 [ 930.595011][ T1015] ? security_file_permission+0x8a/0x370 [ 930.600645][ T1015] do_sendfile+0x549/0xc40 [ 930.605061][ T1015] ? do_compat_pwritev64+0x1b0/0x1b0 [ 930.610343][ T1015] ? wait_for_completion+0x3c0/0x3c0 [ 930.615700][ T1015] ? __sb_end_write+0x101/0x1d0 [ 930.620540][ T1015] ? vfs_write+0x15b/0x5c0 [ 930.624949][ T1015] __x64_sys_sendfile64+0x1cc/0x210 [ 930.630149][ T1015] ? ksys_write+0x19f/0x250 [ 930.634651][ T1015] ? __ia32_sys_sendfile+0x220/0x220 [ 930.639927][ T1015] ? __ia32_sys_clock_settime+0x260/0x260 [ 930.645676][ T1015] ? trace_hardirqs_off_caller+0x55/0x230 [ 930.651567][ T1015] do_syscall_64+0xf6/0x790 [ 930.656060][ T1015] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 930.661937][ T1015] RIP: 0033:0x45c849 [ 930.665829][ T1015] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 930.686077][ T1015] RSP: 002b:00007f1abfcd8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 930.694484][ T1015] RAX: ffffffffffffffda RBX: 00007f1abfcd96d4 RCX: 000000000045c849 [ 930.702436][ T1015] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000007 [ 930.710388][ T1015] RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 [ 930.718359][ T1015] R10: 0800000080004103 R11: 0000000000000246 R12: 0000000000000009 [ 930.726313][ T1015] R13: 00000000000008d4 R14: 00000000004cb786 R15: 0000000000000004 15:23:24 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf22", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x10a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:24 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xa000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:24 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000080)={0x0, 0x83, 0x98}, &(0x7f0000000180)={'enc=', 'pkcs1', ' hash=', {'blake2s-224\x00'}}, &(0x7f00000002c0)="b3775cf7030e230e48e1e6bb83cf9d4a91e1b6d94a426bcdb9124d6ce9c82de32086d4fe61e8d2967d118ffcd5c55920f9ecac307ca316e98f764250c312ca34a2362cd04efa27808d949b8879efde96e38ee97272efcab61261bf9d2b04ea17a17390dc434d159218b5f035b2289a3343e5b16f7e2ba5d4d00e0771f5ad03ebb5ed0e", &(0x7f0000000380)=""/152) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$SOUND_MIXER_READ_VOLUME(r2, 0x80044d04, &(0x7f0000000040)) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r1, 0xc0585605, &(0x7f0000000100)={0x1, 0x0, {0x5ea, 0x209953d3, 0x2008, 0x4, 0x4, 0x0, 0x2, 0x4}}) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:24 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xfeffffff00000000, 0x0) 15:23:24 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x5008}) 15:23:24 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:23:25 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xc000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:25 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x200000, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(r3, 0x0, r4, 0x0, 0x4ffe0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) setsockopt$inet6_tcp_int(r5, 0x6, 0x11, &(0x7f0000000100)=0x400100000001, 0x4) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x40, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r6 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r6, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:25 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xff00000000000000, 0x0) 15:23:25 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xe000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 932.951264][ T1257] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:25 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x5009}) 15:23:25 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$DRM_IOCTL_MARK_BUFS(r1, 0x40206417, &(0x7f0000000040)={0xcd60031e, 0x1f, 0x63b8, 0xc47, 0x8, 0x8}) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 933.257925][ T1372] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:28 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf22", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x10a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:28 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xf000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:28 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xffffffff00000000, 0x0) 15:23:28 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x18, &(0x7f0000000280)=0x4, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040)=[@sack_perm, @sack_perm, @mss={0x2, 0x10000}, @timestamp, @timestamp, @window={0x3, 0x1, 0x7}, @mss={0x2, 0x98}, @window={0x3, 0xdf21, 0x1}, @window={0x3, 0x2ac9, 0x7}], 0x9) clone(0x8634f000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r3, 0x800442d3, 0xfffffffffffffffd) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f}}, 0x20) modify_ldt$write2(0x11, &(0x7f0000000240)={0x9, 0xffffffffffffffff, 0x4000, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1}, 0x10) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, &(0x7f0000000280)={0x13, 0x10, 0x10f, {0x0, r4}}, 0x18) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, &(0x7f0000000100)={0x8, 0x120, 0xfa00, {0x3, {0x5, 0x6, "d37c268a85076453d8f600f4aca48e3e278d580d7fe829ea5146b463730c7a8062036896b8e11a96798895483401e388c207f01704ed1f0de3538d42e8c875cce666c3756e81fa2ea15d03ead22cb3293616b09be6de4250548ad2fc8e55808b3e496fb4f6f5494df57f0f5a7a8c34c207fe0f09009e4fe74eb867fe18041f382a936b9cc309f365d8270060acd0204f2d54b784828d18c6faabc332932a0feda1a01befafd180cf18f647a52ad0a310ba7ce9d3d77fa2cd935952a86c5cb4e5130b3f5ef77a9124356bac7d49c737af48f1c2891ba51eff92d94a46f57e36c6f4b1e643abc628a013ac11947f6d7bede51d046401447205bcbe957dc0bcc855", 0x2, 0x7, 0x8, 0x0, 0x3, 0x0, 0x7, 0x1}, r4}}, 0x128) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:28 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x500c}) 15:23:28 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004102) 15:23:28 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0xfffffffffffff000, 0x0) [ 935.939879][ T1494] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:28 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040)=[@timestamp, @window={0x3, 0x1000, 0xc000}, @window={0x3, 0xb0, 0x3}], 0x3) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x20000, 0x0) getsockopt$nfc_llcp(r2, 0x118, 0x2, &(0x7f00000000c0)=""/45, 0x2d) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(r3, 0x0, r4, 0x0, 0x4ffe0, 0x0) ioctl$DRM_IOCTL_MODE_GETENCODER(r3, 0xc01464a6, &(0x7f0000000200)={0x5}) fcntl$setstatus(r0, 0x4, 0x80000000002c00) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$GIO_UNISCRNMAP(r5, 0x4b69, &(0x7f0000000100)=""/211) 15:23:28 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x10000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:28 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x2) 15:23:28 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80400) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000100)={0xa00000, 0x5, 0x6, r4, 0x0, &(0x7f00000000c0)={0x30379, 0x9, [], @p_u16=&(0x7f0000000080)=0x7}}) [ 936.146640][ T1610] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:28 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x500f}) [ 936.387267][ T1726] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:31 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf22", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x10a}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:31 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x2a0b0000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x3) 15:23:31 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000000e0000000400000030060000ffffffff000000006004000060040000ffffffffffffffff600500006005000060050000ffffffff04000000", @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000a18cd3033c00"/69], @ANYBLOB="035e94fc9ac8a33c96e649e3e3b4540a2e34cd84d190000000ff00000000ffffffff000000ffffffffffffffffff000000ffffffff00766574683100000000000000000000006c6f0000000000000000000000000000ff000000000000000000000000000000ff000000000000000000000002000000080002042000000000000000180350030000000000000000000000000000000000000000000000003801727400000000000000000000000000000000000000000000000000000000fcffffff00000000050000000100000020020000ff010000000000000000000000000001fe800000000000000000000000000018fe88000000000000000000000000000138939a02a5419b05d4f9e3cafaa71d60fe80000000000000000000000000000cfe80000000000000000000000000002800000000000000000000000000000001ff0200742c00000000000000000000000001fe8000000000000000000000000000aaff02000000000000000000000000000100000000000000000000ffffac141442fe8000000000000000000000000000bbfe80000000000000000000000000004100000000000000000000ffffac1e0101fe8000000000000000000000000000aa000000000000000000000000000000010000000038017274000000000000000000000000000000000000000000000000000000002000000040000000010000000010000012020000ff010000000000000000000000000001ff020000000000000000000000000001ff010000000000000000000000000001fe8000000000000000000000000000bbfe88000000000000000000000000010100000000000000000000ffffac14140e00000000000000000000ffff7f00000100000000000000000000000000000000fe8000000000000000000000000000aa00000000000000000000ffffe0000001ff020000000000000000000000000001917642daa24df1562200894687581f64fe8000000000000000000000000000aa00000000000000000000000000000001ff010000000000000000000000000001fe880000000000000000000000000001010000003800534554000000000000000000000000000000000000000000000000000003030006050200050204000602090000001af9ffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e80010010000000000000000000000000000000000000000000000004000636f6e6e6c696d6974000000000000000000000000000000000000000001ffffffffff000000ffffff00000000ff0200000001000000030000000000000028004e46515545554500000000000000000000000000000000000000000000001700000000000000bc94f94144292156ada73126353dd3ac00000000000000000000000000000001000000ffff000000ffffffffff000000ffffffffff000000ffffffffffffffff6261746164765f736c6176655f3000007663616e300000000000000000000000ff000000000000000000000000000000ff000000000000000000000000000000620020004500000000000000d80000010000000000000000000000000000000000000000000000003000657370000000000000000000000000000000000000000000000000000000000004d2000004d20100000000000000280053594e50524f58590000000000000000000000000000000000000000000002807f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff0000000084bda6a346bb4470a03f6547c0426205788f11404cbcc7c5dc19a4cee6841b6d08e4eb780e"], 0x690) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) accept4$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast1}, &(0x7f00000001c0)=0x1c, 0x800) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/asound/seq/clients\x00', 0x0, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x7, &(0x7f0000000280)=0x4001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) splice(r4, 0x0, r5, 0x0, 0x4ffe0, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000313f4e6db38db605dca5cce14e7bdfed430000058d216d7cc46a4efca68fc871e02b060135a4a24b280f"], 0x14}}, 0x8810) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r6 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r6, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:31 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x5010}) 15:23:31 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004104) 15:23:31 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x2e0b0000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x4) 15:23:31 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) keyctl$set_reqkey_keyring(0xe, 0x1) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 939.107389][ T1912] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:31 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x40000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x5) 15:23:31 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x60000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 939.298461][ T1984] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 939.589825][ T2095] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:34 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc376", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x127}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:34 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x5014}) 15:23:34 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, {0x0, 0x0, 0x0, 0x33bc6400}, {0x0, 0x0, 0x1}, {0x4000000}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x40}}, 0xf0}}, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f00000000c0)={0x9e0000, 0x9, 0x3, r3, 0x0, &(0x7f0000000080)={0x990905, 0x7f, [], @p_u8=&(0x7f0000000040)=0xe8}}) ioctl$BLKFRASET(r4, 0x1264, &(0x7f0000000100)=0x5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r5, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000140)={0x5, 0x4, 0x3f, 0x8, 0x0}, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000480)={r6, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x48f, 0x40, 0x0, 0x1000, 0x10, 0x80000001, 0x80}, 0x9c) 15:23:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x65580000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x6) 15:23:34 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004109) 15:23:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x7) [ 942.147588][ T2166] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x6638c3a1, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:34 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) getsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000100)=""/84, &(0x7f0000000180)=0x54) r3 = gettid() setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) splice(r4, 0x0, r5, 0x0, 0x4ffe0, 0x0) ioctl$MON_IOCX_GETX(r4, 0x4018920a, &(0x7f00000000c0)={&(0x7f0000000040), &(0x7f0000000080)=""/32, 0x20}) 15:23:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x8) 15:23:34 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x5063}) 15:23:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x81000000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 942.396641][ T2223] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 942.662509][ T2308] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:37 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc376", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x127}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x88a8ffff, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xc) 15:23:37 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000040)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539", 0x227, 0xfffffffffffffffe) r2 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000100)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) r3 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f00000005c0)="033db656a7f880cae015ba3cfa56cb997aa4caa1719f01b955e2b4956dd4593da1c1bce98341d43bc1edc32dbc53e58c1b2a47c3c63c881da0acb07603ac779d99b367c24f7689b0f613566f250e8b6a0f86bfdb5149a3ab3af7f5b542b4161571042fec67401a15ea53349da4423a497880cc1e16e3582f1f2ce43c1d4efcf3a6e9443005faf9691e5f1c8d66eb4583521b695545b4bb1148d1c2b754476bedda9daa1a0dcc564fd6a6a0b339da66817829435fe4f2b03400", 0xb9, r2) keyctl$dh_compute(0x17, &(0x7f0000000000)={r3, r1, r3}, 0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)={'sha256-ssse3\x00'}}) keyctl$set_timeout(0xf, r1, 0x6) r4 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r4, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x4240a2a0) perf_event_open(&(0x7f00000000c0)={0x5, 0x70, 0x20, 0x9, 0x9c, 0xc3, 0x0, 0xff, 0x1a24c, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_bp={&(0x7f0000000080), 0x8}, 0x10010, 0x9, 0x7fffffff, 0x9, 0x9, 0x6, 0x5}, 0x0, 0xe, r5, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) ioctl$PPPIOCGNPMODE(r5, 0xc008744c, &(0x7f0000000140)={0x8029}) 15:23:37 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x4240a2a0) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x4e23, 0x8001, @local, 0x80000000}, 0x1c) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:37 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x80000008000410d) 15:23:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x9effffff, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x12) [ 945.225854][ T2384] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xa1c33866, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xc0) 15:23:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xc3ffffff, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:37 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f0000000040)={0x4}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_buf(r5, 0x29, 0x14, 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000080)=0x22, 0x4) r6 = syz_open_procfs(r4, &(0x7f0000000380)='attr/sockcreate\x00') setsockopt$inet_sctp6_SCTP_INITMSG(r6, 0x84, 0x2, &(0x7f00000003c0)={0x7ff, 0x2, 0x81, 0x4}, 0x8) ptrace$setopts(0xffffffffffffffff, r4, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000100)) fcntl$setstatus(r3, 0x4, 0x80000000002c00) [ 945.495566][ T2470] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 945.721121][ T2505] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:40 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc376", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x127}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xf0ffffff, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:40 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xf0) 15:23:40 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x204300, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:40 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x1000}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) splice(r5, 0x0, r6, 0x0, 0x4ffe0, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r5, 0x119, 0x1, &(0x7f0000000000), 0x4) 15:23:40 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004110) 15:23:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfcffffff, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:40 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x300) [ 948.311632][ T2642] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:40 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x500) [ 948.514730][ T2724] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:40 executing program 0: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000040)) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r2, 0x8983, &(0x7f0000000000)={0x8, 'veth0_to_team\x00', {'lo\x00'}, 0x3}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000200)=r4) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfeffffff, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:40 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x791eef932fd0d1ad, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000040)=[@mss={0x2, 0x1ff}], 0x1) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$LOOP_SET_BLOCK_SIZE(r3, 0x4c09, 0x101) setsockopt$inet_mreq(r2, 0x0, 0x24, &(0x7f0000000080)={@rand_addr=0x80000001, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x8) [ 948.761245][ T2733] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:43 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be40", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x136}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xffffa888, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x600) 15:23:43 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000080)={@local, 0xfffffffb, 0x0, 0x1, 0x6, 0x9c48, 0x72c}, &(0x7f0000000100)=0x20) fcntl$setstatus(r0, 0x4, 0x80000000002c00) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(r3, 0x0, r4, 0x0, 0x4ffe0, 0x0) ioctl$KVM_GET_MP_STATE(r3, 0x8004ae98, &(0x7f0000000040)) 15:23:43 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x80000008000411e) 15:23:43 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00'}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r5}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000040)={'vcan0\x00', r5}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000000000)=r6) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfffff000, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x700) 15:23:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xffffff7f, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 951.409914][ T2906] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xffffff9e, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xc00) 15:23:43 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 951.699182][ T2982] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 951.983449][ T2991] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:46 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be40", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x136}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xffffffc3, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:46 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r4 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x2, 0xc0000) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:46 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000040), &(0x7f0000000080)=0x4) 15:23:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x1200) 15:23:46 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x80000008000412d) 15:23:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x2635) [ 954.480661][ T3152] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfffffff0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x2639) 15:23:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfffffffc, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 954.692566][ T3225] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:47 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x3526) 15:23:47 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000080)=[@mss={0x2, 0x10001}, @window={0x3, 0x2, 0x9}], 0x2) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x143280, 0x0) write$vhci(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="02448b95748bbff7424c4ccdc62fb668f17d1c9c6ea6e3d9e8da227c535bc35161a578fa4ac3be9aa15898f0bb0a1542470a17cae233ae1afc882c988f112e47ef6ba0d4088efecc334f0a832792bf721b064f0de8ea41d7067c625040544fe7d684a9a3735706"], 0x62) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) write$P9_RAUTH(r1, &(0x7f00000000c0)={0x14, 0x67, 0x2, {0x1, 0x1, 0x6}}, 0x14) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/qat_adf_ctl\x00', 0x800, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r4, 0xc01064b5, &(0x7f00000002c0)={&(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x400000000000024b}) ioctl$DRM_IOCTL_MODE_GETPLANE(r3, 0xc02064b6, &(0x7f0000000240)={r5, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0]}) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 954.900320][ T3233] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 955.168654][ T3340] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:49 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be40", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x136}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:49 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfffffffe, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:49 executing program 5: r0 = getpid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r1, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0x4200, r0, 0xfffffffffffffff7, 0x28) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x80000000002c00) 15:23:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x3926) 15:23:49 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x4e22, @loopback}}, 0x0, 0x0, 0x23, 0x0, "d553c172f2f002b46fcd3fe3e53d0319696bb0aed2d1f333a50532620dccfff06aef86186e05a87a034da26ff1516fe8962d01afeed4d667dfca86658e072ccb769e3c44e2723707dbd5eaad7b2597ee"}, 0xd8) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r4) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:49 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='hfs\x00', 0x0, 0x0) io_uring_register$IORING_UNREGISTER_EVENTFD(r1, 0x5, 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$FS_IOC_ENABLE_VERITY(r6, 0x40806685, &(0x7f0000000240)={0x1, 0x3, 0x1000, 0x66, &(0x7f00000000c0)="0bac965937049ea1b24b612aa70065ff5e2f9070bfc6d3ce6d2cd65c3d2f5da6d1862cf215f6a96cf9f5d5a089e0a334343119dffdf19723b8ee908f8d5ff84d5daf0aa3f1c39de86d6e6530afaf200eccfa6edb5b0aca3e16a107fba2a70c07516f21bcbd54", 0x8a, 0x0, &(0x7f0000000180)="c4934030accf7db0ddf9d562bb1400203d40e879ee4e9bae90aa3fe062cb64ee3809f65b127792d6d4c9d517bc3cabe282fd96adcddf3ab484c88e6cbcc835683e01fd5416963dcd006ef24af4eda957963c64fef8f4ee067d3b61b180d6baa23323d30fef1a4d69cf793f99402435f65ce9af756257d92b4424bf212c70f7c95cdcfed5552e6168c502"}) 15:23:49 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x3f00) [ 957.583732][ T3410] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:49 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0xf, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xc000) 15:23:50 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x10, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 957.807938][ T3486] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xf000) [ 958.006320][ T3498] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 958.185274][ T3503] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:52 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0xc0, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:52 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a681085344", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x13d}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:52 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) ioctl$USBDEVFS_RELEASE_PORT(r1, 0x80045519, &(0x7f0000000040)=0x3) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x2, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xff00) 15:23:52 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$TUNATTACHFILTER(r5, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x7, 0xa6, 0x5, 0xf21f}, {0x7, 0x2, 0x7f, 0xc1}, {0x80, 0x1c, 0x1b}, {0x44, 0x5, 0x4, 0x2}]}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:52 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) recvfrom$x25(0xffffffffffffffff, &(0x7f0000000600)=""/192, 0xc0, 0x2, &(0x7f00000006c0)={0x9, @null=' \x00'}, 0x12) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) socket(0x10, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)=@l2={0x1f, 0x0, @none, 0x8, 0x2}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="919106858e71f304068b7b8f457d06919dcd6c10c881359ebdc8a6fed43b18ce2d05facec8c227540c01460190a58d066aca304cf11e4a6c17b6842423e3d7db2bcc96291a0dad60aa489cfdebcd790a3866cda5f4b615972b408bb8fe055f5b5d6ff0b95d1a6c49a7972725c753c314df32abb6ff7edba45c714bbc", 0x7c}, {&(0x7f0000000280)="912e52cd912a3f65ca0b4062ff9fa0b497081f5a434b71a582c1eaed84df863175fa71bad63e27c6c77b57bae59c3cb7793823363c503f722329b26a44c0055955aae33538a9ec707927e9fd2fcc8c407acf6492d2d50958e42ef516541b1222feb8888b54bc8d91c695f086009e1bd82f7832974d7b1c1986a86c08a4db8c24c309d0d2b5f2fffaa72ededcdcfc5d66a49ab6ff25a46fcabe6f03d0e6bf15927462b5", 0xa3}, {&(0x7f0000000340)="349856a88134e333dc30747834eb8e7409281736fe38628e6b2853a54add0334c3bc5425f94ced711d8baef7ea13a511559f6d64164d12e5aa3ffc073e480c340b43b80206ca893b345bc4598515c1e28d5a1e2bd62564dcd8c3621b6ecf0c12953fb40779e6", 0x66}], 0x3, &(0x7f0000000a40)=ANY=[@ANYBLOB="20000000000000002900000007000000aab47c07237677db906ed70ce689fc10c0000000000000000c01000004000000bf3805868297e9dde4c77d31db359bee5f4415e8e34f1956b9b750bebe879127576a276bfde35590f3230eb5481b0bc004381f7b3ca290f0e65234208deac971835779bd5ba475bbcf46eda30ba6dc174f5d650bd1caa218da75a5da4bf59e4f363126d6559cc35887affbb9e246c5b9757c48b5c9aa12e017319274bd4e6a297e5fa0cb97ee78e5f8c839a0cb8fb2a95270df45cc006ee3c527b6adef0000000000a000000000000000da0000003f00000069aa0180a8049ec5540288c95453de8309e1671f72d7b50969de2d2d4bbac12a5c01576a8c9e09d529c5d4663a34eb5472b04a5846b167d49d81b0415e14cbc3fb2127503dc40079180502d5ad651c5271cf292f1102ab1a4045ba6747a55fc2f08c40c06413f0c4f44fedd95fb981aa8d350923b79093c4c34c513b660350aac5fdfe8d7d74c5d86695875b84480000300000000000000015010000ff03000044c913549f9cd82ffa7c0c5c9b7bfe30f6508bd36a8340cf0dbdd26c000000005e5212ad9e228f860adf6f772e6976b5bb48e3c73085e6c1492003583156fd58ae2cc57171cd0b3befdfddb866d0a17383cc76e6f8a1b2decee4c835dce132ad5e318f9cfaed48091cad162e07098cf0f501730cde8f361f7b39a0c08801ae58f5fabfa4a587233c0707bbdf7d8c63b0ff5f3ae4b3a649f89a5513824f9eb6f33a137b190c059a4a6ba11a7b0ee50ba4a037c608c736e9ea375cf75b5d5ad93c946792f56b4350a953b7ece6969abbc1cd543e991ce92c45df3b2df8928d6df9c10741826277a0a477000000000000000000000000000045e4612ec198f3ff6c459a3943df90ab12827d510085cccfbc9f6030bdd0eaef6c3c2c379e9b109e7855d009628aefdec18d99e4f00679d8900541920082e644775c3b53a57b11758b2666369aace529731ec136598b95f741e25f7e69a74139a5e26d63db8d365a6dafb4f7a287ca2cb5101a7353740d0df384539655d707830de2d524896548fdb3e6d480064a1dac75ba10be43acf4e66ce4889a2d9001010102"], 0x1b0}, 0x20048000) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) write$P9_RVERSION(r2, &(0x7f0000000100)={0x15, 0x65, 0xffff, 0x414a, 0x8, '9P2000.L'}, 0x15) setregid(0x0, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000400)={0x6, 0x0, 0x2, 0x80000001}) 15:23:52 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0xec0, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xf0ffff) [ 960.674146][ T3549] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:53 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x33fe0, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:53 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x2000007c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:53 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x1000000) [ 960.949767][ T3669] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:53 executing program 5: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)=0x4) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) write$cgroup_subtree(r3, &(0x7f0000000140)=ANY=[@ANYBLOB="2d6959000000f8ffffffffffffffa341c0d4a811903a69332969192bb61963aa8f8242aeb49cb2b77cf12c22c173d644e900fcd82e38647a7d7c75cb90bf15393dde95a3a9a80f14b354c59c0eedb7847a95dfff40f8ecd1116d4694bbeb16fb81a75ed8785d482003f5ac719d8818f16ea4fbc80dc9eee606e1abdbcb50b15138"], 0xe) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x1ff, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_buf(r2, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r4, 0x0, 0x0) r5 = pidfd_getfd(0xffffffffffffffff, r2, 0x0) setsockopt$netrom_NETROM_T2(r5, 0x103, 0x2, &(0x7f0000000040)=0x7c68e38f, 0x4) fcntl$setstatus(r2, 0x4, 0x80000000002c00) 15:23:53 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x7ffff000, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 961.156552][ T3680] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:55 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a681085344", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x13d}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:55 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0xfffffdef, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:55 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x2000000) 15:23:55 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000680)=[@in={0x2, 0x0, @rand_addr=0x40}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000000)={r2, @in={{0x2, 0x0, @loopback}}}, &(0x7f0000000100)=0x59) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000140)={r2, @in6={{0xa, 0x4e24, 0x2, @dev={0xfe, 0x80, [], 0x22}, 0x10000}}}, &(0x7f0000000200)=0x84) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000080)={0x1, 0x3, 0x4, 0x400, 0x37e, {}, {0x2, 0xc, 0x2, 0x7, 0x3, 0x4, "71b3c3d5"}, 0xb883, 0x2, @planes=&(0x7f0000000040)={0x40, 0x2, @userptr=0xfffffffffffffff7, 0x9}, 0x52530, 0x0, 0xffffffffffffffff}) ioctl$BLKROSET(r5, 0x125d, &(0x7f0000000100)=0x1) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:55 executing program 0: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000040)=0x12080) socket$inet6(0xa, 0x2, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x200, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001080)={'macsec0\x00', 0x0}) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000200)=r4) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) splice(0xffffffffffffffff, 0x0, r5, 0x0, 0x4ffe0, 0x0) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x3, @any, 0x9, 0x2}, 0xe) r6 = socket$inet6(0xa, 0x2, 0x0) r7 = dup(r6) write$FUSE_LSEEK(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, 0x1, {0x6}}, 0x18) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) uname(&(0x7f0000000000)=""/28) 15:23:55 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = fsmount(r0, 0x0, 0x38) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r5) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) ioctl$VIDIOC_SUBDEV_S_CROP(r3, 0xc038563c, &(0x7f0000000040)={0x1, 0x0, {0x1, 0x5e21, 0x3216, 0x2}}) 15:23:55 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x2, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:56 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x3000000) 15:23:56 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0xa, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 963.786651][ T3852] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:56 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0xf, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:56 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x4000000) 15:23:56 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x25, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 964.008085][ T3928] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 964.160103][ T3936] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. [ 964.241246][ T3938] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:58 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a681085344", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x13d}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:23:58 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) splice(r5, 0x0, r6, 0x0, 0x4ffe0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'vxcan1\x00', 0x810}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$TIOCGSID(r7, 0x5429, &(0x7f0000000040)=0x0) sched_rr_get_interval(r8, &(0x7f0000000080)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:23:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x73, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:58 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x5000000) 15:23:58 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) unlink(&(0x7f0000000040)='./file0\x00') connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000080), 0x0) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:58 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$PPPIOCGFLAGS(0xffffffffffffffff, 0x8004745a, &(0x7f0000000040)) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xffffffffffffff9d) setregid(0x0, r1) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x0, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x32, 0x2}, &(0x7f0000000100)) prctl$PR_GET_SECUREBITS(0x1b) timer_settime(0x0, 0x1, &(0x7f0000000180), 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r2, r3, 0x0, 0x800000080004103) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x4ffe0, 0x0) r5 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) sync_file_range(r5, 0x80000001, 0x400, 0x7) 15:23:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x3, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:23:59 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0xffffffffffffffb7) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) kexec_load(0x1f, 0x2, &(0x7f0000000140)=[{&(0x7f0000000080)="015dc6bccea91a54ec06731faf8748c3fc255d904c5f328de9566f1906b2ff15f995e4127d11a2588861045c1a0c378581c8e885342a4856aa0b63518014f3660119f358ed5f02a765702f9bf5180a58d21db6e92b18fbe29c716276007e5a910c33f64609825a954da880241195672d411e5e8d6021f6a836826b43dc62d5c3b6ed23fc9c9d07ae338a79cb28c79759c498ce871fc822bba1294d2cc1ead29ef9b0f65cff4aa1a8467f3c07bbe6c959e84273fa1102cf912852bd79b66d9faa", 0xc0, 0xfffffffffffffffc}, {&(0x7f00000001c0)="9436dd06f006ca3e1ec96b9a6b6672e5be1a27497de1aa4430a4e8437af07acaccf72752bf5c3e1778b585147b2e2476e734df6894996cafba2536ec57f81d9c0dbb9cafac9b90a212fb73e1c100ecb809b6aca943b7b1679c4b051d453d9e355265863d57e44d34525e721dc7e1aac9c22ca2a6ee0c581f1af363f65969100677d8f3bfe16f8e703b6c35e7eee9830469c27cb2c8a69627b84da7db49cd6120", 0xa0, 0x1, 0x7}], 0x2) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f0000000040)) gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r2 = getpid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x21) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) sendmsg$NFNL_MSG_CTHELPER_NEW(r3, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0x30, 0x0, 0x9, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x1}}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xf}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xe}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:23:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x6000000) 15:23:59 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x802, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 966.874655][ T4062] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:23:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x7000000) 15:23:59 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x803, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 967.078410][ T4174] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 967.347020][ T4193] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:01 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x141}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:01 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x808, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:01 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = getpid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x0, 0x0) fcntl$lock(r0, 0x6, &(0x7f0000000180)={0x0, 0x4, 0x100000001, 0x7ff, r1}) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x14, r4, 0x605, 0x0, 0x0, {0xf}}, 0x14}}, 0x0) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x54, r4, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xcff}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0xd}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x32, 0x1}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@rand_addr="fd51813e57aaaf2aa5baa4ead4aff6ee"}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x88081) 15:24:01 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x8000000) 15:24:01 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(r3, 0x0, r4, 0x0, 0x4ffe0, 0x0) accept4$alg(r3, 0x0, 0x0, 0x800) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:01 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x246080, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r4) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$netrom_NETROM_T4(r1, 0x103, 0x6, &(0x7f0000000100)=0x7, 0x4) close(r6) r7 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ttynull\x00', 0x202140, 0x0) ioctl$TIOCSWINSZ(r7, 0x5414, &(0x7f00000001c0)={0x3, 0x2, 0x3, 0x81}) splice(r5, 0x0, r6, 0x0, 0x4ffe0, 0x0) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f00000000c0)=0x1, 0x4) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) r9 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r8, r9, 0x0, 0x800000080004103) 15:24:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xc000000) 15:24:02 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x810, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 969.938976][ T4231] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x12000000) 15:24:02 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 970.162515][ T4323] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:02 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$VIDIOC_SUBDEV_S_FMT(r1, 0xc0585605, &(0x7f0000000040)={0x0, 0x0, {0x3f, 0xa6c1, 0x0, 0x0, 0x6, 0x2, 0x2, 0x1}}) r2 = gettid() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {0x0, 0x0, 0x0, 0xb98b}, {}, {0x2}, 0x0, 0x0, 0xa, 0x0, 0xfc}}, 0xf0}}, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f0000000140)={r4}) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x35260000) [ 970.365629][ T4330] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 970.595648][ T4438] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 971.536311][ T0] NOHZ: local_softirq_pending 08 15:24:05 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x141}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:05 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$TCGETX(0xffffffffffffffff, 0x5432, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x2, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:05 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x39260000) 15:24:05 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) ioctl$TIOCL_SCROLLCONSOLE(r1, 0x541c, &(0x7f0000000040)={0xd, 0x4}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:05 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r6, 0xc0105303, &(0x7f00000000c0)={0xf7, 0x5, 0x6}) sendfile(r4, r5, 0x0, 0x800000080004103) 15:24:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x3, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:05 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x3f000000) 15:24:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x4, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 973.059158][ T4512] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x6, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:05 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xc0000000) 15:24:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x9, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 973.331374][ T4569] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 973.545505][ T4579] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:08 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x141}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:08 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) ioctl$SIOCAX25CTLCON(0xffffffffffffffff, 0x89e8, &(0x7f00000001c0)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, 0x2, 0x8000, 0x5, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @default, @null, @null, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f00000000c0)={0x101, 0x200, 0x9}) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000040)={'syz0', "060f04599cafad41bc42c6fd9c791b02dbf255c43da3241704c4da7838e3b503ca8b3868332974139cc6ec9ab5d4e9a4dd63606777ce36d9da1912277bb0d266d0edfcd6e21f7172378753a276a9ced98997f73d1f5255c63900"}, 0x5e) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:08 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xf6ffffff) 15:24:08 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xa, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:08 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x402000, 0x0) ppoll(&(0x7f0000000040)=[{r4, 0x18}], 0x1, &(0x7f0000000080), &(0x7f0000000100)={[0x8]}, 0x8) dup(r3) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) splice(r5, 0x0, r6, 0x0, 0x4ffe0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400204) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000700)=ANY=[@ANYBLOB="f00000ea2b34b800100013070000000000000000fe8000000800000000000000000000aae000000200000000000000000000000000000000f5ffffff090000a00000000094e3ddc58a0207d9dc11bc927d43cd7b307b19746fbfd2531edf40ae977e22dfd67e4ba3092740", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/164, @ANYPTR64=&(0x7f0000000440)=ANY=[@ANYBLOB="c5a2f1c5b8540feddb977493a2c1d28e7c231084a88dc68fdc7c01299e6a6b0437765e70777a8c259c482a7116253e5a6c670ff2d063f7a81624b5dd949a361042419f3ae51a218ca215be2daf2285a325b699e22d88bb195696956a63d9c38c0ac908af8348ffe82f2c70cda5785fb807de0f438eb0afab9c50b062544334d91377bb668618f6a0cdab14cd651a", @ANYRES32=0x0, @ANYRES32=0x0], @ANYRES32], 0x6}}, 0x0) ioctl$EXT4_IOC_MIGRATE(r7, 0x6609) write$P9_RUNLINKAT(0xffffffffffffffff, &(0x7f00000001c0)={0x7, 0x4d, 0x1}, 0x7) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) pkey_alloc(0x0, 0x1) 15:24:08 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x4400, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000000c0)={0x8, 0x7f}, 0x2) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r4) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r5, r6, 0x0, 0x800000080004103) [ 976.069496][ T4590] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:08 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xc, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:08 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xfeffffff) 15:24:08 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xe, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:08 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xff000000) 15:24:08 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xf, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 976.397522][ T4710] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:08 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) sendmsg$AUDIT_SET_FEATURE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x3fa, 0x8, 0x70bd2b, 0x25dfdbff, {0x1, 0x1, 0x1, 0x1}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xc0}, 0x44000) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(r1, 0x113, 0x1, &(0x7f0000000140), &(0x7f0000000180)=0x4) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 976.650605][ T4755] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:11 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x143}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:11 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xfffff000) 15:24:11 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f0000000080)={0x1, 0x6, {0x56, 0x800, 0x64dc, {0x1, 0x2}, {0xfc01, 0x2}, @period={0x5c, 0xefc, 0x1, 0xf74f, 0x6, {0x6, 0x4f96, 0x2000, 0x101}, 0x2, &(0x7f0000000040)=[0xfff8, 0x2]}}, {0xae, 0x69, 0x2, {0x8, 0xcd}, {0x5, 0x1}, @rumble={0xd8, 0x47}}}) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:11 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x10, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:11 executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', r4}) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000200)=r5) r6 = socket$inet6(0xa, 0x2, 0x0) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) ioctl$VIDIOC_ENUMOUTPUT(r7, 0xc0485630, &(0x7f0000000000)={0xd8e9, "68cb91a33a84d107a6874ad606d565e7b6989e50243f61176fb80007a41905b1", 0x3, 0x13f, 0x2, 0xff, 0x8}) 15:24:11 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video35\x00', 0x2, 0x0) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) splice(r4, 0x0, r5, 0x0, 0x4ffe0, 0x0) ioctl$VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f00000000c0)={0x2, 0x1, 0x4, 0x80000000, 0x10000, {}, {0x4, 0xc, 0x1f, 0x57, 0x1f, 0x8, "9280a6c9"}, 0x6717, 0x3, @fd, 0x8f, 0x0, 0xffffffffffffffff}) sendmsg$nl_route(r6, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="740000002100020029bd7000090000000a800005080000000400000008000e000700000007000100fe88000000000000000000000000000114000200ffc4730100000000000000000000000000011400020000000000000000000000000000000000140002007eb51b8d7544346a9b0b39f1328f23aa"], 0x74}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r7, r8, 0x0, 0x800000080004103) 15:24:11 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x60, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:11 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xfffffff6) 15:24:11 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xf0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 979.323212][ T4894] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:11 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x300, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:11 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xfffffffe) 15:24:11 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sysvipc/sem\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000200)=r3) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = dup(r4) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$ASHMEM_PURGE_ALL_CACHES(r6, 0x770a, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r7, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$TUNATTACHFILTER(r7, 0x401054d5, &(0x7f0000000080)={0x9, &(0x7f0000000000)=[{0x5, 0x3f, 0x1, 0x20}, {0x401, 0x40, 0x0, 0xd17c}, {0x40, 0x6, 0x3, 0x97}, {0x2, 0x1, 0x1, 0x800}, {0x3, 0x6e, 0x2, 0x4}, {0x3a0, 0xfc, 0x80, 0x9}, {0x100, 0xef, 0xff, 0xe1a}, {0xa3, 0xef, 0x9, 0xbf8}, {0xe789, 0x6, 0x5, 0xffffff7f}]}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) [ 979.631059][ T4955] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 979.980084][ T4967] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:14 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x143}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:14 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x600, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:14 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe0, 0x0) r3 = openat(r1, &(0x7f0000000040)='./file0\x00', 0x6bcc293017cc0451, 0x2d) setsockopt$inet6_tcp_int(r3, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r4, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:14 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x1000000000000) 15:24:14 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) splice(r5, 0x0, r6, 0x0, 0x4ffe0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f0000000640)=[{&(0x7f0000000000)=""/74, 0x4a}, {&(0x7f0000000100)=""/196, 0xc4}, {&(0x7f0000000300)=""/167, 0xa7}, {&(0x7f0000000440)=""/130, 0x82}, {&(0x7f0000000500)=""/169, 0xa9}, {&(0x7f0000000240)=""/106, 0x6a}, {&(0x7f00000005c0)=""/84, 0x54}], 0x7) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:14 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sysfs$3(0x3) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:24:14 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x900, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:14 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xf0ffffffffffff) [ 982.365486][ T4993] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:14 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x80010, r2, 0xef57c000) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:14 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xa00, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:14 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x100000000000000) 15:24:14 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xb2a, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 982.622673][ T5103] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 982.848968][ T5214] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:17 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x143}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x200000000000000) 15:24:17 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xb2e, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:17 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(0xffffffffffffffff, 0xc0845658, &(0x7f0000000040)={0x0, @bt={0xd1dd, 0x0, 0x1, 0x0, 0x6, 0xffff, 0x2, 0x5, 0x10001, 0x6, 0x20, 0x5, 0x3f, 0xc5d3, 0x0, 0x0, {0x5, 0x4}, 0xff, 0x4d}}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0xcc, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000140)=ANY=[@ANYBLOB="0200bd000c2adcdaaaa9a371c794d1aa0848193bc62c0d5304f454726505de17590c362e2dd97b9006e20e3bb99f2c49f0cd148f07092108b498fa63619e5503e89045a174bdf7589358a050c04d680c9e4033053faf10e67f3305b43afdf9f1347ca0769492e2907d146413eaa147dd5a3dda0bf5ccdcf5f22d699c9775adcb41aeb27e7374c41968e515d4732e705204ac69534cada5fa2063a461dd161e2e3d541a8ec83f08cb13cfb6336a103a5321cf821057ca5df1e7cc9390b54d1cf22e"]) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000100)) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:17 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) getresuid(&(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) r5 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040)='/dev/input/mice\x00', 0x2) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000080)=r4, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$SIOCAX25OPTRT(r5, 0x89e7, &(0x7f0000000100)={@bcast, @bcast, 0x2, 0x44}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) splice(r6, 0x0, r7, 0x0, 0x4ffe0, 0x0) ioctl$VT_ACTIVATE(r6, 0x5606, 0x10001) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000002200)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000001000003e634694fe736a3e8d57b4bf1c6e61137f318c55fa29a72f5db03248bb56177c341b99319af0b217b2048bb8f5a19c9fdae3f69b89a41b4cbc3477a2827198f9920636a759a160df71fd16f601f088c97687f962d5e0b2ee7ab10133fedcf3381774918da88735d9d8aa8a502116ea679dbec010dab9a5b0469c76530310766f623ba863bbb8bc5233782fc10f383098b9d47ff006ea1454031c707229f679f7fc78d0e8e5864fcd8ab485d5311845e90a828d9a9fdb6d806e2f5cc8ffc1ddd71b0dbe7b4a5e38e24c6c9a8b9304d074d71125ff5db749da903f160d3746715abf987f9130e7a5374844fcd0822d57581a5bfb7b88f81ae1b2dc309705be3708c475e959ee3206c0ca66f41ef728086ea18eba91dc6287a8c1c9cec2c00f0d352892b4e7c92a8ae07614c6fea7d2f7eccace1fc248e97ed6c6f8b333d4f29703ccb6d0d3435dce03d8c4dadfc0a06510a7c103019e54d64912342e3593fc272eeb560cdde67ae82b5a8b645ec9acc597411de84132ceadda02cce89056da6bb869417c6a73a83826690d2f84c2d41d13e33e8a6e2fdb6fb888935bd6ca37f478b4079a2bd8c9553de3076d9d32712cc90578f16825140e930f805c3f02c40b57ad010742444d338e659b783516696cb4b9730865d8215590162b0f3e4ed192e826452286ecdeac4139b651ecb2dc5404531076657f1c414ca5efd3e0d61599dfcdea8c6327ac5e367b4e44f523a8535cc9e6b8fc4c83bd9d12ba916b51fa772615cf8292e1764d4d873b040e1ee0415f890bc2d96aa130f6b7a8a36ac9f290fab05e77c640ef6b12567064309d66d1ece113f6e0e9e3a337d108756a3745f8a374ed550174089363a1c6f34ba4f510a65f78ab06068eaa45dc8cd41fb5e028f9b3db4e8332e4e65fdf8d85de32f27a459c5fdc050f8ef4f45be0b0b1f65acdb01a1ae5e30f90bbe1b59f895dc752006bffae6a6f0b8ab8cfeee53b6b7a25aa443d960599f05bede73d9ad07d55ed2ca8156e12e1fce9fe7a2bdcee7b458cd8ceef62d6c41e9574890945ec1f767f6a4cbca63628700133af5daa287ae22cd3517d24f95cebceeacb002ac505f91bfea4615b842b3e952ccd65d81644b600806f6a8862035a8565090aac452470226f4f383bcee04a2a50de8d9e493c55903b01f7089cf3c010d9783ab4782597214bab56acd9ffbe5bd01eee860869efd56e9561cb6de412efa46e9dc5276d933fb499312e7f3264fcb1542d7088b45ab12a3838145f7431906f2059a28b7cf2acccf3c8d29d966db0bbac5793c059d0c9f647fb6c322063de91cdb835bf70515b6b75711d1b8437e6dacd15e4d41d59ee80ecc10b8b51eaf3b6135b5343041840bdeb6126d737689d36f0b4262b2658c0a595e992d8858a341067875a60b05062a0bc0c79d0059f8e4dfc1c641cb6566bf71f5456d10ff2c53e16b6ca475aec0ff5d8ca6e8d1e71fa61fa4b5c69c7c90472aca5699ec97971239268de0d2dae22b43ae273ed3b24b0167c3419eb94f6030a96955ac1babff66c8994de8afc18a9948f126e6e1b0f015c7e680e954f3b31001996e30f01ab1c914c6c337c2b124331387c19c7b968d08db6282e3178680b66ca69b4c160a8b24a3990327fa7949c10b444fbedca16618627c9fd0d546e83a77d523f98de86d9c2111dbcc45ebfa2b5d85af14d1b03071563d62ea0f6b64afedf63c61f908dca4a7b93092f78126995e0646c1291df943992a03072f8e5413970c6afa9091c4efc167d39045d19d20542f4c698e7137e286c48370b560b1e12bbd7f25ce0965a6f029ca5c1e30957d6f7cdbec5dd9aab952dfcf236c2809653326ecf087d7a5fe29f941cd9bfb5f5ad881ab74a9bb377eb4e6e565952ba87f1a49cb8370cd099391fc121386113604fc63ccb8331bcf2a6ca34bd596d28ecfb11b30bca5aeafacd5da92e138e6a39d562741b0f4e96d8eaf7248378322b92b29cc0df1c223fcdda97636e52a29bd75a9e0538940b8bf890d7d8d96ed438cf9e08bde0eeaedbefdac1db4222a576b92ffd2a2c3e573957f7b1982526b3332e3816a3c7d6600ba775b328fd9b34366ae4300de2f8838d3e1f77ec1cbe8a2a3da2cef4c4e143224fb492352bac65a5b2350242644616bad7fb54a93e93d527101901ae26e7fcc5a54ce1a207a85db1769384d9f37694c6702885e771c21bd18a4397035910afd150bef08040f64f023d82b4584607701ab04f96c5bf43317f5b8a971bf33dd4cfc4df73a8ce07a9b45a44fe1d6dbed69a1d955584ded88fcd0b80a31d0ddb75f7fa095d957b18457c1dc5c580402a3c554cf419ba13f6dd93dde57bcc12e588c0b96a52d531b02655e0cc940fae1a41d255490eb04e0349a5a56deff8c6f35402f88225b663d6877dcd5fb0762bfcfeaf386e43d070915dd777d2c5e03a2dea74cba363e5145138f76567b5306b813e30985e9ee15a7603409c344ee4cf43a136d778afaa6bc352263bf1e6c9e28ff7a5a9767e90427f1ae84c2f8741db42cdef7ce918116d9d5377dde874f2fb42eb03db08220f43fe5ea8b055f64af883045f10ecbb8f16e9d584666aa70415ebef430ae35e20f339dc903cad4864025024bf17c6cdd0ca1d5d04849d7f5eb3db5053f83027abb32512c8c7161bf07a4d5431092032fb46c1e1e6a3024e62e2eb75218d27054fcc3e98dcd050349588bea49b37eb893594d2abd34166003316ae9900ac07d8a92f836aad4784694d46baebda0b750b30e9b016aaf56caabb7bf8af46a8c2b6e30fd0fe7479df12bc4186e7f97d951871e4fffb97acda46e1f088c3c25ec3c8e65d477dcba90128944c8dc00c0a2fc10c34fc11db9b3a398679dace99c7af5089193ffb22c443aec7b8906ae77f6b52c0b2e8f6d3174a5ab380327c24e72e813e3721d181aff48b3bc95c4d93798e3120ab7735c88ce063d9437c10427e88d8d74da0141227355f6ce5590d3ef89d1889cc58de8ec63ef0adaa180afbba6b6f0c639f446d1d854ba545afa1f69fdad32e5311d6885b4bef0e670f13c5598f07a3be61926c293b05a77292bcc6e07da745461b40d65e85a97b9df9d855ebceb14879c652065dd881f370ea7e5ddf1fb0a7b0d938c5f145a2d60b1c55097061f9e908797d212a9889b896f1f0a950055732fb554d1c3a3f5f53e67ddc33ee96502b68c193d87d28a659c678487c2cb199f997839d5e973e10d7af8e60165619e00f107da2b7498a330079cdddc61bec65b360a1bdc98174b9dac4b740a256c23bc25110bf6da6dc2a94e16ba747c84a139690701837e96524f7bd088ce5f118708b96afb8d1fddac5321ce4b2e8bb2e33439b9fc74f030dff41fbddfeb6b5772d5b09e7402bbd4d80cbf0780886e4d37ddda9b6172255927847e831b37cfec2ea162db2b987de5196e7926b6e24b1151e1e8d93e6f9d6d1401a9262d6c6a93e9e9b7e22ab7c83a7e9abcbc1b8f01bb89e7b66d6cad6a3dc3635cfc13e768e06ca64ccc3a100db0d361d235f4e5e2aa25c3fabea60212479fb6ca30b137dd15555237094321d6d6ed4e8128b19141f77cce4fe1394d43e7d5bbc085f78f484055ac87d0231e4e2008b56929b686b8b6249cac026279723f346aff929148589d1cf75845e1636a89430fa61abb0bd376e341fc24ca76c47edbe1b1ca42e050b903170de0d3bc23811f971847e149715b325a488a88b530c37613f0dea7e79970bb74c8297c28b92b2d5b7d165c57d220737e044ffbb5775180101fe6c9cefb46611b4ff7b38c716e1cd42a335c42d0a30e2968e627b4568422ada63a2aeecac89ed6bbfa1a50d2f353d2574a0a1cf64c2c86bf35db071bb745494c4d5bd725b8bc4011bab44e85cef827ce470b7de5162351e75a34cfd4cca1b9e2c3725a8ed31451aa13e568a5c29206dfe5fd2f3fb799b9b3fb16a90a316e972e1eae005e2d0c045aa501af2acc071cba786bd581434ac0ba2b6c7232985d79673e7a4d9cd854c52443d485230acabdca1e9d3648be103cbcbd17b507507e817783dde9f53889a9ce155252594ed47849365205bb7a489c9f47b6cd30049e9a9ffe4946bb0f6c335222b5fd4dd4037db0deab19966fcbf18ed406044004b8d996f11071b405dca89f1036d6134a0ace26ca5b4643ac8fca22517b2212c3ad88a4a301bb6457abc7945463478202d7447bf168b691adfcd890a86f0a91b2e77380372575746911ed25233886ebf3b40440ccc5ca145d9696eb832cd9a7ad5366bad98ecb6a03b7863d12e2a2b4fe2b2ad0a9a5cd6be0b4fd3ad87382d5b9c44b3d0d4267b3299141abdea2dee378cc1b5339adafbbd804c261c7527becfe3f5408de5fc4c5fdf9878cf44b6a33060a2faf6c246ce7b29c5f73da45e6ccb2b184fe8b467a5bae005745ffdefe8be4af0faa29251fd161f6c99b0762964a3f0aa4fe40c5aa560116d07cb25604ed48ba07b44685020cdfac1835b4ac283c824ef310421703b6b36724377047609d93146ee4520cf3f8a757d8cd69970b44ff2bbc9869aabbff46c38dab060d9eb3326ac5d095fc731696a1f4421d19940b0816d81323d902375d22c5020cd11835cf0e6489dc8f0795e7e7262d20e8bfd86c13c3eb1a8bc1108578d68e9f0f9e37c4818d9a071c5f7e683d106c54d74926d7abd1650b8870860ac770f745394676399c2b85372a38a3efb0508786d5ce8628c21858af00c3687828167d1615d84ad525fdab044c34eae95fe0e1c1b41026d4cfece321b6b3400c1446735942fbb96ec9917aebaa8621e567c4425ca8d92fea8bcd1e5829733ced66517eacb69d62514bc52d5a2656ed90d1d10bd92498ad4ab221462e9421da6194d06c0a49cf22f7401901ad886fb1c6f013d15f254ec10c149bf2c24bf22c725115fe2fbbe04a296774e2ea7f562647e352c561c34d9341ccfac429dca78282c9f426f81a67781e75d7a6ce3d7f72034ea1a90811112cfe98a555aa5e431d7280763663f70bf9d32a3a9e4650df7d904f9b37f9b12261e55d36309bc270a71a2fc174df9c695c0e1c17d2ddc22a2e82e35829565fdb095dad2c62babc9ea1c5ccd583c00dc1c24a2d02d52e792520ff0f13a999ffbd85ae4bd0c729dfa648927f8cf3d464790e520f908698ef229405094f2ee6dc18b58dba069ecd436dafc3371392e53b8c51fc05df06bc07e55b41afd828c118939b91a554938d2efc44e7286ed5474357aea76a618d7a8b8bd476c118aab1f11681d48c3e945827d40dc21e3613a04db133601bceb517e21d64233bec2d60c6061f54de55c5b894c5674d1860052b66a0865d597141592be9873e9affb8c32046f9b7018619bdc1e432d9277611e078aeb4416d8cf7529e46fa655b5ddfcd6f4bfb258fc2a449025016312dfa9135987464ccbb2dcc2d1ee917491e71ee8e63a76172d63f3bbbdff9775157e564fa7e859a17b22708f1b2427688fbe9f66c7fe62dd61e181d60ff99aaa9d59db2a9382782072be5e7e3794e0e75b2ebd1cb1d8b40aa3364ac1f19752d5b75f094583d424241b93f4db8f5f74d5023be9a78b3c1b514046e8e078f606d83681cfe3ea96368b19f4068dfc209e594c80a2099677a3c6e845d83442ddb87f8cd3461fdadba755b66072a4ede59b975865092bc897dabbf2d3a16ee8b2f0aca84ba88d3fe38576b1a0bbffc1f7266392e143939c413fb387eafafe57b065b2c0ef709f292534e39c01333922d83bb32ecf8c5472f39bac8dd504f4354cac95b7b498d8bbdb97552aa70ac5e7e407d29fa450d8773db9a1cdf4d5c81ba6420683e4727cb7e2479996cc206326e39380800b39f46e42336afff7e1be9fa47a7bd0a25a77ea83a760bd226e98cf73cb06f7c9701b6edfc2f01b492567a38760aac6511cbee850275dc4c0f0af67266c1d08147ec2b4e0653482f6204c46dbc7e2cf0892945ce38db79a19e23f61ed3d660aaa2ad7ba16799c9fcbfad88dee854599ea7f36b8c9162bb55aa0c1a3b615f8d1c34b9a90b092427ca78646b6b663b45c979009912f852a9c69782682150b8ee0537a8ba4391cd0e53b8603b41f90675b069a92ed30509891fb318d873925bcff6c0f6089a3fef92c76d543acf6d6e2b143c24d16624cfd"], &(0x7f0000000000)=0x1024) 15:24:17 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000100)='./file0\x00', 0x123) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VT_GETMODE(r5, 0x5601, &(0x7f00000000c0)) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r6, 0x0, 0x800000080004103) 15:24:17 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xc00, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x300000000000000) [ 985.507359][ T5280] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:17 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xe00, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:17 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xf00, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x400000000000000) 15:24:18 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x2a0b, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 985.788525][ T5346] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 986.035476][ T5356] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:20 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x500000000000000) 15:24:20 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000040)) 15:24:20 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x142}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:20 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) socket$rxrpc(0x21, 0x2, 0x2) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='reiserfs\x00', 0x88804, &(0x7f0000000180)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:24:20 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x4b) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet6_mreq(r3, 0x29, 0x15, &(0x7f00000001c0)={@local, 0x0}, &(0x7f0000000300)=0x14) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in=@local, @in=@multicast1, 0x0, 0x8000, 0x0, 0x0, 0xa, 0x0, 0xa0, 0x84}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}, 0x4}, @in6=@ipv4={[], [], @multicast2}, {0x0, 0x0, 0x0, 0x1, 0xffffffffffffffff}, {0x0, 0x4}, {0x0, 0x0, 0x3}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) r7 = dup2(0xffffffffffffffff, 0xffffffffffffffff) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r7, &(0x7f00000007c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000000108010e003e38880412f711de74d6a780c5b21300000000000000130000061c0004000000014000000008080002400001000206000240910000000600024089170000"], 0x40}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f0000000540)={0x40, 0x3, {0x0}, {r9}, 0x9, 0x80}) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=@newsa={0x1e0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in6=@empty, {}, {}, {}, 0x0, 0x0, 0xa}, [@sa={0xe4, 0x6, {{@in6=@empty, @in6=@empty, 0x4e23, 0x3, 0x4e22, 0x8, 0xa, 0x180, 0xa0, 0x3a, r6, 0xffffffffffffffff}, {@in6=@mcast1, 0x4d6, 0x6c}, @in=@local, {0x1, 0xfff, 0x5, 0x95, 0x5, 0x8, 0x100000001, 0x6}, {0x20, 0x7, 0x1ff, 0x2}, {0x5, 0x1000, 0x6}, 0x70bd28, 0x3504, 0xa, 0x3, 0x1, 0x1}}, @mark={0xc, 0x15, {0x35075a, 0x100}}]}, 0x1e0}}, 0x0) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x3, {{0x0, 0x6, 0x1, r10}}}, 0x28) ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r5) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'batadv_slave_1\x00', 0x420000015001}) 15:24:20 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x2e0b, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:20 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x4000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:20 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x600000000000000) [ 988.596774][ T5477] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:20 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x5865, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:21 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000040)=[@window={0x3, 0x2, 0x3}, @window={0x3, 0x81, 0x9}], 0x2) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r2, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) splice(r4, 0x0, r5, 0x0, 0x4ffe0, 0x0) getsockopt$inet_opts(r5, 0x0, 0x9, &(0x7f0000000100)=""/152, &(0x7f00000001c0)=0x98) fcntl$setstatus(r2, 0x4, 0x80000000002c00) 15:24:21 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x700000000000000) 15:24:21 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) r3 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:21 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x6000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 988.854115][ T5487] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:21 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0xfffffff9, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() r2 = getpid() prctl$PR_GET_CHILD_SUBREAPER(0x25) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x0, 0x0) ptrace$cont(0x18, r2, 0x2, 0x1) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 989.118815][ T5602] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 990.734762][ T0] NOHZ: local_softirq_pending 08 15:24:23 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x142}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:23 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x800000000000000) 15:24:23 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x6558, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:23 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) recvmmsg(0xffffffffffffffff, &(0x7f0000003fc0)=[{{&(0x7f0000000040)=@caif=@rfm, 0x80, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/192, 0xc0}, {&(0x7f0000000180)=""/229, 0xe5}, {&(0x7f00000002c0)=""/124, 0x7c}, {&(0x7f0000000340)=""/60, 0x3c}], 0x4, &(0x7f00000003c0)=""/122, 0x7a}, 0x8}, {{&(0x7f0000000440)=@x25, 0x80, &(0x7f0000000840)=[{&(0x7f00000004c0)=""/161, 0xa1}, {&(0x7f0000000580)=""/170, 0xaa}, {&(0x7f0000000640)=""/221, 0xdd}, {&(0x7f0000000740)=""/225, 0xe1}], 0x4, &(0x7f0000000880)=""/187, 0xbb}, 0x9}, {{&(0x7f0000000940)=@nl=@proc, 0x80, &(0x7f0000000fc0)=[{&(0x7f00000009c0)=""/171, 0xab}, {&(0x7f0000000a80)=""/27, 0x1b}, {&(0x7f0000000ac0)=""/248, 0xf8}, {&(0x7f0000000bc0)=""/155, 0x9b}, {&(0x7f0000000c80)=""/130, 0x82}, {&(0x7f0000000d40)=""/77, 0x4d}, {&(0x7f0000000dc0)=""/217, 0xd9}, {&(0x7f0000000ec0)=""/215, 0xd7}], 0x8}, 0x30}, {{0x0, 0x0, &(0x7f0000002200)=[{&(0x7f0000001040)=""/89, 0x59}, {&(0x7f00000010c0)=""/78, 0x4e}, {&(0x7f0000001140)=""/57, 0x39}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000002180)=""/114, 0x72}], 0x5, &(0x7f0000002280)=""/73, 0x49}, 0x8}, {{&(0x7f0000002300)=@pptp={0x18, 0x2, {0x0, @initdev}}, 0x80, &(0x7f00000029c0)=[{&(0x7f0000002380)=""/135, 0x87}, {&(0x7f0000002440)=""/183, 0xb7}, {&(0x7f0000002500)=""/70, 0x46}, {&(0x7f0000002580)=""/110, 0x6e}, {&(0x7f0000002600)=""/29, 0x1d}, {&(0x7f0000002640)=""/88, 0x58}, {&(0x7f00000026c0)=""/139, 0x8b}, {&(0x7f0000002780)=""/246, 0xf6}, {&(0x7f0000002880)=""/149, 0x95}, {&(0x7f0000002940)=""/119, 0x77}], 0xa, &(0x7f0000002a80)=""/153, 0x99}, 0x1}, {{&(0x7f0000002b40)=@nfc_llcp, 0x80, &(0x7f0000003e80)=[{&(0x7f0000002bc0)=""/69, 0x45}, {&(0x7f0000002c40)=""/95, 0x5f}, {&(0x7f0000002cc0)=""/69, 0x45}, {&(0x7f0000002d40)=""/205, 0xcd}, {&(0x7f0000002e40)}, {&(0x7f0000002e80)=""/4096, 0x1000}], 0x6, &(0x7f0000003f00)=""/161, 0xa1}, 0x9f58}], 0x6, 0x40000100, &(0x7f0000004140)) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:23 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'syz_tun\x00', 0x800}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="f0000000102509070000000000000000fe8000000000000000000000000000aae000000200000000000000000000000000000000000000000a0000a00000000025f5d0225c4d5a69f144f3218839871eb7bcec8544ef95c9864a04ab82ebe9fa0edb727eb9aac48a01c0ea8d8ddfbdfcf1e00fe8063f3711e45fd1e75841e781924d5b93407a6c63c6bed9bdbb9bac64bd220e9886966fc3fba35a19185126be56f4441fe7615f55b31db2342bda355297474bbca99d362b73f24466a08364baa3988f92d47ad1a3764fedf013815d2443e96f3cf1ccc7a3b68adf1480b2856b0daf7179a6f7db", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000000)={0x0, 0x0}) capset(&(0x7f0000000040)={0x20071026, r6}, &(0x7f0000000080)={0x9, 0x9, 0x80, 0xe6, 0x4}) 15:24:23 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x800000080004103) 15:24:23 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x8100, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:23 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xc00000000000000) [ 991.617361][ T5745] capability: warning: `syz-executor.0' uses deprecated v2 capabilities in a way that may be insecure [ 991.619820][ T5743] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:23 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xf000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:23 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TIOCL_SETVESABLANK(0xffffffffffffffff, 0x541c, &(0x7f00000001c0)) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video36\x00', 0x2, 0x0) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ocfs2_control\x00', 0x100, 0x0) ioctl$KDSKBMODE(r2, 0x4b45, &(0x7f00000000c0)=0x3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r3 = socket(0x10, 0x2, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) splice(r4, 0x0, r5, 0x0, 0x4ffe0, 0x0) ioctl$SIOCX25SDTEFACILITIES(r4, 0x89eb, &(0x7f0000000180)={0x72, 0x5, 0x7, 0x6, 0x5f, 0xae, 0x26, "716ec6849f28dc4c5a672fb8346999da88ee44f5", "74371ec0da1d83d9ab2d8daa9fc76b2b6527e268"}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r6) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r7, r8, 0x0, 0x800000080004103) 15:24:24 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x44001, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000040)=0x75) r1 = socket$inet6(0xa, 0x4, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000200)=r3) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:24 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x1200000000000000) [ 991.933811][ T5842] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 992.153185][ T5853] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:26 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x142}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:26 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xf0ffff, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:26 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x3526000000000000) 15:24:26 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) r2 = getpid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x0, 0x0) close(0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x1) write$binfmt_script(r3, 0x0, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_LOCK(r3, 0x4008642a, &(0x7f00000002c0)={r4, 0x9}) ioctl$DRM_IOCTL_DMA(0xffffffffffffffff, 0xc0406429, &(0x7f0000000180)={r4, 0x6, &(0x7f0000000080)=[0x2, 0x7, 0xffff, 0x7, 0x20, 0x7fffffff], &(0x7f00000000c0)=[0x7f, 0x7, 0xe, 0x0, 0x80], 0x6, 0x8, 0x89, &(0x7f0000000100)=[0x6, 0x6, 0x4, 0x5, 0x8000, 0xfffffffd, 0x401, 0xe7], &(0x7f0000000140)=[0x9, 0x9, 0x5, 0xff, 0x8]}) sched_setparam(r2, &(0x7f0000000040)=0x80000000) 15:24:26 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'gretap0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=@known='system.posix_acl_default\x00', &(0x7f0000000100)='eth0\x00', 0x5, 0x1) r4 = dup(r3) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x4240a2a0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$PERF_EVENT_IOC_RESET(r6, 0x2403, 0x81) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="7d0800000000000000d619620800"], 0x14}}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r9, 0xc08c5332, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r9, 0x402c5342, &(0x7f0000000280)={0x0, 0x700000}) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x20}) 15:24:26 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) socket(0x10, 0x2, 0x0) accept$alg(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r4 = accept4$rose(r3, 0x0, &(0x7f0000000040), 0x800) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r5) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r6 = socket$bt_hidp(0x1f, 0x3, 0x6) sendto(r1, &(0x7f00000000c0)="a077249bfe6748bd8c814fd13c5a8bd2de1d385b1383300dcb13d4ed289cebb0a76967c3c0946573b73e75e23c215209b69c2512652ce333a9192ecc2c094c7bc0992589e6813a03883816a120e413111f9d2902e3c9", 0x56, 0x80050, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r6, {0x2, 0x4e20, @loopback}, 0x4, 0x3, 0x2}}, 0x80) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r7, r8, 0x0, 0x800000080004103) 15:24:26 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x1000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:26 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x3926000000000000) 15:24:27 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x2000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 994.728073][ T5923] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:27 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x3000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:27 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x3f00000000000000) 15:24:27 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x4000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 995.018787][ T5989] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 995.292523][ T5999] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:29 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:29 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x6000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:29 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xc000000000000000) 15:24:29 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r0}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000480)=0x14, 0x800) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f00000009c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000980)={&(0x7f0000000a00)={0x4b4, 0x0, 0x2, 0x70bd27, 0x25dfdbfc, {}, [{{0x8}, {0x174, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x1637}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8}}, {0x8}}}]}}, {{0x8}, {0x1a8, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x6}}}, {0xa0, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x5}, {0x8, 0x4, 0x400}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xf, 0x4, 'activebackup\x00'}}}, {0xfffffffffffffea0, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x5}, {0x8, 0x4, r0}}}]}}, {{0x8, 0x1, r1}, {0x16c, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x5}, {0x8}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x73}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x5}}}]}}]}, 0x4b4}, 0x1, 0x0, 0x0, 0x24000010}, 0x4000) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0xf0, @dev={0xfe, 0x80, [], 0x2c}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r6 = gettid() setsockopt$inet6_buf(r5, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r6, 0x0, 0x0) 15:24:29 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x44) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40286608, &(0x7f0000000280)={0x40, 0x2b2, 0x3, 0xfffffffffffffffe, 0x8, 0x1}) r5 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x35040, 0x0) getsockopt$inet_sctp_SCTP_EVENTS(r7, 0x84, 0xb, &(0x7f00000001c0), &(0x7f0000000240)=0xe) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$TUNSETLINK(r6, 0x400454cd, 0x206) setxattr$security_ima(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.ima\x00', &(0x7f0000000100)=@sha1={0x1, "4889eb6ba99a2c641b22766dc49be6b1cf2a65f1"}, 0x15, 0x2) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3000110063696966300009ae872668bb000000000000000000000000b3bbffa768f8b10b21f2200001800000"], 0x30}}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'dummy0\x00', 0x420000015001}) 15:24:29 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f00000004c0)={0x2, 0x0, @ioapic={0x0, 0x80, 0xffffff01, 0x46c, 0x0, [{0x4, 0x40, 0x7e, [], 0x1f}, {0x3, 0x9, 0x18, [], 0x3f}, {0x5, 0x6e, 0xe, [], 0x7}, {0x80, 0x7f, 0x1, [], 0x3}, {0x69, 0xd0, 0x80, [], 0x7f}, {0x80, 0x9, 0x0, [], 0xff}, {0x7, 0x65, 0x9, [], 0x7}, {0x81, 0x1, 0x6, [], 0x81}, {0x9, 0x9, 0x6, [], 0x1}, {0x0, 0xfd, 0x7, [], 0x8}, {0x6, 0x9, 0x81, [], 0x5}, {0x1f, 0x7e, 0x1, [], 0x5}, {0x81, 0x7, 0x1, [], 0x81}, {0x5, 0x44, 0xd6, [], 0xff}, {0x3, 0x3f, 0xaf, [], 0x3}, {0x1, 0x1, 0x1, [], 0x20}, {0x1, 0x6, 0x9, [], 0x3f}, {0x7f, 0x4, 0xf9, [], 0x5}, {0x7, 0x20}, {0x1, 0x7f, 0x8, [], 0x3f}, {0x81, 0xe0, 0x40, [], 0x9}, {0x5, 0x4, 0x81, [], 0xbb}, {0x81, 0x8, 0x0, [], 0x3}, {0x69, 0x6, 0x0, [], 0x6}]}}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) r3 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x7b, 0x400500) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f000000010001307000000000000000000e1ffffffffffffff00ffffac141430e000000200000000000000000000000000000000000000000a0000a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffe000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000a00"/168], 0xf0}}, 0x0) connect$pppl2tp(r3, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r4, 0x2, 0x0, 0x4, 0x2, {0xa, 0x4e21, 0xfffffff8, @mcast1, 0x3}}}, 0x3a) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/ip6_tables_matches\x00') setsockopt$TIPC_SRC_DROPPABLE(r5, 0x10f, 0x80, &(0x7f00000001c0)=0x4, 0x4) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r6) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='proc\x00', 0x10a0000, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="19f1d6ca", @ANYRES16=r8, @ANYBLOB="000425bd7000fedbdf25160000002c0007800c0004007b000000000000000800020099faffff0c00030005000000260000000800020000800000"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x20) r9 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r7, r9, 0x0, 0x800000080004103) 15:24:29 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:29 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) r4 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x5, 0x101001) move_mount(r2, &(0x7f0000000040)='./file0\x00', r4, &(0x7f0000000100)='./file0\x00', 0x20) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r4, 0x84, 0x13, &(0x7f0000000180)=0x49, 0x4) setregid(0x0, r6) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(0xffffffffffffffff, r7, 0x0, 0x800000080004103) 15:24:29 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x9000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:30 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000080)={0x1, 'ip6_vti0\x00', {}, 0x1ff}) setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$USBDEVFS_REAPURB(r2, 0x4008550c, &(0x7f0000000040)) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 997.813336][ T6084] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:30 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:30 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xa000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:30 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xf6ffffff00000000) 15:24:30 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000100), 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000000040)=0xc) setregid(0x0, r4) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r5, 0xffffffffffffffff, 0x0, 0x800000080004103) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r7, 0x0) write$FUSE_CREATE_OPEN(r5, &(0x7f0000000180)={0xa0, 0x0, 0x5, {{0x0, 0x0, 0x0, 0x3, 0x7, 0x1f, {0x0, 0x7fff, 0x8, 0x4, 0x401, 0xf34, 0x1, 0x8, 0x2, 0x7, 0x1, r7, r4, 0xfff, 0x10000}}, {0x0, 0x10}}}, 0xa0) 15:24:30 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:30 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 998.264296][ T6258] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:30 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:30 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xc000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:30 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xfeffffff00000000) 15:24:30 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000100)="cdcbab1ba4062370706b1a08000000ef3f91806daab55979d24af30cd0c3a0d82d2f216b52240ff5a40761267551f3532daae19b1515ca258594cbea422ac30d323e963dc27d317e694a593b53209c9126a247c3718dc3f57e59ee144dd5fedc5d230295bd00ded127d9dd66d7db5eed98192b5ca4175cf6c4d804bf40f08a", 0x7f, 0x40, &(0x7f0000000040)={0xa, 0x4e24, 0x7, @remote, 0xfffffffe}, 0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r3) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:30 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$inet6_tcp_int(r1, 0x6, 0xa, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e21, 0x2, @empty, 0x3f}, 0x1c) ptrace$setopts(0x4200, r2, 0x8, 0x4) fcntl$setstatus(r0, 0x4, 0x80000000002c00) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000680)=[@in={0x2, 0x0, @rand_addr=0x40}]}, &(0x7f0000000180)=0x10) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000000)={r5, @in={{0x2, 0x0, @loopback}}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x80000000]}, &(0x7f0000000100)=0x100) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000400)={r5, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f00000004c0)=0x84) 15:24:30 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:31 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xe000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 998.766452][ T6271] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xff00000000000000) 15:24:31 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x17, &(0x7f0000000280)=0x2659, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xffffffff00000000) 15:24:31 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xf000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 999.027806][ T6390] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:31 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x54, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x1d}}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @loopback}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_to_hsr\x00'}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}]}, 0x54}}, 0x2000c840) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r5, &(0x7f0000000280)={0x13, 0x10, 0x10f, {0x0, r7}}, 0x18) write$RDMA_USER_CM_CMD_CONNECT(r4, &(0x7f0000000180)={0x6, 0x118, 0xfa00, {{0x100, 0x1, "c239b3bb5c2847d413bd0d69d99a9c8771434e813a40878b07d246d5178ad5f28e299125b352659dfeec5d16313dc6d1fb3f6051df64110536f68b8b05d85c93e7e7493be81066476cf9a46de7b3c70d07901c4b60bae24f009289b2fd74dbac0fbc22001e7ed9a7a564f17bc8a92f9541c33dfbfe648ab2b7947279db7f6d3f07cf8e43ada239af463bb3354c43820dbe951ebc1b6c3a7dabe81c205a3711e22c62430d20ff912e0b73c0348f7b93e49f452cd3277d2fbb3305925dcdd4fddc26d124d23885551994756e8c62a42e58c3674c64b0b9203fdc6ef2589fe2f5ea97a79fbd7f2027b211d66db13f0bac3c300cbf7531771aa946bfa1397a218a21", 0x3, 0x0, 0x2, 0x2b, 0x8, 0x2, 0x1, 0x1}, r7}}, 0x120) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) r9 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r8, r9, 0x0, 0x800000080004103) 15:24:31 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) getsockopt$TIPC_NODE_RECVQ_DEPTH(r1, 0x10f, 0x83, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:31 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x10000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0xfffffffffffff000) [ 999.397021][ T6519] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 999.614072][ T6611] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:32 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000f00)='/dev/sequencer\x00', 0x804020, 0x0) sendmsg$AUDIT_USER(r0, &(0x7f00000020c0)={&(0x7f0000000f40)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001040)={&(0x7f0000000f80)={0xa0, 0x3ed, 0x20, 0x70bd28, 0x25dfdbfc, "36624b749ad7837652631299313df4e3ce4311f655fd4aa344dee03827b791868f42cd9fcfcccb55cbcb216b477b316ddfe4b4849fdf2d552d607753ddf855034d14de3c32f07d80c1a91fb1566f6f7df2ec45627f8c668bc6173aa59af6ba23edbb7073dbb2683cd7a8ff61c6056c2f0737216b4124bb0bfd6ee5dc8f76c0f95b9cef7dda772d7f1ea4a6723721", ["", "", "", ""]}, 0xa0}, 0x1, 0x0, 0x0, 0x40004810}, 0x48000) prctl$PR_GET_FP_MODE(0x2e) r1 = socket$inet6(0xa, 0x2, 0x5) ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000200)=r3) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:32 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x2a0b0000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:34 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) open(&(0x7f0000000040)='./file1\x00', 0x693d03, 0x0) 15:24:34 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in=@empty, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000100)={0x9f0000, 0x8, 0x8e03, r2, 0x0, &(0x7f0000000080)={0x990a30, 0x1cb7, [], @value64=0x6}}) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000140)='tls\x00', 0x4) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) splice(r4, 0x0, r5, 0x0, 0x4ffe0, 0x0) ioctl$VIDIOC_QUERYSTD(r4, 0x8008563f, &(0x7f0000000040)) 15:24:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x2e0b0000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:34 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r1, 0x0, r3, 0x0, 0x4ffe0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000000)="29e2d6d452fd760dfccf5385d5e3df87", 0x10) getsockopt$rose(r1, 0x104, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r4, 0x400454da, &(0x7f0000000200)=r5) r6 = socket$inet6(0xa, 0x2, 0x0) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:34 executing program 2: setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f0000000180)=0x2004, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x1ff) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) write$snddsp(r4, &(0x7f0000000040)="5def437f88d352a4017473ec123bfc30b88ce3e7b4c25d820b7d2392f236bebeeb56", 0x22) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) sendfile(r5, r6, 0x0, 0x800000080004103) r7 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000200)=@assoc_value={0x0}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000000)={r8, @in={{0x2, 0x0, @loopback}}, [0x5, 0x10000000000000]}, &(0x7f0000000100)=0x100) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r6, 0x84, 0x23, &(0x7f0000000100)={r8, 0xeb80}, 0x8) 15:24:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x40000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)={&(0x7f0000000100)='./bus\x00'}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) accept4$rose(r0, &(0x7f0000000040)=@full={0xb, @dev, @rose, 0x0, [@netrom, @remote, @default, @rose, @remote, @null]}, &(0x7f0000000080)=0x40, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:24:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x60000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:34 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcsu\x00', 0xc000, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper^ib=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:24:34 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x65580000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 1002.240342][ T6754] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:37 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000080)=[@window={0x3, 0x9, 0x6}, @sack_perm], 0x2) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:37 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x6638c3a1, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6c6f726b6469723d2e2f66696c65312c75707065726469723d2e2f66696c6530f72a52c337bd8221e2ca4789cea64a0b84977fed3663190947cbb0d616a2546bc408b0d08b9e10734bd7d9060000000000000013686f318d5620ff0300004604053300"/113]) r0 = open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) sendmsg$TIPC_NL_MON_GET(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f0000000440)={0x110, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}, @TIPC_NLA_LINK={0xbc, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd812}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x108c9606}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4ab3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}]}]}, @TIPC_NLA_NODE={0x34, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x721d}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x4}, 0x8000) 15:24:37 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="f0000000100013070000000000000000fe8000000000000000000000000000aae00000020000001e00000000000a0000a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) fsetxattr(r7, &(0x7f0000000040)=@known='trusted.overlay.opaque\x00', &(0x7f0000000080)='lo*keyring-eth0ppp0\x00', 0x14, 0x3) splice(r5, 0x0, r6, 0x0, 0x4ffe0, 0x0) ioctl$PPPIOCDISCONN(r5, 0x7439) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:37 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='tmpfs\x00', 0x42001, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:24:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x81000000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:37 executing program 4: r0 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000440)=""/218, &(0x7f0000000100)=0xda) mknod$loop(&(0x7f00000003c0)='./bus\x00', 0xc000, 0x1) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x802, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="6c6f776572646901002e2f6275732c776f726b6469723d2e2f66696c65312c75707065726469723d2e2f66696c6530"]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:24:37 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x8, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_BEARER_NAMES(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x400, 0x70bd2b, 0x25dfdbfd, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x24000000) fcntl$setstatus(r0, 0x4, 0x80000000002c00) [ 1005.065934][ T6881] overlayfs: unrecognized mount option "lorkdir=./file1" or missing value [ 1005.090598][ T6957] overlayfs: unrecognized mount option "lorkdir=./file1" or missing value 15:24:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x88a8ffff, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:37 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f0000000100013070000000000000000fe8000000000000000000000000000aae000000200000000000000000000000000000000000000000a0000a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) r2 = accept(r1, 0x0, &(0x7f0000000040)) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r3, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x80000000002c00) 15:24:37 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x9effffff, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bs,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x4) [ 1005.328412][ T7038] overlayfs: unrecognized mount option "lowerdi" or missing value [ 1005.345910][ T7038] overlayfs: unrecognized mount option "lowerdi" or missing value [ 1005.493195][ T7105] overlayfs: failed to resolve './bs': -2 [ 1005.537917][ T7110] overlayfs: failed to resolve './bs': -2 15:24:40 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xa1c33866, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:40 executing program 4: prctl$PR_SET_MM(0x23, 0x4, &(0x7f0000ffd000/0x1000)=nil) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080)='batadv\x00') sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, r1, 0x300, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x7ff}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x40}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000000) 15:24:40 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x8, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x812300, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r1, 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000080)=0x5, 0x4) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) ioctl$VIDIOC_S_PRIORITY(r2, 0x40045644, 0x2) fcntl$setstatus(r0, 0x4, 0x80000000002c00) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$KVM_ASSIGN_SET_INTX_MASK(r4, 0x4040aea4, &(0x7f0000000040)={0x13, 0xfffffffd, 0x8, 0x0, 0x9}) getsockname$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @rose}, [@bcast, @default, @remote, @netrom, @null, @null, @default, @bcast]}, &(0x7f0000000180)=0x48) 15:24:40 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x4000, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000180)={r0, 0x5, 0x9, "eafaa3d2771f25e403664a867a63080080709e65ca45fb1c5ad98d909075a448c7aff0a7d105c46eac080e793cfc4c06f86731073f2fbcf1b8bfb8231b3d6a623f6aae39f4411fadd8f2d10fbd05c44fa45cf31a25b0bde4f4e3bfcce1fd2b1a1ba8666fc218940f19ea693f01cfd00dc489e070b305f269d950c0040beeb640dc40b5d5795ed884065cfe805b560d7a957ea20388c1cac52228df54d59acbfcad6c7f44c47086e64f1defa30e6d595e9ac0e31361232d5cd70bbf02caa1a5021a8f574dc311ccaa06dc9073c37f43dfcf9de7e70be1612c8efaf49918fce7a11ce71c47330f0ea05dbdbb4418b3395212d0448675d7ca2f8cc2fced88c5c13d9a76858b41539ad33776aadcb8cb7110dc6da7dc1d37d82d34ed1872df78409a420fc70966416ab3732512c1743b2eb74a57a14067fbb3a7c2c2673aadfc33462e576963cb7038d340585ec466a7d8e2ee1137ee5253138d1620bab2cc6e3c1a71a81286b203cb4ac369e4c84cd0752beee5a097e969fd6a74277ea5f154a538f98071546d3d5573ea5329b65f0de140b6bd82918e9a1365f2ab14a5bd967b04cd3c76b4086e5a79f62b622d5163934d64944ff56d1758058ec5401c1d705c9f8f6ad0a710cf963ddaaef4d3b826cbf0bd81e45297ff4d57828c0c65bca015d437c95d483fc3b9682e93d5cfb9b87a1d25b05849703705dae367d68524f617bae4ff0d176645579873f222d286f802966d7878faf140eaa00f8b5f03a351ec0d2a7201ee712e86009d804ae6d7e50461cb456d0d772dcc79eacfb4aab97e4eb4ccefb6569dab93b49b466e5bd9e2909b41fb7e0f4b58f50645e2e111af8d88c3dd92e4ae0d773817f361a73515d46ebd8b100dddccad1f262451f9753df1193ddbde8d719daed8a97282a0bba13d5b9ea02b87b0842a2e0e32a27644f4c97021aa65f777d3ae47eb58c3bad1aa82e52061c0569c64c5524f5db5f7442b7c7daef6cb04110e022672eff80542ebed7e212870da84ac0339708e9ab2ffc16f67a73173575db06f8353b4810d68bbc91bab52dacde50a0a88dc910ee7ab6984b4288aa4f41db9f61d54f7d20be4f37e54b17bc7136e3a94a12fa433f4ed732cfa1c26c5c63b0cbdeaf17d9fff2283e731bbaa115a0dcfd35a14fa911963e3be862148e88da01c85ce2a37a613cc5df3d0618411752c2d68db20779834f7209b1f2a12c787bf63e62b2d7defbf9adc209d6430846f01e5e6a56c040cd486ae566fb0cc5319741e3760934b36136db06ca863947c1ff56c50559b6cdabd4eb8d4848af50a8e5321bcfe6f669166dcecccac5f32e15449cbe63c5e0c12758740e79c56c87447089f301016b8417d4415a0a86c939662ed7b0b6c9a996e9df696912678a299c548c1017623c3b751120da3af1e64b405e5f8c4d576fec826cbfe37cee8e7c88fd55465837f07f43b380efcd219bcd99a623411fbac1938ef28554f1de31c4c6f233ed1d17cdd9806ad143e1cb89d0a175d3a59156d7e8a04bbc399bb6885085a99d0893b89a7d061d31b5edcabd2a131fdd8215fb1910d2c38c274aeb4609228dc7185014f139a6abaef22318da38ac178004d863ab8dcf362ebc92ec7d63273e0306ce642ed4ef2ab6bb2b83bf63a6090a2ebb04b62ffe0ccebff2075524ad3bda00005f0e1db3596304870c6857319daab17c3435148a31669748f89f1179062c103fd2fc0b3488b5baea52867d55113b5bf563468b2b6bb352edd834b2108ff9b54b5de1d3a2a3f34f22fc7a3294a4973f00fa9c639fc45dc7dc459845c2bd89440af2d39b99ad14de45730a93e64f49ba6b4e034ff3867b58cabc9e4c1eba8645a83eba41e7ada15d3714654f6d01b27784160178f98c81c7ce54d2cf468c7cdbeacc9ee8bf2c085df440e4352ee64a45966cd978e7bca57d0866650c7beeaf3f57657839cf11fb71626297c7401627012b4a5830887dee6ea3e585269c5cd36eb3e04d9b7ff764a1c85d9d9303f43b38b80e1d407b2d66af2d4012383db7d167015e7f276cb3ebfbc60a586c77600257c207c8915d256315072838d0d327cc1d744403310e2803707d9bf0e601876486670013c943af6e2ca5f717b804a6f4b1653a16b7b1f6727de9172006a16744ff1ef21b9da88e213b97c24d1327d6b05715f763b2d16e81188dcf73bd8a5f6bed09fbc40af40dab9e93b1fa4f0470424abbd6d22b2434d075ef83f5f46ae67b4d0f51d5a4115116c3c4c13df193f921d9d9c051768a1a56bcb9a4a0131da618ba234ab911557f1f753c72cd7d32742c927d86dc1d3c78ac62ae9433fea29f2fcefa2909072c4476fd5fa4376ec984033428e913d8ab59c1c03a3dc6369c700264b58bc8edd73c21006850ae133ca10ccef1528b235dacd34469ea7a35480b39f7621a6f41eae8eb36d71c138aea4e78626cc3416f4d0c27863dd160d4e8633c94811fc1d2673cd4966cfaff1824149e22fa95d502f40a5a99a0555acdc11ec5afb62b6a04c470b674854e3bcd328b77555e2d1fdee71b92b847f0297ea0d2983c9b5b1bfde43805ca112cd0ecc3a67fabb00606f883a9c895e12a2f5f504fdc47ae0251fd86d797ce5e1436068464abb6aaf125885804a049b03ef3d2962b2822d47623e14ad7d2230251ea62d096ea23bd06e652be7a4d54e83706a3cc7c3e97e080d6dfa3a7d1671f3cd042b938e4d7fdb46af0b4dda1be11b4e394608bfb875a2a521d552d1180250cfd0cb3094bfd3144748819df8a15414c95dd0976e6a32bcacb72d00329dbaadee6e623f74a915cda543e63e66a5da97ee353a1115fa3bcc4f3c9ed2b7acb7bb2f80d31cbc1e084cebb41c9dbdeacf3fa8e031c5f4d563117e640205aa987d9c28d88859285c70e3542c6c8b07c7c7eedaab33d44d3396d26be7cf44a2099e070d0fca67ce00c70ae8c1a15e7b873660212e274283cd6abd3cf4a97e1d66e8d08d2340654f14171c4ba03f4094580d57e1ae76dc963cab8c69ede068940380c0d522bb956823e2a4829055fcbf06fe2861f74c24c83e41f7101da605a08e106e2761b240ec6ea6eb2abfb14742db0fb05314b392485f429d3588c41cb91767f4fb6878d9255d557aba0ec37abe9db24c5201ab2dbc37f37ea55c9f72954c6980eb9c8512619642a07e807eb8c65c87feedd997553b634ca55e17082ead3ba01d0ddacd7a445789cd09d9f13aefba50931e9847d3420777c5dbc927dfadc370d921dbab4191e4ea8bc3b43fd039f136243f7d583cf89e7d16d873dbfb3e7538892689501b5a7400cae95fb792bd06e6b4155c96fd311612c4270e346fa8e157e552a36f7125b377c70d6b354f27b86c3d7c69352cc04b76cebd98e84aa7ddacf114b5d62d52eb1e7d89575e9a9319838357c02fe41832d9936361d3d5596119cc362d32b31e843ea1679858428effa0b3641d65af05664fcb0b032c2ac427bc5310bb5afe4eb20f55f5bb090e21551b573225cb2a5c53a4b8b9cebb419deec2d1f3800b19cff70762e4d1444448e4cfdaeb276348fbdf9e4f0d78bbfccf38505402186d26a2bb3e93546965e2498f57ee5754e28c33b9f92feedf2cc352f20b2064eac9dc92151bbe0e5c67208101d83937f1731aabc4a09742f1b4716ef49e2593a1bccde60d6c225abeb141a1190c26bf609a65159541500687326e3f74c11634e878521c3963fd7944abf25a7720ffc68368644688c4f52c0f70dfe8a554951605c25d88302ecafa2a23ef116fcb869c47892461e9bd8964599c00a3322190932227fee4e03cc15505c04e5d8fc23afb5e6fb68188417a96111675a877cf2dd6a483b4c31c829a6c4a43c182d17f9e018798f03afa3e7842d5239e12a115f079edba344e3ff827480eca7b489c1623c93fa4d35710ef177f8ad6e4d25952f73b9d684fb7a2cac80fbec0fdd7dee9a469b5aab585e558741b19861ffab0845257d02e08ea8833b33db25aea60053e5e210f1785138694c11badcffc6cea82c4d5bc04d5b0ee651f18c1a97bcef5f28bfe2bf7f73032b3ca3a62ec5f7d41361a018cdbdfbc9f624b29f8c221298f08e0af7cbcba5a93ff3ec6a12358b6ca5142db71c5fa48311487a96ce0aad01eca94126f41bafc0647063dd62561644af8f210ec62e39961b3a6e91beb59078ae636ed29205815f6a464cf89746830b47514de6bcf9569f8504ee6cb613e2e15b44c970bd143ff39eb40335494eb9f2ec29354d8b4ebdc5877c7cfa070b7b895256db0a9d2d36627d25c881ce324dc61684d50fbf3c25796b256b0d8cc65e4730cb715a04c6db6066ed5cb3ce984259432fa60c3b4f967943b4d2f2528a7751507b67722fa8a5c8e40ec81f9f4f7d922d632de2c28e67d1be978925ff218e03cc56dec3905ffb44f3e7397d3bd78b41f49f5a36c5199b36fc50834a04536eed4308d6ee3190e99b5ce512a56bb141334af6dcb78584fd075510d9b2dc1a45a8f0388344f8c70bee9c856785edd4e9e6e435d36cf3c27c86829a1c5ef18c67a7171b852aa517879dab1ba2e1b8a2acec8a11b1f657c3c9279f41da87b7ccee051b33b9846cf161e2ded7d5e57aa49e482aaca515a6959742e04e56a5644a65a6ab55fdbddfd15d49ae1dc206ba113e9d926b88fd7a8b7b3a3e82761486b41b39f9c64abc0b1744b98104868c64e75ddb4a1e35c9855108a39a1da200ffd6c55a5333481f8b4eef3a60c7d2353c33b498a0581a4325649ca54b688fb4c753c94ef469f7282ff80f76c3368036944c4713334000b5489bca27f184d3157d194579dc3b2aa4e21d77f0be4e021babf3fe77226875d9deb0396cc690c0485401b1a5293d17ce3fe6cd665376dbb6a2a2e8fdd53d94538243c5e2308e01721d9ac4391fa42892dc76c597b326304b24f9508b18b72442d890d17dc25dbb2f03db3b9d7a95097db20d6d091b8babeccd4339931938fad5d41184732b597e93e017b67ae17bd3a93156560bb3442bc8fb8a8f1535cc54b3dc196778740cbf80bc5a89ecf0f13e1b030bdad5807b8b1d6b19bf529b37acf7b561b6c9ce7f613c9057c8a920138ef2ddc554a7579d42fb4fa9c9a1838870c36e390466b6ddc1e930a7bd06ef8b62a7605bd709cb03ea4df70529efd3d979b65455716a9c3e340cfcf28387eeb4aa158c23fc21055e4891bdbf628899724765e47896bbb5814064a613555ef299da958274792d7b9eb05f87d193ef08571fda5ca7c88bfdec9cdad830a6a544a3f124a37d98c9d96a0b4d49a8dcc8d869eaedac77adc1e83660349e83e69383ffa555e3c22c3e62d50316d0551e8694475c9f02af14c229e53e880712fc29cbac7de39ceff0210882ef6c78ca0eaab0c4d8c76baddcd895dfa31d4563219620baf709db63a7129426fe6823594713feb2e785decc237a176b0342ea591eca9644cc19f9274495a1a454dbe12e9ff355d5392588750834e5be32a735a550750771364094cb82b28478e48c0a6f355f726888dd22eb96059c412870f2024f13a61e9584dd991ef27f22baa8e44acddd96248e2f6684d7963eb75f38787319b5bbd191c2b4d3b2f78387b67c985aabf5a70ced000a1f19c4860b5387a3511098490f7f4fd26c1e8bb27e1321172f53e9f5556949c07d958a4eac8f78569f12b904031ecd0b14785c0ffa521c388d0b190bf9c974162d2ef2df232d572891fa47b3ac158c75c0056838f59be12ae000c1575ffff03762d230bf0a04fcf74cf31e4ed957b53e2135900ec61ac81695ee4a5d550dd"}) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:24:40 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x121442, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xc3ffffff, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:40 executing program 5: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x121000, 0x0) ioctl$EVIOCGABS0(r0, 0x80184540, &(0x7f0000000080)=""/65) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r1, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x80000000002c00) 15:24:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xf0ffffff, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xfcffffff, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:40 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x1b0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000440), 0x12f7e5) clone(0x2000000002000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = syz_open_dev$vcsu(&(0x7f0000000040)='/dev/vcsu#\x00', 0x400, 0x80800) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x14, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r2, 0x0, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) ioctl$EVIOCGNAME(r3, 0x80404506, &(0x7f00000000c0)=""/145) fcntl$setstatus(r3, 0x4, 0x80000000002c00) 15:24:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xfeffffff, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:43 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xffffa888, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:43 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x143}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:43 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r4 = fspick(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r4, 0x5, &(0x7f00000000c0)='tmpfs\x00', 0x0, r0) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r5, r6, 0x0, 0x800000080004103) 15:24:43 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x143}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xfffff000, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:43 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x143}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xffffff7f, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:43 executing program 5 (fault-call:5 fault-nth:0): timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:24:43 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x0, 0x204) 15:24:43 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xffffff9e, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:44 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xffffffc3, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:46 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:46 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000680)=[@in={0x2, 0x0, @rand_addr=0x40}]}, &(0x7f0000000180)=0x10) r7 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r6, 0x84, 0x6d, &(0x7f0000000000)={r8, @in={{0x2, 0x0, @loopback}}}, &(0x7f0000000100)=0x59) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000180)={r8, @in={{0x2, 0x4e20, @loopback}}, 0xd5, 0x4, 0x7, 0xfffffff8, 0x0, 0x6, 0x9}, &(0x7f00000000c0)=0x9c) getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000240)={0x0, 0x6, 0x10001, 0x1000, 0x1000, 0x3ff, 0x81, 0x7, {r9, @in={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x80000001, 0xfffffff0, 0x6, 0x1000, 0xffffffff}}, &(0x7f0000000100)=0xb0) sendfile(r4, r5, 0x0, 0x800000080004103) 15:24:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xfffffff0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:46 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x8, 0x204) 15:24:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xfffffffc, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:46 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xe, 0x204) 15:24:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) splice(r2, 0x0, r3, 0x0, 0x4ffe0, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r2, 0xc010640b, &(0x7f0000000040)={0x0, 0x0, 0x364}) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000080)={0x0, r4}) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:24:46 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x64, 0x204) 15:24:46 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xfffffffe, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r3 = getuid() syz_mount_image$afs(&(0x7f0000000140)='afs\x00', &(0x7f0000000180)='./bus/file1\x00', 0x3, 0x2, &(0x7f0000000200)=[{&(0x7f0000000280)="fa20d7fe6bb5985e3ae97575ead45ba1217cf4221ef9dd03dd7fce3680bc7749bd3a11a8bbc7c5547688dca9a183ccdf6de9b4ce4b96317920aefd3d504260df32985f3fcab91ff92333bb419a7e95316f7ee4afa32550e6ebc2b4ea4e47718ee52819c282c514b3b73c993d5e474ad97c07182dc751012df5f33a458f8943", 0x7f, 0x80}, {&(0x7f0000000540)="c2a1c50651708ac5c18ca0cafce90a061818b436e5f38090e634791b5f1dfa185fd298d9446c2fd199e980d4f863ee19f0b59eaa85b5924e6294782c62949d574892f1965b1a380902da178ed75274f48124008f99464c4019de50f854cde12a5a11a1443289311cc8ba40f13b49c652f5f02d177c1f7a8bcf3a943276c4d96a36356f5de5c6ce25ca24fc6827ae6447784bdeeb51d336bb547e039d450acdfe43ca12d1aee6cc0d57c6e96b2013cf4724cf4fbb00be2ad5ab169a2726f23c5f63f1c002e5639747613e09cd47fdd503e7c3db5a95f87eda9f0f3234cd5b853908bc62e580d3fda50a0007f697878cdac006fe940b1d49bc06102c9dc6c56b5ac65ec5ecd2b901d74e85606811ab6ed639816e42bccb2199be19f67fb88fe5783c485a66799334f8b736e038713272d1e1ba6953b35245f72def6191bab127e2381a94b64c2af5dca74489c4cdf669e221e9d9c77cc8cb856d4b495fb06a2d71c16781ec70afd51bdd94bf07468f208e8bc03a890fe99eb0cdba47640580d7178c97aa1d25a9da915972b1195e2753a2418b023ffcdaa9a1d95a4b70c1a3fafdca1baa97ac2053034e975cc33a37328cd40f4be12cbf0a644c726acbd6fb9ad6f07752bc6477ee99b659da46c8c06967c4dcf31d9570e39267393d7483df5b0fed5d39c62ef19a9f569432512eab5e62b8d7f2e3a1f81dbae01ba9c2be5ddc02629dafa017d7fdb6a5bbde7833f83f8c09c49c152f33993470aec42b2231a59209f5c208c051fc9117a3c899a40976d13bf033a9aeeb221920d0f962fe86e52a0e7af8c89afe2bc1ff451d28e3bbde1cd67260243f8fb78d133c276c37e2f62b83e6ef2b38078d8d120e154649ba70468a759e67e0f13fbb4f56b01f2540a77f6124997ff63ebb379a4e8f40c8f499c8cc2b4130d3b8f73d25d19e13adfb7f9c3432225d5a35e4ac7bf0e823c336977b22cbab44ddf9616de29e90b0911c628c9d76547d6b5edbd21e8d63a6149d4e8fc61e8ecedbde03bed34a8c510ba12aa09c343ad8e46495adb664a26422e726d45acb498a9964acee1e5931775bfba9a22dcba8a1c96d067581ca87c9d68da501d2b258af5f42aca8cd40e2056a6f58a27dc9c68179c77afb72797c0c28f8358d55e54f57013e2c9ca049d796f52a427e8d9dd5b47dab902c1a27c790ea8a60a6300d0e03e5e4ba32d22be3e4ee4f15a57b9b5f32de4067061274a53918a5b82fadf129acf659a04ca7088dced52f33ac8fe4dc18fa14e9f6f2308f225197128839ca774dd13c36e827fbdf49f2efd7d1e261e18e5ac9949f81af966c0917dea0850efa9f2626bb52f7c450998df1a759e3a4b71bf3b3143e01a1a6d640b1aaed4dd8ff6467090ea88d66f16926ecb4db27703cb478b6705c308463eb795f436b2b9e7437b38d056e0802d463081ce5f1ef0562f5abed67fa867b1d6caf8e877db279acd560d4d152e7ec965ec570639678246ebd274edb6202a787aac5d3d71d7f71e75cf25d59e134b0eeffec840822eb8fac7d489cde8231d29b0541548dfb56808177ad9b667148c4ea85eec78dc343e0ad26dbe29b60eeb1a316dc2ddb1e6917b18e657875d8b4d7a0c86abd37c2246ffae9fdf3eab7ef6fa232d74c016f9dc28e8b031c2e0ac7eb938da837c120033293124bfdfd352e4424c305d10cad444386211e1257a7dba91ccd4eff436187743932a6b3b3cd600d0a9954fe3731cf810b970d336e6495b2c1cb17e7310b12e658f6a32341a8f61ca7ba5dc0b5810769a1106c70f3952ecf9811e6f8fb789e4efcce6c983a805ef025979aa09807bc9b4940ee0d5a4a99162cae88111b25f307f717333ba6f0e04a92abfb140029b407f2499b2a0cafad8ef9934cef737451b94acbc0870b1045d61510e7135963ee341a45e1f58afddc624af700ebf7bbc6fe214be4b310e73bd08dc01294c95f759b900d68888b68a1d0b70d8635d058e830982b55e073e75131e3c9c0a04b8da873c6fc282a908b01c606975d1acb8e0d73760b36944948328e7c7e1709ddf22d123579f60630d061122813121b768749a375646286186a1c81e23472072ff052b021308c47005ad5eedbe0c988aac616ac9905abf72a619424d4136229706ad689342a32d90c69a4d66699a9349197e2e8f7fbd9010f7445c43ba228c498808799ed22f427ea3245ae89b38841fa7bab74b73df3024b5cec3fed6c5f32ff68fef36b5e2141e43357d1b4b998b0ef279af1bc6bff0b873c33117972f2905b9f13c5f0fe59c6f613121a3a1d2dcd0449685029c53349f01078f9cef9858868a93473d4811fb606f8d4d22e5331762a4283e358b75b44ea8d10287b7ce15e524fcacf8c8b88afc1a8983f30d04ec8c2361c54f00f9806acc15e9dcc48ecea16210e8eea24a69d05910c1c136b45a5cc20d2db38115c91671e8204280541ed39df9ffa31dbdcd75ecc41bc494df2aac9535f4d991f2377feefca7821b32ccaf74889a4379d22d901f24c27b27d4a244a739c6a9b7f27300f3baec99a6b6ab6e1d6da680a160d30a9eb1d61928aa16b261ff5c1cb94d6a8f54b3f5048deb1c073c9fdb70bc4706267e10fad0b0454903e114f56ea0e8263eadb50fe8b11794d31f6903b0129dbf3a1b60ccc22606aee09faed0f935d969347550338b2d4bec5d5c1e4b29118d38e938927a4a8570ba1ad5cb12b8a07bdc6a7e643677d2a6731a0df49762df4e267f3981c09bbc76c55d2a309149b4d1293bf077fad5018e3a72bb06a369ad20522038923a994cd33e3a5dc2030dacfd7b78541619add26ff0f0442bc63e9a199e7f908ef3912af3b1146220f382687bb50bfb0fd258509ed3d3772c72649c149b30300b6d1107ecdf75904bb00b06e316b223380c9a6ca8628167886d2e392865801704dd7dcac87e03e2b7950cd6c9c259bc56cff960591d15c79d016f157dbd602cb391b3012665c87897597bdb7bc9bc3fb06e3c06e2ec4fb159a84801ce88ecc8eb2b79835450be414df8837da2aeb67e77b476e4a25036f9093db32888581c68c048deb3b16b84180359bf0841b1eea7fc91411088a0a0aab501d8aab49a2fafeb8f72015da56593ad006e22d006aa427a9967bae58c7f5e669f913f41309a6d221bacb7de5e8f0940194fccd1cf5337c82f2a21a559c8dda4ff4b1f986deaf591390ed0f9c2a518826151a44e5837409306ab5f40e8d6110f29cc3ae377cf957f02ef5d4d2af7453c6b836e2c8f574619d8319fc69e3186893a524570b37fd2f509434ec6f5348e954bee33f23ed77837576dd1d9ac0c0dd26ab2baa43faf2dc82b54d88af5b24bbc6693614cedac6cd435ace5ddc5da4102ead34df91bd8d1023b8610b927838987f3604a84cf7c97a574c2302ec27e2bf7de99e450bd3d685480dd110b64c2365515e6f08307acc06dc4d6b9dfb8a823f38416061e68200f92dd4186598c91b5a023a2b0d0f337e4afc44089a620c4dea76d12fbe20a120b0f3cbf7e69c61c2e3f6fd57a9885a5faa0bd38f8943baa9d54792adcf5baf7f5a202b49adbb02f83e05dafb6fbf2dc5f2c091ba55413c099bff5309fdacd91c9112ec32214ae1316a258de9d641f78379044047d87bfd60df8a608a3b04cc7e980a32504cdf0ec038986d75fc0e91785fc92ebb33fb7496054c3d607c261df566bc8826182fe0e3cf154c32e7fb02aaf00208bf3ac6e7cdece2102b7fc8d1da7d9f53d99c5436625f11de1b654bb4f10ed9c982e733a8f1be6b63c98a014d68175134f8aae32a525b104a563a6ba6994285de1263e112c5f37b43b64adf334506210d5fd2f98213f8d6f5f81cfcaa7d06dded42472a94deb6de8256149bdbc23002947a4ea647202c72adac59a988899bf861161de90cf155be2885dc2a4ee76337f70ea542843bde713717c8ee462f486e3233d4b8c5ae495b90864512ba2b7deae1a695ab9a77daa1e18109675000c5278e9a8ae940c79b643881fcdfe8c9a533cfbd2dc06c916273862ea7313848018bad4ca5e86ce8102d4a66fbdbbeea8cefb73d585d4dfcbc1a678145009b2726d0717d34a590f1d56cd8fa6a64f4599a1ff7dc91ea3a3a94a418f2f3753d337800b84f42806d9ef5053536279d49e342a30db5f23b7c91457d4fa2ec7878d0de8d2f51926ba40778063cf599345e831bf8d267c1bf06ce8b5db1588424a5018860f06a3c309e9342a50ad58ada89baa1bf3ef9d4bf632d5eede22ba30c65561a7c2597667588079d1610f3b82d7f0dd1a8ca71cd690c7143b42d31b556f755c3b1a3940a30c5c37320d198fe4aee405c1c8798cc9dd420b083879d9578900528c2f27c09a1f984eeabd09fa1ab8701f3901f7437ebab23bd98bbe209563e92d578c35901e76a42d9f421558957b092692dd55b07a8e1abeeeb28b92628a0b1ab1da90c7e9567e8fb0f23642d1f1c2d3a120393c815d7fb176355ae3c61e86d5edb66d0578f4a19c5f42f54f7bff3d63eab50052f5041a636627a3244b815a8ad705e41b166d281de82ddcbc90a6dde8d66b34780734e731dc43923f09cdf4e8523b80c2da98df2b09c88312056ff23a0dc398dbf7292fda521c170213ecb98936b41262c7db12298c1b66c2cf1747da84e75cf7b90c8e417e86c4a5e5fc6c292b0bb2d53e02e00ed866a7810e99cfd76d111758d8d44be9a6919ed95a8c8f51e4a5fcec2607b8afe33da9c39713bc007bd3c412350c126f69c582a482a3423f955a73c5d43dd01e1e61e980d583ea2cacc87699c862349b3100ce944d086f8019b60a913cd572a077e716dcbe1541d9b8dc33eb8180c418adc912dcc7e1fe255c8ac8e7d08dd726050e4518e242a8da12d999391c421ac8d4b23d6853008f561ebf7f6ed9c3952d380c9760d03a2a29865adb69efe638e9c450423cc653193afffe4e8ed116524dff5bfa387e4f67a6e7d0049f767e42196c88f7ca65e8a7823592c7c0e2d108703da57e80d6b210d3ba0213462a90ff6a0e764a3e4a4c2520ad7a0083a1f9841ea54dd067fbce2e1bb64187ded59aeba5d9fdfef9cb6ea255e673c4da52c218664a43fa3c81f6269b45c44348e268dda78e05e7ea89fc7553d2c55a2b6ac585f3d078f1057c83706cbc4c674a56ab420b60f17d4ef05ad01536d6091996149976984a90a333311e31589332c46e7ee07ae8f1c07e65ce67de08e09cce0b29dfaed5b7c33d9537f1373743ce479292b9a0a1c32eea8cdb7ff0664879a7bfb06faa1aea1ad2d35c371223747ff9fcf48283dfc3af09eadb44ebf42712c4b06e75e9ec0a93242e9926ba6b292acfdc50d7c8735a4fb046f525455d44d57d94181a916c51c863c9a34c823745e5ccd4fd447ea7e0d9ca02313cf7e99e1d29a342bed797db32ead52834fb9be1e217b8993b5062377cda25f0b6805737145267a4b5e56e6d0ff469cd98a0197f5fbc03829c6a8251560e193b7f6d4f68371b23f49269c2f4d8b6f1d1c6fa4b2fbd0337f907048a951ed6f1e8bcab786f11955d36ba1a7208727bd8b0224d364e3ee1fdd20e40182723eb2fb282f2e7458f68cc272ec3a882b5578221ced3a1ccf2d1da1d894964586c45d0d7779681ab19a27572b0d8128b44047e66f81cc8dcd23209e45b90aad97e67db42ec40c83e05bcdf6f94fa7ae6a05d1f3cb50db83802a455847713b2fed75b062cce834524110b4da376dcc6c8733202ffdf481ee68df1cfaee0ef4399ca2b6449096b41b6b4cf806a1a8c7b4f41a9f43c5ab342c5080d1fdc2c733", 0x1000, 0x200}], 0x1080000, &(0x7f0000001540)={[{@flock_local='flock=local'}, {@flock_strict='flock=strict'}, {@flock_openafs='flock=openafs'}, {@flock_local='flock=local'}, {@dyn='dyn'}, {@flock_local='flock=local'}], [{@func={'func', 0x3d, 'MMAP_CHECK'}}, {@fsuuid={'fsuuid', 0x3d, {[0x30, 0x64, 0x31, 0x61, 0x36, 0x32, 0x66, 0x61], 0x2d, [0x61, 0x61, 0x30, 0x32], 0x2d, [0x34, 0x61, 0x63, 0x36], 0x2d, [0x64, 0x66, 0x36, 0x35], 0x2d, [0x64, 0x64, 0x35, 0x64, 0x35, 0x66, 0x34, 0x65]}}}, {@euid_lt={'euid<', r3}}, {@dont_hash='dont_hash'}, {@pcr={'pcr', 0x3d, 0x22}}]}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r4, 0x0) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, r6, 0x0) getgroups(0x3, &(0x7f0000000100)=[0xee00, r6, 0xee01]) mount$fuseblk(&(0x7f0000000040)='/dev/loop0\x00', &(0x7f0000000080)='./bus\x00', &(0x7f00000000c0)='fuseblk\x00', 0x30000c0, &(0x7f0000000440)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id', 0x3d, r7}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xc00}}, {@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x7}}, {@default_permissions='default_permissions'}], [{@fsmagic={'fsmagic', 0x3d, 0x6}}]}}) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:24:46 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x3f4, 0x204) [ 1014.692919][ T7812] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:47 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0xffffffff, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 1015.079386][ T8027] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 1015.085435][ T8027] fuseblk: Bad value for 'group_id' 15:24:49 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:49 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xe00, 0x204) 15:24:49 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) listxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/205, 0xcd) 15:24:49 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r4) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x4240a2a0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='fuse\x00', 0x0, &(0x7f0000000180)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x5000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1400}}, {@max_read={'max_read', 0x3d, 0x4}}, {@allow_other='allow_other'}], [{@audit='audit'}, {@context={'context', 0x3d, 'user_u'}}, {@subj_type={'subj_type', 0x3d, 'tmpfs\x00'}}, {@obj_type={'obj_type', 0x3d, 'mountinfo\x00'}}, {@seclabel='seclabel'}]}}) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) splice(r7, 0x0, r8, 0x0, 0x4ffe0, 0x0) ioctl$VIDIOC_QBUF(r7, 0xc058560f, &(0x7f0000000280)={0x3, 0xa, 0x4, 0x10, 0x101, {0x0, 0x7530}, {0x2, 0x0, 0xff, 0xc1, 0x6, 0x9, "e0026902"}, 0x0, 0x2, @fd, 0x8, 0x0, 0xffffffffffffffff}) getsockopt$inet6_mtu(r9, 0x29, 0x17, &(0x7f0000000300), &(0x7f0000000340)=0x4) r10 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r6, r10, 0x0, 0x800000080004103) 15:24:49 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x2, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 1017.409236][ T8130] fuse: Invalid rootmode 15:24:49 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x50c3, 0x204) 15:24:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0x10, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) clock_settime(0x0, &(0x7f0000000040)={0x0, 0x989680}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:24:49 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x3, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 1017.454758][ T8145] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:49 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x6400, 0x204) 15:24:49 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x4, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) lsetxattr$trusted_overlay_opaque(&(0x7f0000000040)='./file1\x00', &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 1017.768572][ T8255] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 1018.001690][ T8363] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 1018.143035][ T8369] fuse: Invalid rootmode 15:24:52 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:52 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x6, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:52 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xc350, 0x204) 15:24:52 executing program 4: mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6c6f7765726469723d2e2f6275732c776f726b6469723d2e2f66696c65312c75707065726469723d0e2f66696c6530455b11d472b4ec92237dbd503455a174946e5e210c51e52a4f08"]) creat(&(0x7f0000000080)='./file1\x00', 0x180) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x1000}) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:24:52 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000500)=ANY=[@ANYBLOB="f000000af7a3860f6eb2ff000000000000000000aae0000002413a00000000000000000000000000000000000a0000a000000000aec20600000000000000b4e556730fccc4caa7e1c77a0e57a3fa8ce66c46350c6307c0da531dfd1032bd17bfe7204c891655a38b7eaba65e5f40d9ffbf9752cac0407cb1500154e86cd9763ea692908dbedd8f444e5b94a8ed72019b6f", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) ioctl$VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000100)={0x1, 0x0, 0x4, 0x8, 0x5, {r6, r7/1000+30000}, {0x3, 0x0, 0x81, 0x1f, 0x20, 0x6, "310beec9"}, 0x9, 0x3, @fd=r5, 0x9, 0x0, r8}) read$alg(r9, &(0x7f0000000300)=""/184, 0xb8) r10 = socket$inet_udp(0x2, 0x2, 0x0) close(r10) splice(r5, 0x0, r10, 0x0, 0x4ffe0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000000)={0x4b7, 0x0, 0x10001, 0xffffffffffffabec}) ioctl$DRM_IOCTL_AGP_FREE(r4, 0x40206435, &(0x7f0000000040)={0x400, r11, 0x10001, 0x6460}) 15:24:52 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x80) r2 = socket(0x2, 0x2, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) splice(r3, 0x0, r4, 0x0, 0x4ffe0, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvram\x00', 0x0, 0x0) ioctl$VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f00000000c0)={0x8, 0xc, 0x4, 0x4, 0x2, {0x0, 0x2710}, {0x7, 0x8, 0x4, 0x4, 0x5a, 0xa7, "77d2cae1"}, 0x0, 0x3, @userptr=0xcd, 0x9, 0x0, r5}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r6) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r7, r8, 0x0, 0x800000080004103) 15:24:52 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x9, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 1020.440448][ T8375] overlayfs: failed to resolve '/file0E[Ôr´ì’#}½P4U¡t”n^! Qå*O': -2 15:24:52 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xf403, 0x204) 15:24:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0xb) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000040)='./file1\x00', 0x100) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x22081, &(0x7f0000000300)=ANY=[]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) splice(r0, 0x0, r1, 0x0, 0x4ffe0, 0x0) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000180)={&(0x7f00000000c0)="24b89020e0aa6edb5c2946187dc41a54cbb3e84566ba12a348828202351a653ef3ba38a46d923a016d4ae8a6e33bf9746f214e54a7594d251da939e8dc5ce1d072c867563711bdd30f63dab22464652724bf1022a8822b46d796d63330701edde5bd738874a89be7c721abcdb01ca19db13e9f36a25d913090811d3a", &(0x7f0000000140)=""/31, &(0x7f0000000400)="1639c7e4405e88da4767ccb3bb7ac85d5962096bb1ff90103932db2d9b72143f8c3dfde4e2b34d06e49b65c9d55666a4b821a82002d8b66c11b7ebd082dc5023bfacb8f7a4eee0e020733320b5d6de6848e9258829418d0e2987caf35af28ab14a79a848d681f62eed8a78cf4ff51a33c6a03a84e0106275b2b2f1c1fa988386ab308cb730fbaf5c9c9b6b3f75", &(0x7f00000004c0)="566e797ce10e41a11111cd4366e5cf9350b49ee842861a41b5cb2896617bb6f3a217cc4b902fb2d3c1a28d34c4bf5341be01312ed849c747bda053ed737f3d12b3fdf5f10a442d03c7ac815aef358e76abf6cdcf68b3402b1e439635a1d9f2450182831822f77fb5ea420a38bafd6c9ccac2eb059455118291b880ad0bf2962763c0becb68336bdf8af1f9a34008273b4151a38ce83ea72ddb4fef0cbefab8c9551b6e598eb6f9a89a53f987d6263c90f4c13838dbd320201b88e4ed4222b13ff944797809786094cdb297b0de060a330abd893e282d548f58dff57b75ec66b650e169de21df59eb12c15fc4be3ca0e23fa291c95e62", 0xe0000000, r0}, 0x38) [ 1020.508922][ T8487] overlayfs: failed to resolve '/file0E[Ôr´ì’#}½P4U¡t”n^! Qå*O': -2 15:24:52 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xa, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:52 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x8000000, 0x204) 15:24:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6c6f776dfc8e3dd2f3aec765726469723d2e2f6275732c776f726b6469723d2e2c75707065726469723d2e2f66696c6530000000000000"]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 1020.959271][ T8688] overlayfs: unrecognized mount option "lowmüŽ=Òó®Çerdir=./bus" or missing value [ 1020.969959][ T8708] overlayfs: unrecognized mount option "lowmüŽ=Òó®Çerdir=./bus" or missing value 15:24:55 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:55 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xc, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:55 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xe000000, 0x204) 15:24:55 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.+file1,ur=.\x00'/47]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:24:55 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000080)=r2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="f0000000100013070000000000000000fe8000000000000000000000000000aae000000200000000000000000000000000000000000000000a0000a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="f0000000000000000000ffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fd00000000000000000000000000000000000000000000000000000000220000000000000000000000000000000000000000000a0000000000000000000000b39610d8d63e5bb6e44135fda476e4ee5789d22437620cc65d78b9c6ff57d28da32d9c5db7908d4592809a0a9266a2a63e379678c4fe0ab3f725dbbbe131f4b283eca0697d8ed0d38302b2d23775e542aad4039b8e037653734cb7d063a4b399287abe79a8d6add75a97991c847c17819152a2fb2a5cfc52acb314ea49d3bcfccd4930a1927353c7b0a54c3bd03630b3cccbee616d456621714ba23ad98406769b555a2ce0ab7357b5255576bc4011eb730df92113d11b8cf9f4b77a52d95ef4d3c0214b16e3ed"], 0xf0}}, 0x0) ftruncate(r3, 0x2) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) splice(r6, 0x0, r8, 0x0, 0x4ffe0, 0x0) ioctl$VIDIOC_EXPBUF(r7, 0xc0405610, &(0x7f0000000040)={0x6, 0xfffffc01, 0x7, 0x80800, r6}) connect$packet(r6, &(0x7f0000000000)={0x11, 0x3, 0x0, 0x1, 0x3, 0x6, @broadcast}, 0x14) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:55 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8982, &(0x7f0000000040)={0x7, 'batadv_slave_1\x00', {0x2}, 0x1ff}) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, r4, 0x0) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) setregid(0x0, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r6, &(0x7f0000000140)=ANY=[], 0x4240a2a0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r6, 0x84, 0x15, &(0x7f00000000c0)={0x7f}, 0x1) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r7, r8, 0x0, 0x800000080004103) 15:24:55 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xe, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:55 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x50c30000, 0x204) [ 1023.534355][ T8721] overlayfs: unrecognized mount option "ur=." or missing value [ 1023.555996][ T8797] overlayfs: unrecognized mount option "ur=." or missing value 15:24:55 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvram\x00', 0x3970c0, 0x0) name_to_handle_at(r0, &(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)={0xcf, 0x8, "c82b6fdfd7722947d2f2d64ed4d60e9fed0190ea5fd026062ce3b5d6b8181332f94946d869c29c0479f308672d95cd370e31d6e448a500ed2594dd7c218c17d7e1cf7c2879f308baf645fc48ea868002c0c9d7d55282baadc00303b4229fdb5399e4ef37e5db3847eda07e2468187a03671b6f9c7064859b5158b3381d8bf0f0997da2c748fe29870f3c0430e488b0854b73fb5df5dbafbcdc5365952df3285b36c178b79b53cab97dce00bae17a5f515615d23b0e739a7b0efd5ebcb252aebfb1520bbbba846b"}, &(0x7f0000000200), 0x0) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:24:55 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xf, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:55 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x64000000, 0x204) 15:24:56 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="6c6f7765726469723d2e2f6275732c776f726b6469723d2e2f66696c653175707065726469723d2e2f66696c65300f969a9995ff3633d72500e03d3abd8b74b5933c46ac0d2e8647f2787e755b78f6bc37049cf7aeb68f46ff6b617f08dfb439f628b72c18a396eb56ee97441a2940c4e57194b820450e4c2e00677ec6fc0164ca3f5fa1fda60b37e62024888984629d248b53a352ff60"]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 1023.829345][ T8942] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 1024.042136][ T9049] overlayfs: option "workdir=./file1upperdir=./file0–š™•ÿ63×%" is useless in a non-upper mount, ignore [ 1024.042165][ T9049] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1024.062556][ T9050] overlayfs: option "workdir=./file1upperdir=./file0–š™•ÿ63×%" is useless in a non-upper mount, ignore [ 1024.062598][ T9050] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 15:24:58 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x2, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:24:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x10, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:58 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xf4030000, 0x204) 15:24:58 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f0000000040)='./bus\x00', 0x3a000, 0x0) 15:24:58 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x292002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:58 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r5, 0x0, 0x800000080004103) 15:24:58 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x60, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:58 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r6}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000000)={'team0\x00', r6}) r7 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:24:58 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xfefdffff, 0x204) 15:24:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r1, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus/file1\x00', &(0x7f0000000140)='overlay\x00', 0x200000, &(0x7f0000000440)=ANY=[@ANYBLOB='default_permissions,index=off,metacopy=off,xino=off,workdir=./file1/file0,uid=', @ANYRESDEC=r1, @ANYBLOB=',appraise,smackfsdef=system.advise\x00,appraise_type=imaWRITE,\x00']) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) r2 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539", 0x227, 0xfffffffffffffffe) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @loopback}}}, &(0x7f0000000100)=0x59) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000680)={0x0, 0x30000000}, 0x8) r3 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000100)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) r4 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f00000005c0)="033db656a7f880cae015ba3cfa56cb997aa4caa1719f01b955e2b4956dd4593da1c1bce98341d43bc1edc32dbc53e58c1b2a47c3c63c881da0acb07603ac779d99b367c24f7689b0f613566f250e8b6a0f86bfdb5149a3ab3af7f5b542b4161571042fec67401a15ea53349da4423a497880cc1e16e3582f1f2ce43c1d4efcf3a6e9443005faf9691e5f1c8d66eb4583521b695545b4bb1148d1c2b754476bedda9daa1a0dcc564fd6a6a0b339da66817829435fe4f2b03400", 0xb9, r3) keyctl$dh_compute(0x17, &(0x7f0000000000)={r4, r2, r4}, 0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)={'sha256-ssse3\x00'}}) r5 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000280)="904fdb8cabcfeb7ccdcf7ae49820f82e30dabcf35dd7b4080cf8b1b40cd6", 0x1e, 0xfffffffffffffff8) keyctl$dh_compute(0x17, &(0x7f00000002c0)={r2, r5}, &(0x7f0000000380)=""/19, 0x13, &(0x7f00000005c0)={&(0x7f00000003c0)={'sm3-generic\x00'}, &(0x7f0000000500)="1cb7015976085578d37cfb968536676f5ce9546074bd6c7e4ffb23d8a932c9ab1090493febf7d8fc8addc578b850e8e8c1c7686e484c9ee01a38d76a7620695443696b55fb3613eeea057f3fd8a98ce8dc630acc86cdc7b57ace5284ffba2a42a968ef5c4a949512d20036f8f69dbc47079f84b21b725aa384652fd1d57e673b29edbe1899400dc58bec89c2feddbfccc8aed130d3af535dc8c80ccc1fe257", 0x9f}) mknod$loop(&(0x7f0000000100)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) lremovexattr(&(0x7f0000000040)='./file1\x00', &(0x7f0000000080)=@known='system.advise\x00') mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x8) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) [ 1026.662561][ T9146] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 15:24:59 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xf0, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:24:59 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xfeffffff, 0x204) 15:25:01 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x2, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:25:01 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x300, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:01 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xfffffdfe, 0x204) 15:25:01 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:25:01 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x201) syz_mount_image$hfs(&(0x7f0000000040)='hfs\x00', &(0x7f0000000080)='./file1\x00', 0x10000, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="a031d1d348e30adcb1328e6d037d74d9af848b5b67ea5001938c759a320afa60317c56e85542d755f9af00039beb6072fdd92e2c376ef179174325658d39d2deb19c2553ec178b967fa87f76a42b672526b5f6f05ffd88f9a6aa06d03b7c5dee1b953b", 0x63, 0xb}], 0x4000000, &(0x7f0000000280)={[{@gid={'gid'}}], [{@dont_appraise='dont_appraise'}, {@obj_role={'obj_role'}}, {@func={'func', 0x3d, 'FILE_CHECK'}}, {@dont_hash='dont_hash'}, {@appraise_type='appraise_type=imasig'}]}) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,ur\x00'/47]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:25:01 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) close(0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000680)=[@in={0x2, 0x0, @rand_addr=0x40}]}, &(0x7f0000000180)=0x10) r5 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x6d, &(0x7f0000000000)={r6, @in6={{0xa, 0x4e21, 0x0, @loopback, 0x8}}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x85, 0x2, 0xbe, 0x0, 0x6]}, &(0x7f0000000100)=0x100) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040)={r6, 0x7f}, &(0x7f00000000c0)=0x8) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='stack\x00') sendfile(r7, r8, 0x0, 0x800000080004103) [ 1029.692022][ T9446] hfs: unable to parse mount options 15:25:01 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xfffffffe, 0x204) [ 1029.761290][ T9446] overlayfs: unrecognized mount option "ur" or missing value [ 1029.793540][ T9517] hfs: unable to parse mount options 15:25:02 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x600, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:02 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x1000000000000, 0x204) [ 1029.866102][ T9446] overlayfs: unrecognized mount option "ur" or missing value 15:25:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x4ffe0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000140)={0x26, 0x40, 0x80, 0xff, 0x2, 0x20, 0x0, 0x7, 0x3, 0x1f, 0x3, 0x1, 0x20, 0x4}, 0xe) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$FBIOBLANK(r3, 0x4611, 0x2) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r4, &(0x7f0000000140)=ANY=[], 0x4240a2a0) getsockname$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000100)=0x1c) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) sendmsg$nl_crypto(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000440)=@upd={0x0, 0x12, 0x100, 0x70bd26, 0x25dfdbfb, {{'drbg_nopr_sha384\x00'}, [], [], 0x3000, 0x400}, [{0x0, 0x1, 0x40}, {0x0, 0x1, 0x7fffffff}, {0x0, 0x1, 0xfff}]}, 0x10}, 0x1, 0x0, 0x0, 0x883}, 0x4008000) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="6c6f7765726469b8df423927543d2e2f6275732c776f726b6469723d2e2f66696c65312c7570d75b726469723d2e696c6520"]) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:25:02 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x900, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:02 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0xbfc7d9ee50e1bde4, 0x0) bind$phonet(r1, &(0x7f0000000100)={0x23, 0x59, 0x2, 0x5}, 0x10) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) socket(0x10, 0x800, 0x6) r3 = socket$isdn_base(0x22, 0x3, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r4) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}}, @in6=@empty, {}, {}, {}, 0x0, 0x0, 0xa}}, 0xf0}}, 0x0) sendfile(r0, r6, 0x0, 0x1000) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r5, 0x4008ae48, &(0x7f0000000040)=0x1) ioctl$TIOCL_GETKMSGREDIRECT(0xffffffffffffffff, 0x541c, &(0x7f0000000200)) [ 1030.286256][ T9648] overlayfs: unrecognized mount option "lowerdi¸ßB9'T=./bus" or missing value [ 1031.696025][ T0] NOHZ: local_softirq_pending 08 15:25:04 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x2, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:25:04 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xa00, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:04 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) socket$bt_rfcomm(0x1f, 0x1, 0x3) getrlimit(0xc, &(0x7f00000000c0)) r2 = socket(0x3, 0x3, 0x2) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r3) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) splice(r5, 0x0, r6, 0x0, 0x4ffe0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="9401000009060102000000000000000000000000280008800c00078008000a40000000050c00078008000b4005ffbca40c0007800500070088000000180007800c001480080001400000000608000640000000026c0007801800018014000240fe8000200000000000000000000000aa18000180140002400000000000000000000000000000000008001c4000000400060004404e20000006001d40000300000c0018400000000100000000140017006e657464657673696d3000000000000005000100070000000800094000000002bc000880180007801400170076657468305f6d6163767461700000000c00078008001c40000006241c000780180016801400024000000000000000000000000000000001100007800900120073797a3000a2a0d851f2c07eccc9a5515a0000000c00078008000a40000000040c00078005001500240000000c000780060005404e2000001c0007801800018014000240fe8000000000000000000000000000bb100007800900130073797a3100000000180007801400170076657468315f746f5f6d0000000500010007000000bf1a10ea8517daf625e245de3fd41cc5daa04e8ff27a0cfb4933dcb6a0a241ff0afa7f1bbfcc922cf97335b9036940f3f28c37e8914abd98e5"], 0x194}, 0x1, 0x0, 0x0, 0x4040080}, 0x40000) write$UHID_GET_REPORT_REPLY(r5, &(0x7f0000000100)={0xa, {0x4, 0xb2, 0xc0}}, 0xa) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') sendfile(r4, r7, 0x0, 0x8000000800040ff) 15:25:04 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) socket$inet6(0xa, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:25:04 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x800000000000000, 0x204) 15:25:04 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x7a) r0 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000100)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) add_key$user(&(0x7f0000000040)='user\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000440)="033db656a7f880cae015ba3cfa56cb997aa4caa1719f01b955e2b4956db6593d9f4fcdbea1c1bce98341d43bc1edc32dbc53e58c1b2a47c3c63c8860770ded7603ac779d99b367c24f7689b0f613566f250e8b6a0f86bfdb5149a3ab3af7f5b542b4161571042fec671a15ea53349da45c3a497880cc1e16e3582f1f2c603c1d4efcf3a6e9443005faf9691e5f1c8d66eb4583521b695545b4bb114896c2b754476bedda3192f6cc979ba09daa1a0dcc564fc1fe037139da668178295fe4f2b034004eee00ff347f0159e3dd3cbe931457e679630f9131a4e689b8f1223199a2fbf497e2497c5325fe311a9d22011498f1a18aa686b62a4588c824f51cef7070a8ba5a8a8e24c541eb78a990590c2b215577e61523ade41650a5f4a66185a4f19f7b329a59ee823b093eb605898fad8b00", 0x131, r0) keyctl$clear(0x7, r0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x1) setresuid(0x0, r3, 0x0) ioctl$SIOCAX25GETUID(r1, 0x89e0, &(0x7f0000000040)={0x3, @bcast, r3}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x10400, &(0x7f0000000300)=ANY=[@ANYRESHEX]) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000140)=ANY=[], 0x4240a2a0) ioctl$DRM_IOCTL_ADD_CTX(r4, 0xc0086420, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_LOCK(r1, 0x4008642a, &(0x7f0000000140)={r6, 0xc}) ioctl$IOC_PR_RESERVE(r5, 0x401070c9, &(0x7f0000000080)={0x9, 0x7, 0x1}) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:25:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xb2a, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xb2e, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xc00, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xe00, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:05 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0xe00000000000000, 0x204) 15:25:05 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0xf00, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:07 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x2a0b, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) 15:25:07 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES16, @ANYBLOB="cf2af50c115c351907ef022c3128d6c3867293f6e03ad9929c35189bdd88b4086842663709b16e3841ebec84549f0e10889b91b860d8cf431c025fe40e5e7e814dcf67352ce4f7f85a9101711917667049a743b57b7bacf7cb05b665ddc22659c3cb0981b50935b09ca1f60ddfd615eb60dfd43b580af43a4bacb0d243c0d72a098a75beed056915c8d02cb86479a5d8202f00e58062158ca3570238f105e698a686032d72f3000000000000710daf225c32ec43b9ea3e1103355de204e008ab995a15f3aeb5dc852983bbc3764c8dc041297d949549ca79b883be4030d0a6810853446a3acd31500a8d", @ANYBLOB="a7b74aad84a9d68309edc937d385a7c5959263093c6547c70921cd03f191f3b525328e92fad8556bc8405672662be6236747a6cdb02d4d678ce828c53466ba9d95a6b464336d4f7eadad3878640848d2", @ANYPTR], 0x0, 0x144}, 0x20) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000000)=""/6, 0x6}], 0x2, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x33) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 15:25:07 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mknod$loop(&(0x7f00000003c0)='./bus/file1\x00', 0xc000, 0x1) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) execve(&(0x7f0000000040)='./bus/file1\x00', &(0x7f0000000100)=[&(0x7f0000000080)=',selinuxself.\x00', &(0x7f00000000c0)=')selinux\'\x00'], &(0x7f0000000280)=[&(0x7f0000000140)='overlay\x00', &(0x7f0000000180)='overlay\x00', &(0x7f0000000200)='vboxnet0*{#\x00']) open(&(0x7f00000001c0)='./bus/file1\x00', 0x0, 0x0) 15:25:07 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) nanosleep(&(0x7f00000000c0)={r3, r4+10000000}, &(0x7f0000000100)) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(0x0, r5) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') r7 = socket$alg(0x26, 0x5, 0x0) sendfile(r7, r6, 0x0, 0x800000080004102) 15:25:07 executing program 5: timer_create(0x0, &(0x7f0000000300)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x16}, &(0x7f0000000200)=0x0) timer_settime(r0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(0x0, 0x50c3000000000000, 0x204) 15:25:07 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000200)=r2) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x4) r4 = dup(r3) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="f0000000100013070000000000000000fe80000000001d0000000000000000aae000000200000000000000000000000000000000400000000a0000a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00'/168], 0xf0}}, 0x0) close(r5) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r4, 0xc02064b9, &(0x7f0000000240)={&(0x7f0000000040)=[0xfffffde9, 0x5, 0x5, 0x9, 0x2, 0x5], &(0x7f0000000080)=[0x0], 0x6, 0xfffffff9, 0xcccccccc}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000400)={'rose0\x00', 0x2}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000100)={{{@in6=@loopback, @in6=@ipv4={[], [], @broadcast}}}, {{@in6=@local}, 0x0, @in6=@dev}}, &(0x7f0000000000)=0xe8) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) splice(r6, 0x0, r7, 0x0, 0x4ffe0, 0x0) ioctl$KVM_NMI(r6, 0xae9a) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) 15:25:08 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x2e0b, {}, [@IFLA_MASTER={0x8, 0x4, r4}, @IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}]}, 0x3c}}, 0x0) [ 1035.871212][T10064] [ 1035.873589][T10064] ======================================================