18756f76cce34ba789bce2861f11e2beb3dcadf1e0280f35c360040af16dcd5986b3be571dfdc790f8a59b8825e6fae25f18c774026341ee7b2123f394dc985ef2cdd607c44c152ec200f275e410f96e035cb00088d87a233339629bdeffa274623914af1e84b5d41d794f821a6954f8f9b4ec305b9d686e144cca8d5585c8461e1f30ab6a91178bfa03b0e9734f80f9ed9f9fd7b4b28543bf7652462feb6b88c8fe362d53ee1730d6638e3a952b1761615ed5b8b2451734cecd3adfe7a8845d7ebf1de7f1fc161763f471b12f15eb8f31e41a81af260eabe616229b670b65180973856865c6d1e10c8aef41fa180e6131a98b2019d1b693b441604de2258e85c2f40a0c4c4c309a8eb1a66f8ab5c6a5b9bf11249ab218d17420026b9046c536e37c3ede3a1f2c6a5cb4c4994f3998d6287eb5be4756ee0db2c35ea4b9ebc4dd7c73cff037c97d2bf1352a4044e01057c314e9a7154c363a1c478ae62925d683113fb6fcc6470ba5b3d7bdb0a56ab44fce1d1f4b6d63891aaab9664fd588e3dfd80e909623b69775d3d06619c84baa861d96d1af91b032e6b5dbebd6bebafb07694f2180f8cd2ce6913663eb22f58a2020d18018acb1a129c71bf74461c6d92f8345dde828f1967464bf387cf90c776dc9c400cd4e379e1ae830538fd2d974279d005d37fe72e69b4108bc6f0163d37488e2147b63246686729605b84776069b1bffd69a75017c1b0807a33df6f3509cba92c9cdc5908b7f783b74fdd7a663d550a9432defad556d1a30b706af49868fa0c70f6182ba66b1c00760ee79fa9048163a40c1d09ea222b7d5ba436bfe4b828a52375877e40dc23975dfd1def77728cc328bb68a61f3c0f6fecdaaf70be48a5fbf319724d57dce05b8e2af1d73c43a038d753d4935f381bf46428b36cf6a42f7a08392fa65a51296f7c4faf660a99c53f49d95fba7def4e6a851cfe6b729fe631a50aa5972f15f1ff4d242eac46aec5a35819e9c6286bea3169e11aeb5bed2e3707539859160abc02e4d8e01c153958df96f6b5f66c2981e9919c6df52d261c63dd812e983b5a512934eec5b6ceb9b73be10686a7a543cea01d19ae45ed767faf1b788e08d354ae843e68be67b50cf5bd87abbcadca7ef73e9eda412c33595b96a2bf353fd593c843dcb1e1114619003262f7527549b723baf485b07875bc1f1a15b59928631566417239d68f9840e76945e84a4a77f9c74dfe46a87a49c31e8dd562569a33267e0f9695ef1bd42c8069e9e6cb65140d982ca5131e8b649ecb9b84bbc933842a5451deafb77fbade7b5c690ba5b78919648c13709db06b86cb13d9bb3e132e1fb3b708e7af5bd3a3b3d1a1616f26417a436dda477ac9f14390a7a80ee01267c31780a66739a929497e0740799ef1c07337c264815d9ab48712b5ea9011b914c7874096fd881da593cb1e8bed0df156947dc757f71e2e58d0c6cf3d7bd1a0ba31b58e1463260bd8d5bacd7d9e07a77019a0a21bfe0975de819935ca6c8f269f7901fc779bf7d86ead39617a2296539999a4541accd82e489ea7218a192998edb0d0941688fd20d2376c1c73cd15b0fa13a5e07551990b9963fa0406224142f27f7d7e8ddbc11eb7aecda2b0a46d3be114d97980019a7774de28f16ff20261c0300e1e3b9cb2c78fe6027f9791c5a365af97bff6156fac27d3739ed1f079f693aca0c28931600532f849f3cf32614d5f2d8f9091b8686da479afa6fb13beb6f321d5d188cc2eb70d917c77fb7c924f4a83c77ba969c4304d48c37640701ff952e9e2b41213e7683489b65c9f4a5a8fa863221c5d9568faad8bd5601931743d074883baeb869364cd2e741ed92741fa0ca4732f7f3f4e71f8f71cb22115e72db23c2c858afc0a2ebf3751303c8052fb5021529388d581250e8b1106e298bad1bdfab2e942d073a6d7ffca983800c0deecbc50fdadb4ceea9741d6779501d5e91598a7d45933b94e188f2171afb2d01bc1e9ae0c58df08046813357051f5e442cfb958a63b7112e09075108bf8b2775c18f3faf2a3fc052873aef0182530ba28c8dbf119e9dc94f7ed1f4cb9872c4af1e05afaaf0921bbb9c841862f5615cc9473cd3d263670c44c8a24e38"}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x9, 0x0, {0x9, 0x5, 0x1, 0x0, 0x10000}, [0x0]}}, @name="efdf45aad2b99511ca7d860f481512f7d225fe8c41ff1f5e4a9b67bf5550f2a13ba9b1b29fd3690b1661598c04298532a415fdff1305914f976cd3e1c137416124e20585cedf0ad75c26931fca2022952b1a089e06c974da8ef4f41de92ab345a8aa9c488323a3243d83f27dfd07ff9d541b316cb0cd5b08775f58e52a93c61f005299832a1921ae63e7556d03111c5938cdddf2f915d4b32a22e7941841e0ba43ef64189c18a1e4684e99925e049d71967b3b665abe3784cf64d9f5b5ed4d0492e07dc304246a9bb61396d44e1dd5590d3040cdd0faa383ea8f806c08a677a53f1c451c1a24b4a4105d5a5cd877f27a9e28ffc80f409682945fcb604426a4da809f96e3249795bcfbf777932e02bb0694fbd536fb4c51f0ce1dbb50297a3ad93611aa936384b8d421b6c7197bbb29643caca1d6734e6867563fe24decad399fe4f2370882a26e3b3abed1fa373e0deda3b5a9db2ec359e5c2b9a27cab961cec7e876156b64d095f10f11891e22568e5947dcbd03253a1ab0e33db6a11d92b3af920e139feb2eace5dfa186ce82c92fc8f78280246f69fff8632c14fde9a6846e15dd52c96740e4f3a70fa51bd6c050983fc1495ec9310ea03f4b76896f96a8c990ba9ec41ee319dacf8ca71000ae0745640aa7842e58fbd2c5440694fee87a728bef8ba66ecbe8b60be7428e77e45ee5f21c2ae4e9a709c9c40b416edd467230e5afc593c016ec83e1316219873bf056511423e11e7b6853d1350a5fd1c11f8994b55fbb56123a1be772564654a77c3cce41d6a83e4c7dbbf91a336f7f9aa9771927cb7e2192c6c21ebb870b1076c580e3a5bcf58a2caeb8e3848532f50b9fccce8607c95c3d4236348c9eb92be8dee127d14a255d6ab53fa78b06de1d5c6a38e462f6ba49c5eb70d68c0df94960bcf4ff620f43e8f02813a31dcd9a42a8eb6df94fef7e251cdfb2519528b6f002f9360eafbdcf60b4e9c442e8de47c70b1aeb31f4497b88fb74d6df571b5709597bea7ca7859b99cf7a9fd05ddf505c729e0c7efc3d4926394f3a481c2437b6b48c07505b1f1d03ba0e9ad47528c69c73889ddc4395ec6ef7ed9ea36d2121a8b45fe9f4ac0571874853d2c1708cc0ee67851e5e3d446637c836d99d3e79fc3d3751e29da1825f559e50e303ee42e0bdcf0b7e01201388e3789d83819ed7cadea7448bf705a8cf7789cc0cbed4cfd9755e2ecf7a41d7f67ed5ec6e306cb7655ea574ef8a21f5bc8e7b3a3411e99f265cd97c300bc1077270daacd0ac1912b290a390350301ca2b90c03b5f7f0b5ad8dce36f0c287ffa296accb3c400b2c1318b117316c88702dba3c3790b4c796fd218cedad1bc240b129006a5f8d5cbf7009e556462c7ff077eb593bc6814960828e9bd091de8803760ca46a54a31571c62297c3b959eff20aca31621a2566d0a1dee3b1291d4b324865de8bdb59a89910f86fd1bc85f15926f2d6da81cda19f690c8417df094836014549123135f78908d6ef5bce92905b172cf239b0c2da3d378d4b7b9edd21957f12b4e545cca466cbac51ca50d9a2c04fd2ffd32618ed30db51150d82a2bcca978e6640dad4e20ee570565b47fe39e32f671d739bd934acc99367e3f0994d9ed5bcec88721a6683fe3ddd9064a71e27935cefe96a5fadf78925d3a2aa95cde8febce57825a1af6067b4f926452a1d56574461985974885f5b63d1aee31acc0405f08e5f9ad87eb328bcaf7aff2b2f649588d55465d73ec9a145d089e58c5beb95134910492e4128f5199a6b2087fe7c42060e26a5867fef15f0b14da24d57e6d45b972c883478f240a20d76121419272954b47acf0ae78c1581a91e84dcca8911b6aa2448773f560fffa443bfa982a2f09d3cf20f3713ed8ecf00cf22be5564ee7bc0e6de31841eb8a2d60cf1a48f1265bab29d938d1e30d093e4daa8151301873f50d8be5ceb004b679613adcd6213e20c13a46df2dcae1dcbe9a8412ad38046abeb8b0d6fc1d36f9c09850ccab272932ea1fab8b1fe948edb2e957176a856b6cbe6c822844c2aa573991b611bf059e07659a64412edacf7bc97e61eea489dbe45a2287c6040ffb546ba1fa7863928cdeca431a0b9727118f554727bbc3ba68ca333a35e27686af3ac7ed3d916a8fea4a217ff0739e4eeb5c3508a2da786a013efd14b66b1b29307c707e2ba2bbe85a0109227e150cb7614cc8fbb91d454ca5129bf13082bca5895fad7ef4a04cc42746bf170a591d8c2e5aacf352147adf8ae9408919625a8da0f2593b92812b0602e1fdeda0b440226fc9b5400293cd6d87843458ef73b262f294064a1609a6e39f35e19d2a560fb550cd07e751cf50463582b1e45da657ce5850c26b83bd186ebac39e59b4de7acf861ba18a7632d5f31854814e7c65c17ca40dfa67e6e1436f829b59f0ce10fb4287bba811cbe1ee588e846b7337a2621d31d4e18dee557cd7805dcb83e01b00c09931c2aabb9f5240ee4b975164c073c71aef686b81a99e4cf037b8c9d020c1ff18fc64e2968a6fea7ba8a1b3ca0b79a4ba3aeea96b54afedee575872bbfee100ef7d975ebfc862fc4752f702c005f03f332c3478fe6c139e953277d24eb47f56c9d6583bc7ca6ef6255be7b3a9fe7b9cddb7f15efbc20c4efffbcbaae181614bdcac073360780f984bbc64c660f843742c8091267144364002c2cbe1498dfc83bb0d25ee97d2a2480ef9d82614ae5b60a54b0133d1f9f98f401951e2e7cee520ab585dc4976903574666c1fc3cdd205649b37c6094bf240c5eb38e6a774e58de85e25b94f938115be377a8d5e68cd0f008f12cd2ee92131c794fbeb242657d53f9e06f75909b9d81424f067c5adc3847ca69ca236766b67b83d86b32dc74b9bca4cdc8bf82fc3f09a9be944ae224f36c46529e2b0455800de1d1330604f8e6491083a940880fee8bc23889d048b00eec554b2f91c7236aefdb01a6111e672d01ce98636c24c2268c58d86cbdc4c53b1e8181c395dd225a494046dbe837383d56e912c0a429743c1d8ded007205fcaa91c85d2a32d61c5059a954eed2db6dafa4b0e58c5a43b680db62aeb40c73f63375e3687c2a9ed4a6c98ece00e27f222a79cb523e53485cc9746890a27b45425c86230483f045b26f0649444472b08cff802fff038f04522cab80831c6dde39a14b628c3c61ae902ba091c514c33be64221cd00e87ea24ed848af3b341c589a33c5a4cc5bf322a90a4844d098cb4ad5abbe636be440564d69ced00526d798adf15dca9f25bf90c65bc194f3af525bdd678b27ee645a0ce2ae1e825d447ab86706182e020197a604e77ed98dcc69fb5980981e27e5eb211964593b62630ad1822e47f12703f515c30f16b411924cee86c4541af6646a103d1cc5f1e20a95f3b0dcf791d7cc2c08d9622a64d66fcc70f70d9a1f5fabea0b491897bc9057bee8db9ce2c0f55e8ab65755261dda8102b0e35cfd5c3b9443e4fddacc257681bae0eabf0831bcb13a25549bc960344b83fca69e39322a47f468455abac2ae0aa56af3f11c10b11574c33aa23f7e5c7455fbdacd5c48986ac44440d83aaa79eb29618756f76cce34ba789bce2861f11e2beb3dcadf1e0280f35c360040af16dcd5986b3be571dfdc790f8a59b8825e6fae25f18c774026341ee7b2123f394dc985ef2cdd607c44c152ec200f275e410f96e035cb00088d87a233339629bdeffa274623914af1e84b5d41d794f821a6954f8f9b4ec305b9d686e144cca8d5585c8461e1f30ab6a91178bfa03b0e9734f80f9ed9f9fd7b4b28543bf7652462feb6b88c8fe362d53ee1730d6638e3a952b1761615ed5b8b2451734cecd3adfe7a8845d7ebf1de7f1fc161763f471b12f15eb8f31e41a81af260eabe616229b670b65180973856865c6d1e10c8aef41fa180e6131a98b2019d1b693b441604de2258e85c2f40a0c4c4c309a8eb1a66f8ab5c6a5b9bf11249ab218d17420026b9046c536e37c3ede3a1f2c6a5cb4c4994f3998d6287eb5be4756ee0db2c35ea4b9ebc4dd7c73cff037c97d2bf1352a4044e01057c314e9a7154c363a1c478ae62925d683113fb6fcc6470ba5b3d7bdb0a56ab44fce1d1f4b6d63891aaab9664fd588e3dfd80e909623b69775d3d06619c84baa861d96d1af91b032e6b5dbebd6bebafb07694f2180f8cd2ce6913663eb22f58a2020d18018acb1a129c71bf74461c6d92f8345dde828f1967464bf387cf90c776dc9c400cd4e379e1ae830538fd2d974279d005d37fe72e69b4108bc6f0163d37488e2147b63246686729605b84776069b1bffd69a75017c1b0807a33df6f3509cba92c9cdc5908b7f783b74fdd7a663d550a9432defad556d1a30b706af49868fa0c70f6182ba66b1c00760ee79fa9048163a40c1d09ea222b7d5ba436bfe4b828a52375877e40dc23975dfd1def77728cc328bb68a61f3c0f6fecdaaf70be48a5fbf319724d57dce05b8e2af1d73c43a038d753d4935f381bf46428b36cf6a42f7a08392fa65a51296f7c4faf660a99c53f49d95fba7def4e6a851cfe6b729fe631a50aa5972f15f1ff4d242eac46aec5a35819e9c6286bea3169e11aeb5bed2e3707539859160abc02e4d8e01c153958df96f6b5f66c2981e9919c6df52d261c63dd812e983b5a512934eec5b6ceb9b73be10686a7a543cea01d19ae45ed767faf1b788e08d354ae843e68be67b50cf5bd87abbcadca7ef73e9eda412c33595b96a2bf353fd593c843dcb1e1114619003262f7527549b723baf485b07875bc1f1a15b59928631566417239d68f9840e76945e84a4a77f9c74dfe46a87a49c31e8dd562569a33267e0f9695ef1bd42c8069e9e6cb65140d982ca5131e8b649ecb9b84bbc933842a5451deafb77fbade7b5c690ba5b78919648c13709db06b86cb13d9bb3e132e1fb3b708e7af5bd3a3b3d1a1616f26417a436dda477ac9f14390a7a80ee01267c31780a66739a929497e0740799ef1c07337c264815d9ab48712b5ea9011b914c7874096fd881da593cb1e8bed0df156947dc757f71e2e58d0c6cf3d7bd1a0ba31b58e1463260bd8d5bacd7d9e07a77019a0a21bfe0975de819935ca6c8f269f7901fc779bf7d86ead39617a2296539999a4541accd82e489ea7218a192998edb0d0941688fd20d2376c1c73cd15b0fa13a5e07551990b9963fa0406224142f27f7d7e8ddbc11eb7aecda2b0a46d3be114d97980019a7774de28f16ff20261c0300e1e3b9cb2c78fe6027f9791c5a365af97bff6156fac27d3739ed1f079f693aca0c28931600532f849f3cf32614d5f2d8f9091b8686da479afa6fb13beb6f321d5d188cc2eb70d917c77fb7c924f4a83c77ba969c4304d48c37640701ff952e9e2b41213e7683489b65c9f4a5a8fa863221c5d9568faad8bd5601931743d074883baeb869364cd2e741ed92741fa0ca4732f7f3f4e71f8f71cb22115e72db23c2c858afc0a2ebf3751303c8052fb5021529388d581250e8b1106e298bad1bdfab2e942d073a6d7ffca983800c0deecbc50fdadb4ceea9741d6779501d5e91598a7d45933b94e188f2171afb2d01bc1e9ae0c58df08046813357051f5e442cfb958a63b7112e09075108bf8b2775c18f3faf2a3fc052873aef0182530ba28c8dbf119e9dc94f7ed1f4cb9872c4af1e05afaaf0921bbb9c841862f5615cc9473cd3d263670c44c8a24e38"}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) linkat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', r4, &(0x7f0000000140)='./file0\x00', 0x400) [ 1623.302629][T14437] overlay: Unknown parameter '\' [ 1623.314962][T14440] fuse: Bad value for 'fd' 14:42:32 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) linkat(r0, &(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000100)='./file0\x00', 0x400) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1623.353495][T14445] fuse: Bad value for 'fd' 14:42:32 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1228010, &(0x7f0000000300)={{'fd', 0x3d, r0}}, 0x1, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1623.403268][T14450] fuse: Bad value for 'fd' [ 1623.739221][T14427] orangefs_mount: mount request failed with -4 14:42:33 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) read$ptp(r0, 0x0, 0x0) (async) 14:42:33 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 10) 14:42:33 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="04000000000000002e2f66696c653000a58df9b8a90f552385f821a01402ea30f8290ab69ed1d65522300a33b92d7affdcc278369ec45ff03917530df11e393594902ed1d978"]) ioctl$AUTOFS_DEV_IOCTL_READY(r1, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:33 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0x4020940d, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:33 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1228010, &(0x7f0000000300)={{'fd', 0x3d, r0}}, 0x1, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1228010, &(0x7f0000000300)={{'fd', 0x3d, r0}}, 0x1, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:33 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$pvfs2(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x820030, &(0x7f00000001c0)={[{'.'}, {'[@'}, {'overlay\x00'}, {'overlay\x00'}, {}, {'-[\xbc-]{^\\]-%}'}], [{@fsuuid={'fsuuid', 0x3d, {[0x35, 0x38, 0x34, 0x65, 0x7, 0x38, 0x30, 0x63], 0x2d, [0x33, 0x36, 0x36, 0x35], 0x2d, [0x39, 0x38, 0x37, 0x34], 0x2d, [0x35, 0x34, 0x64, 0x61], 0x2d, [0x33, 0x66, 0x62, 0x31, 0x62, 0x34, 0x63, 0x63]}}}]}) fstat(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$pvfs2(&(0x7f0000000240), &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2004001, &(0x7f0000000380)={[{'unused\x00'}], [{@uid_eq={'uid', 0x3d, r1}}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x35, 0x38, 0x32, 0x0, 0x65, 0x33, 0x63, 0x38], 0x2d, [0x61, 0x30, 0x35, 0x62], 0x2d, [0x38, 0x33, 0x33, 0x35], 0x2d, [0x30, 0x34, 0x30], 0x2d, [0x62, 0x37, 0x38, 0x34, 0x38, 0x35, 0x36, 0x36]}}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1624.127298][T14460] FAULT_INJECTION: forcing a failure. [ 1624.127298][T14460] name failslab, interval 1, probability 0, space 0, times 0 [ 1624.150324][T14460] CPU: 0 PID: 14460 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1624.160458][T14460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1624.170548][T14460] Call Trace: [ 1624.173857][T14460] [ 1624.176821][T14460] dump_stack_lvl+0x1e7/0x2d0 [ 1624.181585][T14460] ? nf_tcp_handle_invalid+0x650/0x650 [ 1624.187089][T14460] ? panic+0x850/0x850 [ 1624.190669][T14464] fuse: Bad value for 'fd' [ 1624.191265][T14460] ? __might_sleep+0xc0/0xc0 [ 1624.200348][T14460] should_fail_ex+0x3aa/0x4e0 [ 1624.205079][T14460] ? jbd2__journal_start+0x148/0x5d0 [ 1624.210499][T14460] should_failslab+0x9/0x20 [ 1624.215045][T14460] kmem_cache_alloc+0x6d/0x350 [ 1624.219855][T14460] jbd2__journal_start+0x148/0x5d0 14:42:33 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0x4020940d, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) (async) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0x4020940d, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:33 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="04000000000000002e2f66696c653000a58df9b8a90f552385f821a01402ea30f8290ab69ed1d65522300a33b92d7affdcc278369ec45ff03917530df11e393594902ed1d978"]) ioctl$AUTOFS_DEV_IOCTL_READY(r1, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="04000000000000002e2f66696c653000a58df9b8a90f552385f821a01402ea30f8290ab69ed1d65522300a33b92d7affdcc278369ec45ff03917530df11e393594902ed1d978"]) (async) ioctl$AUTOFS_DEV_IOCTL_READY(r1, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) [ 1624.225014][T14460] __ext4_journal_start_sb+0x215/0x5a0 [ 1624.230571][T14460] __ext4_new_inode+0x12cb/0x4360 [ 1624.235659][T14460] ? ext4_has_group_desc_csum+0x1e0/0x1e0 [ 1624.241434][T14460] ext4_create+0x279/0x550 [ 1624.245910][T14460] ? ext4_lookup+0x750/0x750 [ 1624.250545][T14460] ? bpf_lsm_inode_create+0x9/0x10 [ 1624.255685][T14460] ? security_inode_create+0xb8/0x100 [ 1624.261088][T14460] ? ext4_lookup+0x750/0x750 [ 1624.265702][T14460] path_openat+0x13fa/0x3280 [ 1624.270327][T14460] ? do_filp_open+0x490/0x490 [ 1624.275022][T14460] do_filp_open+0x234/0x490 [ 1624.279535][T14460] ? vfs_tmpfile+0x500/0x500 [ 1624.284149][T14460] ? _raw_spin_unlock+0x28/0x40 [ 1624.289008][T14460] ? alloc_fd+0x59c/0x640 [ 1624.293345][T14460] do_sys_openat2+0x13e/0x1d0 [ 1624.298025][T14460] ? mutex_unlock+0x10/0x10 [ 1624.302536][T14460] ? do_sys_open+0x230/0x230 [ 1624.307222][T14460] __x64_sys_openat+0x247/0x290 [ 1624.312089][T14460] ? __ia32_sys_open+0x270/0x270 [ 1624.317059][T14460] ? syscall_enter_from_user_mode+0x32/0x230 [ 1624.323111][T14460] ? lockdep_hardirqs_on+0x98/0x140 [ 1624.328334][T14460] ? syscall_enter_from_user_mode+0x32/0x230 [ 1624.334325][T14460] do_syscall_64+0x44/0x110 [ 1624.338831][T14460] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1624.344728][T14460] RIP: 0033:0x7fad1fe7cae9 [ 1624.349140][T14460] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1624.368750][T14460] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1624.377174][T14460] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1624.385143][T14460] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 1624.393119][T14460] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1624.401095][T14460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1624.409082][T14460] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1624.417157][T14460] 14:42:33 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1228010, &(0x7f0000000300)={{'fd', 0x3d, r0}}, 0x1, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:33 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0x4020940d, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1624.431081][T14472] fuse: Bad value for 'fd' 14:42:33 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="04000000000000002e2f66696c653000a58df9b8a90f552385f821a01402ea30f8290ab69ed1d65522300a33b92d7affdcc278369ec45ff03917530df11e393594902ed1d978"]) ioctl$AUTOFS_DEV_IOCTL_READY(r1, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:33 executing program 3: statfs(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=""/64) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x20003, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xc00}}, {@allow_other}, {@default_permissions}, {@allow_other}, {@allow_other}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x1400}}]}}, 0x40, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="0000e8ffffffffff2d2f66696c653000"]) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r7, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000005c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r7, @ANYBLOB="000000001c000000000000696c653000"]) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000580)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) stat(&(0x7f0000000680)='./file0\x00', &(0x7f0000000380)) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r9, 0xc018937b, &(0x7f0000000600)={{0x1, 0x1, 0x18, r0, {r6, r8}}, './file0\x00'}) unlinkat(r10, &(0x7f0000000640)='./file0\x00', 0x0) syz_mount_image$fuse(&(0x7f00000002c0), &(0x7f0000000300)='./file0\x00', 0x4b098, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xa00}}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'rootmode'}}]}}, 0x1, 0x0, &(0x7f00000004c0)="538c9b521499a9e34496c1066d45bc1d2b33278b7f74a6698df161ac3eb956846df3900a0ae13178a3151218b63d1d20fbf17ebd57ced30045b6310bb2dfa36ab509fec36ed9dc72c52f9ef910d5364b3ff6110296edfcb27e68ef3ead8a9781d706c2be233712e74b11546b666c5803b1c2ca4dfdd69abdb5b914fb14fd2c9be46cf67ddf2ede03") [ 1624.455742][T14461] overlay: Unknown parameter '\' [ 1624.474991][T14460] EXT4-fs error (device sda1) in __ext4_new_inode:1083: Out of memory [ 1624.540737][T14483] fuse: Bad value for 'fd' [ 1624.571938][T14485] fuse: Bad value for 'user_id' 14:42:34 executing program 4: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:34 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7}}, './file0\x00'}) r1 = fspick(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1, {0x40}}, './file0\x00'}) 14:42:34 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 11) 14:42:34 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[], [{@pcr={'pcr', 0x3d, 0x22}}, {@smackfshat={'smackfshat', 0x3d, '^'}}, {@uid_eq}, {@fsuuid={'fsuuid', 0x3d, {[0x62, 0x0, 0x39, 0x0, 0x30, 0x38, 0x36, 0x64], 0x2d, [0x36, 0x64, 0x30, 0x39], 0x2d, [0x30, 0x36, 0x30, 0x62], 0x2d, [0x61, 0x33, 0x65, 0x30], 0x2d, [0x64, 0x30, 0x31, 0x38, 0x63, 0x65, 0x31, 0x36]}}}, {@smackfsdef={'smackfsdef', 0x3d, 'rootmode'}}, {@permit_directio}, {@pcr={'pcr', 0x3d, 0x3b}}]}}, 0x0, 0x0, 0x0) 14:42:34 executing program 3: statfs(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=""/64) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x20003, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xc00}}, {@allow_other}, {@default_permissions}, {@allow_other}, {@allow_other}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x1400}}]}}, 0x40, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="0000e8ffffffffff2d2f66696c653000"]) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (rerun: 64) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) r7 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r7, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000005c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r7, @ANYBLOB="000000001c000000000000696c653000"]) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000580)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) stat(&(0x7f0000000680)='./file0\x00', &(0x7f0000000380)) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r9, 0xc018937b, &(0x7f0000000600)={{0x1, 0x1, 0x18, r0, {r6, r8}}, './file0\x00'}) unlinkat(r10, &(0x7f0000000640)='./file0\x00', 0x0) syz_mount_image$fuse(&(0x7f00000002c0), &(0x7f0000000300)='./file0\x00', 0x4b098, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xa00}}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'rootmode'}}]}}, 0x1, 0x0, &(0x7f00000004c0)="538c9b521499a9e34496c1066d45bc1d2b33278b7f74a6698df161ac3eb956846df3900a0ae13178a3151218b63d1d20fbf17ebd57ced30045b6310bb2dfa36ab509fec36ed9dc72c52f9ef910d5364b3ff6110296edfcb27e68ef3ead8a9781d706c2be233712e74b11546b666c5803b1c2ca4dfdd69abdb5b914fb14fd2c9be46cf67ddf2ede03") 14:42:34 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$pvfs2(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x820030, &(0x7f00000001c0)={[{'.'}, {'[@'}, {'overlay\x00'}, {'overlay\x00'}, {}, {'-[\xbc-]{^\\]-%}'}], [{@fsuuid={'fsuuid', 0x3d, {[0x35, 0x38, 0x34, 0x65, 0x7, 0x38, 0x30, 0x63], 0x2d, [0x33, 0x36, 0x36, 0x35], 0x2d, [0x39, 0x38, 0x37, 0x34], 0x2d, [0x35, 0x34, 0x64, 0x61], 0x2d, [0x33, 0x66, 0x62, 0x31, 0x62, 0x34, 0x63, 0x63]}}}]}) fstat(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$pvfs2(&(0x7f0000000240), &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2004001, &(0x7f0000000380)={[{'unused\x00'}], [{@uid_eq={'uid', 0x3d, r1}}, {@dont_hash}, {@fsuuid={'fsuuid', 0x3d, {[0x35, 0x38, 0x32, 0x0, 0x65, 0x33, 0x63, 0x38], 0x2d, [0x61, 0x30, 0x35, 0x62], 0x2d, [0x38, 0x33, 0x33, 0x35], 0x2d, [0x30, 0x34, 0x30], 0x2d, [0x62, 0x37, 0x38, 0x34, 0x38, 0x35, 0x36, 0x36]}}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1624.955823][T14459] orangefs_mount: mount request failed with -4 14:42:34 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7}}, './file0\x00'}) r1 = fspick(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1, {0x40}}, './file0\x00'}) [ 1625.036648][T14495] FAULT_INJECTION: forcing a failure. [ 1625.036648][T14495] name failslab, interval 1, probability 0, space 0, times 0 [ 1625.038015][T14493] fuse: Bad value for 'user_id' [ 1625.067416][T14489] overlay: Unknown parameter '\' [ 1625.072656][T14493] fuse: Bad value for 'fd' 14:42:34 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[], [{@pcr={'pcr', 0x3d, 0x22}}, {@smackfshat={'smackfshat', 0x3d, '^'}}, {@uid_eq}, {@fsuuid={'fsuuid', 0x3d, {[0x62, 0x0, 0x39, 0x0, 0x30, 0x38, 0x36, 0x64], 0x2d, [0x36, 0x64, 0x30, 0x39], 0x2d, [0x30, 0x36, 0x30, 0x62], 0x2d, [0x61, 0x33, 0x65, 0x30], 0x2d, [0x64, 0x30, 0x31, 0x38, 0x63, 0x65, 0x31, 0x36]}}}, {@smackfsdef={'smackfsdef', 0x3d, 'rootmode'}}, {@permit_directio}, {@pcr={'pcr', 0x3d, 0x3b}}]}}, 0x0, 0x0, 0x0) [ 1625.093328][T14495] CPU: 0 PID: 14495 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1625.103472][T14495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1625.113559][T14495] Call Trace: [ 1625.116874][T14495] [ 1625.119832][T14495] dump_stack_lvl+0x1e7/0x2d0 [ 1625.124645][T14495] ? nf_tcp_handle_invalid+0x650/0x650 [ 1625.124786][T14494] fuse: Bad value for 'user_id' [ 1625.130126][T14495] ? panic+0x850/0x850 [ 1625.130153][T14495] ? __might_sleep+0xc0/0xc0 14:42:34 executing program 4: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) (async) read$ptp(r0, 0x0, 0x0) [ 1625.130186][T14495] should_fail_ex+0x3aa/0x4e0 [ 1625.130216][T14495] ? security_inode_init_security+0x128/0x470 [ 1625.130237][T14495] should_failslab+0x9/0x20 [ 1625.130260][T14495] __kmem_cache_alloc_node+0x6d/0x300 [ 1625.130285][T14495] ? security_inode_init_security+0x128/0x470 [ 1625.130306][T14495] __kmalloc+0xa8/0x230 [ 1625.130334][T14495] security_inode_init_security+0x128/0x470 [ 1625.181020][T14495] ? ext4_init_security+0x40/0x40 [ 1625.186095][T14495] ? security_dentry_create_files_as+0xc0/0xc0 14:42:34 executing program 4: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) (async) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) [ 1625.192736][T14495] ? _raw_spin_unlock+0x28/0x40 [ 1625.197805][T14495] ? insert_inode_locked+0x3b7/0x410 [ 1625.203225][T14495] ? ext4_has_metadata_csum+0x136/0x1c0 [ 1625.208817][T14495] __ext4_new_inode+0x3482/0x4360 [ 1625.213917][T14495] ? ext4_has_group_desc_csum+0x1e0/0x1e0 [ 1625.219715][T14495] ext4_create+0x279/0x550 [ 1625.224187][T14495] ? ext4_lookup+0x750/0x750 [ 1625.228838][T14495] ? bpf_lsm_inode_create+0x9/0x10 [ 1625.233989][T14495] ? security_inode_create+0xb8/0x100 [ 1625.239399][T14495] ? ext4_lookup+0x750/0x750 14:42:34 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) read$ptp(r0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) read$ptp(r2, &(0x7f0000000000)=""/112, 0x70) [ 1625.244036][T14495] path_openat+0x13fa/0x3280 [ 1625.248728][T14495] ? do_filp_open+0x490/0x490 [ 1625.253465][T14495] do_filp_open+0x234/0x490 [ 1625.258019][T14495] ? vfs_tmpfile+0x500/0x500 [ 1625.262680][T14495] ? _raw_spin_unlock+0x28/0x40 [ 1625.267606][T14495] ? alloc_fd+0x59c/0x640 [ 1625.271987][T14495] do_sys_openat2+0x13e/0x1d0 [ 1625.276712][T14495] ? mutex_unlock+0x10/0x10 [ 1625.281263][T14495] ? do_sys_open+0x230/0x230 [ 1625.285917][T14495] __x64_sys_openat+0x247/0x290 14:42:34 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7}}, './file0\x00'}) (async) r1 = fspick(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1, {0x40}}, './file0\x00'}) [ 1625.290816][T14495] ? __ia32_sys_open+0x270/0x270 [ 1625.295809][T14495] ? syscall_enter_from_user_mode+0x32/0x230 [ 1625.301866][T14495] ? lockdep_hardirqs_on+0x98/0x140 [ 1625.307121][T14495] ? syscall_enter_from_user_mode+0x32/0x230 [ 1625.313188][T14495] do_syscall_64+0x44/0x110 [ 1625.317744][T14495] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1625.323686][T14495] RIP: 0033:0x7fad1fe7cae9 14:42:34 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r0, r1, 0x1000) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000240)={{0x1, 0x1, 0x18}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1625.328146][T14495] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1625.347803][T14495] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1625.356262][T14495] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1625.361076][T14510] fuse: Bad value for 'user_id' [ 1625.364333][T14495] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 1625.364353][T14495] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1625.364367][T14495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 14:42:34 executing program 3: statfs(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=""/64) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x20003, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xc00}}, {@allow_other}, {@default_permissions}, {@allow_other}, {@allow_other}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x1400}}]}}, 0x40, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="0000e8ffffffffff2d2f66696c653000"]) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r7, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000005c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r7, @ANYBLOB="000000001c000000000000696c653000"]) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000580)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) stat(&(0x7f0000000680)='./file0\x00', &(0x7f0000000380)) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r9, 0xc018937b, &(0x7f0000000600)={{0x1, 0x1, 0x18, r0, {r6, r8}}, './file0\x00'}) unlinkat(r10, &(0x7f0000000640)='./file0\x00', 0x0) syz_mount_image$fuse(&(0x7f00000002c0), &(0x7f0000000300)='./file0\x00', 0x4b098, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xa00}}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'rootmode'}}]}}, 0x1, 0x0, &(0x7f00000004c0)="538c9b521499a9e34496c1066d45bc1d2b33278b7f74a6698df161ac3eb956846df3900a0ae13178a3151218b63d1d20fbf17ebd57ced30045b6310bb2dfa36ab509fec36ed9dc72c52f9ef910d5364b3ff6110296edfcb27e68ef3ead8a9781d706c2be233712e74b11546b666c5803b1c2ca4dfdd69abdb5b914fb14fd2c9be46cf67ddf2ede03") statfs(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=""/64) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x20003, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xc00}}, {@allow_other}, {@default_permissions}, {@allow_other}, {@allow_other}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x1400}}]}}, 0x40, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="0000e8ffffffffff2d2f66696c653000"]) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r2, &(0x7f0000003880)) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r5, &(0x7f0000003880)) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r7, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000005c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r7, @ANYBLOB="000000001c000000000000696c653000"]) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000580)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) (async) stat(&(0x7f0000000680)='./file0\x00', &(0x7f0000000380)) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r9, 0xc018937b, &(0x7f0000000600)={{0x1, 0x1, 0x18, r0, {r6, r8}}, './file0\x00'}) (async) unlinkat(r10, &(0x7f0000000640)='./file0\x00', 0x0) (async) syz_mount_image$fuse(&(0x7f00000002c0), &(0x7f0000000300)='./file0\x00', 0x4b098, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xa00}}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'rootmode'}}]}}, 0x1, 0x0, &(0x7f00000004c0)="538c9b521499a9e34496c1066d45bc1d2b33278b7f74a6698df161ac3eb956846df3900a0ae13178a3151218b63d1d20fbf17ebd57ced30045b6310bb2dfa36ab509fec36ed9dc72c52f9ef910d5364b3ff6110296edfcb27e68ef3ead8a9781d706c2be233712e74b11546b666c5803b1c2ca4dfdd69abdb5b914fb14fd2c9be46cf67ddf2ede03") (async) [ 1625.364380][T14495] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1625.364410][T14495] [ 1625.379097][T14510] fuse: Bad value for 'fd' 14:42:34 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 12) 14:42:34 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r0, r1, 0x1000) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000240)={{0x1, 0x1, 0x18}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x1000) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x1000) (async) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r0, r1, 0x1000) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000240)={{0x1, 0x1, 0x18}, './file0\x00'}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:34 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[], [{@pcr={'pcr', 0x3d, 0x22}}, {@smackfshat={'smackfshat', 0x3d, '^'}}, {@uid_eq}, {@fsuuid={'fsuuid', 0x3d, {[0x62, 0x0, 0x39, 0x0, 0x30, 0x38, 0x36, 0x64], 0x2d, [0x36, 0x64, 0x30, 0x39], 0x2d, [0x30, 0x36, 0x30, 0x62], 0x2d, [0x61, 0x33, 0x65, 0x30], 0x2d, [0x64, 0x30, 0x31, 0x38, 0x63, 0x65, 0x31, 0x36]}}}, {@smackfsdef={'smackfsdef', 0x3d, 'rootmode'}}, {@permit_directio}, {@pcr={'pcr', 0x3d, 0x3b}}]}}, 0x0, 0x0, 0x0) [ 1625.469249][T14521] fuse: Bad value for 'user_id' [ 1625.518788][T14525] fuse: Bad value for 'user_id' [ 1625.518795][T14528] fuse: Bad value for 'fd' [ 1625.530467][T14527] FAULT_INJECTION: forcing a failure. [ 1625.530467][T14527] name failslab, interval 1, probability 0, space 0, times 0 [ 1625.550281][T14527] CPU: 1 PID: 14527 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1625.560423][T14527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1625.570511][T14527] Call Trace: [ 1625.573821][T14527] [ 1625.576782][T14527] dump_stack_lvl+0x1e7/0x2d0 [ 1625.581507][T14527] ? nf_tcp_handle_invalid+0x650/0x650 [ 1625.587113][T14527] ? panic+0x850/0x850 [ 1625.591242][T14527] should_fail_ex+0x3aa/0x4e0 [ 1625.596042][T14527] ? smack_inode_init_security+0x5ed/0x740 [ 1625.601904][T14527] should_failslab+0x9/0x20 [ 1625.606435][T14527] __kmem_cache_alloc_node+0x6d/0x300 [ 1625.611944][T14527] ? smack_inode_init_security+0x5ed/0x740 [ 1625.617785][T14527] __kmalloc_node_track_caller+0xa5/0x230 [ 1625.623567][T14527] kstrdup+0x3a/0x70 [ 1625.627480][T14527] smack_inode_init_security+0x5ed/0x740 [ 1625.633128][T14527] ? smack_inode_init_security+0x210/0x740 [ 1625.638944][T14527] security_inode_init_security+0x1a1/0x470 [ 1625.644839][T14527] ? ext4_init_security+0x40/0x40 [ 1625.649895][T14527] ? security_dentry_create_files_as+0xc0/0xc0 [ 1625.656875][T14527] ? _raw_spin_unlock+0x28/0x40 [ 1625.661853][T14527] ? insert_inode_locked+0x3b7/0x410 [ 1625.667238][T14527] ? ext4_has_metadata_csum+0x136/0x1c0 [ 1625.673842][T14527] __ext4_new_inode+0x3482/0x4360 [ 1625.678889][T14527] ? ext4_has_group_desc_csum+0x1e0/0x1e0 [ 1625.684627][T14527] ext4_create+0x279/0x550 [ 1625.689064][T14527] ? ext4_lookup+0x750/0x750 [ 1625.693840][T14527] ? bpf_lsm_inode_create+0x9/0x10 [ 1625.698950][T14527] ? security_inode_create+0xb8/0x100 [ 1625.704326][T14527] ? ext4_lookup+0x750/0x750 [ 1625.709106][T14527] path_openat+0x13fa/0x3280 [ 1625.713849][T14527] ? do_filp_open+0x490/0x490 [ 1625.718546][T14527] do_filp_open+0x234/0x490 [ 1625.723067][T14527] ? vfs_tmpfile+0x500/0x500 [ 1625.727717][T14527] ? _raw_spin_unlock+0x28/0x40 [ 1625.732581][T14527] ? alloc_fd+0x59c/0x640 [ 1625.736980][T14527] do_sys_openat2+0x13e/0x1d0 [ 1625.741658][T14527] ? mutex_unlock+0x10/0x10 [ 1625.746185][T14527] ? do_sys_open+0x230/0x230 [ 1625.750815][T14527] __x64_sys_openat+0x247/0x290 [ 1625.755682][T14527] ? __ia32_sys_open+0x270/0x270 [ 1625.760624][T14527] ? syscall_enter_from_user_mode+0x32/0x230 [ 1625.766605][T14527] ? lockdep_hardirqs_on+0x98/0x140 [ 1625.771812][T14527] ? syscall_enter_from_user_mode+0x32/0x230 [ 1625.777799][T14527] do_syscall_64+0x44/0x110 [ 1625.782318][T14527] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1625.788303][T14527] RIP: 0033:0x7fad1fe7cae9 [ 1625.792737][T14527] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1625.812389][T14527] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1625.820852][T14527] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1625.828853][T14527] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 1625.836849][T14527] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1625.844825][T14527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1625.852806][T14527] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1625.860794][T14527] [ 1625.864317][T14488] orangefs_mount: mount request failed with -4 14:42:35 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x200000, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:35 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r0, r1, 0x1000) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000240)={{0x1, 0x1, 0x18}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x1000) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x1000) (async) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r0, r1, 0x1000) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000240)={{0x1, 0x1, 0x18}, './file0\x00'}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:35 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) faccessat(r0, &(0x7f0000000100)='./file0/file0\x00', 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) openat(r1, &(0x7f0000000040)='./file0\x00', 0x201042, 0x52) 14:42:35 executing program 2: statfs(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000100)=""/110) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1010, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0/../file0\x00', &(0x7f00000001c0), 0x4000) 14:42:35 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 13) [ 1625.964597][T14541] fuse: Bad value for 'fd' [ 1626.003120][T14543] overlay: Unknown parameter '\' [ 1626.029753][T14545] FAULT_INJECTION: forcing a failure. [ 1626.029753][T14545] name failslab, interval 1, probability 0, space 0, times 0 [ 1626.042849][T14545] CPU: 1 PID: 14545 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1626.052955][T14545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1626.063074][T14545] Call Trace: [ 1626.066358][T14545] [ 1626.069332][T14545] dump_stack_lvl+0x1e7/0x2d0 [ 1626.074026][T14545] ? nf_tcp_handle_invalid+0x650/0x650 [ 1626.079488][T14545] ? panic+0x850/0x850 [ 1626.083579][T14545] ? __might_sleep+0xc0/0xc0 [ 1626.088189][T14545] should_fail_ex+0x3aa/0x4e0 [ 1626.092873][T14545] ? smk_fetch+0x92/0x140 [ 1626.097215][T14545] should_failslab+0x9/0x20 [ 1626.101751][T14545] __kmem_cache_alloc_node+0x6d/0x300 [ 1626.107154][T14545] ? smk_fetch+0x92/0x140 [ 1626.111506][T14545] kmalloc_trace+0x2a/0xe0 [ 1626.115960][T14545] smk_fetch+0x92/0x140 [ 1626.120165][T14545] smack_d_instantiate+0x74a/0xa50 [ 1626.125316][T14545] ? ext4_blocks_for_truncate+0x270/0x270 [ 1626.131072][T14545] ? smack_sem_semop+0x230/0x230 [ 1626.136251][T14545] security_d_instantiate+0x9b/0xf0 [ 1626.141503][T14545] d_instantiate_new+0x65/0x120 [ 1626.146672][T14545] ext4_add_nondir+0x21e/0x290 14:42:35 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) read$ptp(r0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) read$ptp(r2, &(0x7f0000000000)=""/112, 0x70) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) read$ptp(r0, 0x0, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) (async) read$ptp(r2, &(0x7f0000000000)=""/112, 0x70) (async) 14:42:35 executing program 2: statfs(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000100)=""/110) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1010, &(0x7f0000000300), 0x0, 0x0, 0x0) (async, rerun: 32) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async, rerun: 32) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0/../file0\x00', &(0x7f00000001c0), 0x4000) 14:42:35 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="e0bea1312e2f6669"], &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='afs\x00', 0x200000, &(0x7f00000004c0)='\x9ft\xb9$\x83`\xdd\xf8YC=\xb0\xfd\xf7\xea\"\xb8\xb5\x99\xbe\x0f\xa8\xe1\xc4-\x12u\xfb\x1b\x12\fL\xbdW6?\xa2\xa6i\xa7\x186\xf3>>S\xe6\x00\xe2R;>\xb8z\xbb\xb6\x06O\x16\xe1\x98\xb5z') r0 = openat$incfs(0xffffffffffffffff, &(0x7f00000001c0)='.log\x00', 0x80000, 0x32) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000740)='fuse\x00', &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mknodat$null(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x1, 0x103) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f00000007c0)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000800)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) r6 = syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000700)='./file0\x00', 0x5040, &(0x7f0000000540)=ANY=[@ANYBLOB="66643da7a2f2556ab9cfbf1f312caf78df7f09131affd860a56f0e39f6127c118423980343655263ef543697e3f61976e6cdd21c0cb741df71ae37ed40a386f1f28ba9df6b9d4153d56f0fa09f6fb634577c3212d206cbbcc0d99ab60d97098efb740bdb2c3bc908f2d0cdba57bdeec224b5fff6a5b67ed119d43adee368d8d5d2aa51b7501a517b6e430b481e222f6dcf19dfd6dc70406b846685c14afca3a6249d0ae0cf5c68727b20", @ANYRESDEC=r5, @ANYBLOB="2d726f6f746d6f64653d303091740178cde010aae62e303030303030303049303030303030313261c48833490a6f71794d1b4cb392178f9fbd7eedba67fb63bd6af44b9b84de44725818b3175d5702ed5e13095adc86e9b0ca9fc34e9e6c738a34382301cd839bfe7a3a4ff561e73e71a86e59d13cea1ef5ff1f5c713b08c27d22bd822961e503e796016bdb0fa188a51b1d04ff0700001794bc3f90f0", @ANYRES8=0x0, @ANYBLOB='\x00'/10, @ANYRESHEX=r1, @ANYRESDEC=r2], 0x1, 0x0, &(0x7f0000000300)="51ae0701ec175b82b0730298bf517107aad1ef5e7d17fb26353b2e7f30e71130a94a7623d04233d11f82ab9a9579850994d0e34a05ddf43aeb3e17f7b35c567aef91d215886626f7bceaec3486783bbb647771a39cdb6e2c3095d17b47218ca5ba31") fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000280)=']-\x00', &(0x7f00000002c0)='./file0\x00', r6) readlinkat(r6, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)=""/245, 0xf5) 14:42:35 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x200000, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x200000, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) 14:42:35 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) faccessat(r0, &(0x7f0000000100)='./file0/file0\x00', 0x1) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) openat(r1, &(0x7f0000000040)='./file0\x00', 0x201042, 0x52) 14:42:35 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="e0bea1312e2f6669"], &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='afs\x00', 0x200000, &(0x7f00000004c0)='\x9ft\xb9$\x83`\xdd\xf8YC=\xb0\xfd\xf7\xea\"\xb8\xb5\x99\xbe\x0f\xa8\xe1\xc4-\x12u\xfb\x1b\x12\fL\xbdW6?\xa2\xa6i\xa7\x186\xf3>>S\xe6\x00\xe2R;>\xb8z\xbb\xb6\x06O\x16\xe1\x98\xb5z') (async) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="e0bea1312e2f6669"], &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='afs\x00', 0x200000, &(0x7f00000004c0)='\x9ft\xb9$\x83`\xdd\xf8YC=\xb0\xfd\xf7\xea\"\xb8\xb5\x99\xbe\x0f\xa8\xe1\xc4-\x12u\xfb\x1b\x12\fL\xbdW6?\xa2\xa6i\xa7\x186\xf3>>S\xe6\x00\xe2R;>\xb8z\xbb\xb6\x06O\x16\xe1\x98\xb5z') openat$incfs(0xffffffffffffffff, &(0x7f00000001c0)='.log\x00', 0x80000, 0x32) (async) r0 = openat$incfs(0xffffffffffffffff, &(0x7f00000001c0)='.log\x00', 0x80000, 0x32) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000740)='fuse\x00', &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c) (async) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000740)='fuse\x00', &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mknodat$null(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x1, 0x103) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f00000007c0)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000800)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000800)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) r6 = syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000700)='./file0\x00', 0x5040, &(0x7f0000000540)=ANY=[@ANYBLOB="66643da7a2f2556ab9cfbf1f312caf78df7f09131affd860a56f0e39f6127c118423980343655263ef543697e3f61976e6cdd21c0cb741df71ae37ed40a386f1f28ba9df6b9d4153d56f0fa09f6fb634577c3212d206cbbcc0d99ab60d97098efb740bdb2c3bc908f2d0cdba57bdeec224b5fff6a5b67ed119d43adee368d8d5d2aa51b7501a517b6e430b481e222f6dcf19dfd6dc70406b846685c14afca3a6249d0ae0cf5c68727b20", @ANYRESDEC=r5, @ANYBLOB="2d726f6f746d6f64653d303091740178cde010aae62e303030303030303049303030303030313261c48833490a6f71794d1b4cb392178f9fbd7eedba67fb63bd6af44b9b84de44725818b3175d5702ed5e13095adc86e9b0ca9fc34e9e6c738a34382301cd839bfe7a3a4ff561e73e71a86e59d13cea1ef5ff1f5c713b08c27d22bd822961e503e796016bdb0fa188a51b1d04ff0700001794bc3f90f0", @ANYRES8=0x0, @ANYBLOB='\x00'/10, @ANYRESHEX=r1, @ANYRESDEC=r2], 0x1, 0x0, &(0x7f0000000300)="51ae0701ec175b82b0730298bf517107aad1ef5e7d17fb26353b2e7f30e71130a94a7623d04233d11f82ab9a9579850994d0e34a05ddf43aeb3e17f7b35c567aef91d215886626f7bceaec3486783bbb647771a39cdb6e2c3095d17b47218ca5ba31") fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000280)=']-\x00', &(0x7f00000002c0)='./file0\x00', r6) (async) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000280)=']-\x00', &(0x7f00000002c0)='./file0\x00', r6) readlinkat(r6, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)=""/245, 0xf5) [ 1626.151487][T14545] ext4_create+0x376/0x550 [ 1626.156036][T14545] ? ext4_lookup+0x750/0x750 [ 1626.160693][T14545] ? bpf_lsm_inode_create+0x9/0x10 [ 1626.165846][T14545] ? security_inode_create+0xb8/0x100 [ 1626.171273][T14545] ? ext4_lookup+0x750/0x750 [ 1626.175912][T14545] path_openat+0x13fa/0x3280 [ 1626.180584][T14545] ? do_filp_open+0x490/0x490 [ 1626.185332][T14545] do_filp_open+0x234/0x490 [ 1626.189888][T14545] ? vfs_tmpfile+0x500/0x500 [ 1626.194548][T14545] ? _raw_spin_unlock+0x28/0x40 [ 1626.199450][T14545] ? alloc_fd+0x59c/0x640 [ 1626.204181][T14545] do_sys_openat2+0x13e/0x1d0 [ 1626.208902][T14545] ? mutex_unlock+0x10/0x10 [ 1626.213455][T14545] ? do_sys_open+0x230/0x230 [ 1626.218096][T14545] __x64_sys_openat+0x247/0x290 [ 1626.222991][T14545] ? __ia32_sys_open+0x270/0x270 [ 1626.227981][T14545] ? syscall_enter_from_user_mode+0x32/0x230 [ 1626.234004][T14545] ? lockdep_hardirqs_on+0x98/0x140 [ 1626.239254][T14545] ? syscall_enter_from_user_mode+0x32/0x230 [ 1626.245283][T14545] do_syscall_64+0x44/0x110 14:42:35 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) (async, rerun: 64) mount(&(0x7f0000000500)=ANY=[@ANYBLOB="e0bea1312e2f6669"], &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='afs\x00', 0x200000, &(0x7f00000004c0)='\x9ft\xb9$\x83`\xdd\xf8YC=\xb0\xfd\xf7\xea\"\xb8\xb5\x99\xbe\x0f\xa8\xe1\xc4-\x12u\xfb\x1b\x12\fL\xbdW6?\xa2\xa6i\xa7\x186\xf3>>S\xe6\x00\xe2R;>\xb8z\xbb\xb6\x06O\x16\xe1\x98\xb5z') (async, rerun: 64) r0 = openat$incfs(0xffffffffffffffff, &(0x7f00000001c0)='.log\x00', 0x80000, 0x32) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000740)='fuse\x00', &(0x7f0000000780)='./file0\x00', 0xffffffffffffff9c) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async, rerun: 64) mknodat$null(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x1, 0x103) (rerun: 64) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f00000007c0)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000000800)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) (async) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) (async) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) r6 = syz_mount_image$fuse(&(0x7f0000000180), &(0x7f0000000700)='./file0\x00', 0x5040, &(0x7f0000000540)=ANY=[@ANYBLOB="66643da7a2f2556ab9cfbf1f312caf78df7f09131affd860a56f0e39f6127c118423980343655263ef543697e3f61976e6cdd21c0cb741df71ae37ed40a386f1f28ba9df6b9d4153d56f0fa09f6fb634577c3212d206cbbcc0d99ab60d97098efb740bdb2c3bc908f2d0cdba57bdeec224b5fff6a5b67ed119d43adee368d8d5d2aa51b7501a517b6e430b481e222f6dcf19dfd6dc70406b846685c14afca3a6249d0ae0cf5c68727b20", @ANYRESDEC=r5, @ANYBLOB="2d726f6f746d6f64653d303091740178cde010aae62e303030303030303049303030303030313261c48833490a6f71794d1b4cb392178f9fbd7eedba67fb63bd6af44b9b84de44725818b3175d5702ed5e13095adc86e9b0ca9fc34e9e6c738a34382301cd839bfe7a3a4ff561e73e71a86e59d13cea1ef5ff1f5c713b08c27d22bd822961e503e796016bdb0fa188a51b1d04ff0700001794bc3f90f0", @ANYRES8=0x0, @ANYBLOB='\x00'/10, @ANYRESHEX=r1, @ANYRESDEC=r2], 0x1, 0x0, &(0x7f0000000300)="51ae0701ec175b82b0730298bf517107aad1ef5e7d17fb26353b2e7f30e71130a94a7623d04233d11f82ab9a9579850994d0e34a05ddf43aeb3e17f7b35c567aef91d215886626f7bceaec3486783bbb647771a39cdb6e2c3095d17b47218ca5ba31") fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000280)=']-\x00', &(0x7f00000002c0)='./file0\x00', r6) (async) readlinkat(r6, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)=""/245, 0xf5) [ 1626.249823][T14545] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1626.255767][T14545] RIP: 0033:0x7fad1fe7cae9 [ 1626.260216][T14545] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1626.279866][T14545] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1626.288337][T14545] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1626.296370][T14545] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c 14:42:35 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) faccessat(r0, &(0x7f0000000100)='./file0/file0\x00', 0x1) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) openat(r1, &(0x7f0000000040)='./file0\x00', 0x201042, 0x52) [ 1626.304554][T14545] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1626.312562][T14545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1626.320565][T14545] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1626.328598][T14545] [ 1626.341281][T14564] fuse: Bad value for 'fd' 14:42:35 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) read$ptp(r0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) (async) read$ptp(r2, &(0x7f0000000000)=""/112, 0x70) 14:42:35 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYRES32, @ANYBLOB="08000000000000002e2f666904653000f35afeb0182768dafac059855a8dc1241561e58bc37f8e684867ef38d201dc7451f33c5c991e6f5c553e88f8d529abf1aff574fbfe805b01048ca9561b49b150761e208ce41e615f56f344bc409dcd"]) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1626.381614][T14565] overlay: Unknown parameter '\' 14:42:35 executing program 2: statfs(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000100)=""/110) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1010, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) newfstatat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0/../file0\x00', &(0x7f00000001c0), 0x4000) [ 1626.402238][T14565] overlay: Unknown parameter '\' [ 1626.411539][T14571] fuse: Bad value for 'fd' 14:42:35 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 14) 14:42:35 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYRES32, @ANYBLOB="08000000000000002e2f666904653000f35afeb0182768dafac059855a8dc1241561e58bc37f8e684867ef38d201dc7451f33c5c991e6f5c553e88f8d529abf1aff574fbfe805b01048ca9561b49b150761e208ce41e615f56f344bc409dcd"]) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:35 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000140)='./file0/file0\x00', 0x1400) 14:42:35 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 32) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x200000, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (rerun: 32) 14:42:35 executing program 2: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000040), 0x115e03, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/module/vub300', 0x0, 0x1c1) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) fcntl$getownex(r1, 0x10, &(0x7f0000000180)) [ 1626.537175][T14583] fuse: Bad value for 'fd' 14:42:35 executing program 0: lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYRES32, @ANYBLOB="08000000000000002e2f666904653000f35afeb0182768dafac059855a8dc1241561e58bc37f8e684867ef38d201dc7451f33c5c991e6f5c553e88f8d529abf1aff574fbfe805b01048ca9561b49b150761e208ce41e615f56f344bc409dcd"]) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) lchown(&(0x7f00000000c0)='./file0\x00', 0xee00, 0xee00) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYRES32, @ANYBLOB="08000000000000002e2f666904653000f35afeb0182768dafac059855a8dc1241561e58bc37f8e684867ef38d201dc7451f33c5c991e6f5c553e88f8d529abf1aff574fbfe805b01048ca9561b49b150761e208ce41e615f56f344bc409dcd"]) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:35 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000140)='./file0/file0\x00', 0x1400) [ 1626.562963][T14590] overlay: Unknown parameter '\' [ 1626.583634][T14590] overlay: Unknown parameter '\' [ 1626.591548][T14591] fuse: Bad value for 'fd' [ 1626.599887][T14590] overlay: Unknown parameter '\' 14:42:35 executing program 2: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000040), 0x115e03, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) (async) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/module/vub300', 0x0, 0x1c1) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) fcntl$getownex(r1, 0x10, &(0x7f0000000180)) 14:42:35 executing program 0: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000140)='./file0/file0\x00', 0x1400) [ 1626.628323][T14590] overlay: Unknown parameter '\' [ 1626.637523][T14595] fuse: Bad value for 'fd' [ 1626.645867][T14590] overlay: Unknown parameter '\' [ 1626.658181][T14599] FAULT_INJECTION: forcing a failure. [ 1626.658181][T14599] name failslab, interval 1, probability 0, space 0, times 0 [ 1626.675921][T14590] overlay: Unknown parameter '\' [ 1626.693248][T14599] CPU: 1 PID: 14599 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1626.703385][T14599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1626.709645][T14601] fuse: Bad value for 'fd' [ 1626.713448][T14599] Call Trace: [ 1626.713460][T14599] [ 1626.713469][T14599] dump_stack_lvl+0x1e7/0x2d0 [ 1626.713500][T14599] ? nf_tcp_handle_invalid+0x650/0x650 [ 1626.733233][T14605] fuse: Bad value for 'fd' [ 1626.734259][T14599] ? panic+0x850/0x850 [ 1626.734296][T14599] ? __might_sleep+0xc0/0xc0 [ 1626.747428][T14599] ? __up_read+0x2bd/0x690 [ 1626.751893][T14599] should_fail_ex+0x3aa/0x4e0 [ 1626.756621][T14599] ? smk_import_entry+0x18d/0x610 [ 1626.762121][T14599] should_failslab+0x9/0x20 [ 1626.766672][T14599] __kmem_cache_alloc_node+0x6d/0x300 [ 1626.772093][T14599] ? smk_import_entry+0x18d/0x610 [ 1626.777161][T14599] __kmalloc_node_track_caller+0xa5/0x230 [ 1626.782932][T14599] kstrndup+0x41/0xb0 [ 1626.786972][T14599] smk_import_entry+0x18d/0x610 [ 1626.791827][T14599] ? smk_fetch+0xd3/0x140 [ 1626.796172][T14599] smk_fetch+0xdd/0x140 [ 1626.800327][T14599] smack_d_instantiate+0x74a/0xa50 [ 1626.805441][T14599] ? ext4_blocks_for_truncate+0x270/0x270 [ 1626.811170][T14599] ? smack_sem_semop+0x230/0x230 [ 1626.816119][T14599] security_d_instantiate+0x9b/0xf0 [ 1626.821335][T14599] d_instantiate_new+0x65/0x120 [ 1626.826207][T14599] ext4_add_nondir+0x21e/0x290 [ 1626.830988][T14599] ext4_create+0x376/0x550 [ 1626.835419][T14599] ? ext4_lookup+0x750/0x750 [ 1626.840007][T14599] ? bpf_lsm_inode_create+0x9/0x10 [ 1626.845126][T14599] ? security_inode_create+0xb8/0x100 [ 1626.850502][T14599] ? ext4_lookup+0x750/0x750 [ 1626.855121][T14599] path_openat+0x13fa/0x3280 [ 1626.859764][T14599] ? do_filp_open+0x490/0x490 [ 1626.864470][T14599] do_filp_open+0x234/0x490 [ 1626.869000][T14599] ? vfs_tmpfile+0x500/0x500 [ 1626.873597][T14599] ? _raw_spin_unlock+0x28/0x40 [ 1626.878448][T14599] ? alloc_fd+0x59c/0x640 [ 1626.882777][T14599] do_sys_openat2+0x13e/0x1d0 [ 1626.887465][T14599] ? mutex_unlock+0x10/0x10 [ 1626.891979][T14599] ? do_sys_open+0x230/0x230 [ 1626.896602][T14599] __x64_sys_openat+0x247/0x290 [ 1626.901681][T14599] ? __ia32_sys_open+0x270/0x270 [ 1626.906630][T14599] ? syscall_enter_from_user_mode+0x32/0x230 [ 1626.912635][T14599] ? lockdep_hardirqs_on+0x98/0x140 [ 1626.917953][T14599] ? syscall_enter_from_user_mode+0x32/0x230 [ 1626.923938][T14599] do_syscall_64+0x44/0x110 [ 1626.928447][T14599] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1626.934343][T14599] RIP: 0033:0x7fad1fe7cae9 [ 1626.938752][T14599] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1626.958362][T14599] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1626.966771][T14599] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1626.974743][T14599] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 1626.982709][T14599] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1626.990674][T14599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1626.998647][T14599] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1627.006631][T14599] [ 1627.013722][T14590] overlay: Unknown parameter '\' [ 1627.028093][T14590] overlay: Unknown parameter '\' [ 1627.034145][T14590] overlay: Unknown parameter '\' [ 1627.048211][T14590] overlay: Unknown parameter '\' [ 1627.055836][T14590] overlay: Unknown parameter '\' [ 1627.061438][T14590] overlay: Unknown parameter '\' [ 1627.068336][T14590] overlay: Unknown parameter '\' [ 1627.074040][T14590] overlay: Unknown parameter '\' [ 1627.079793][T14590] overlay: Unknown parameter '\' [ 1627.085145][T14590] overlay: Unknown parameter '\' [ 1627.090732][T14590] overlay: Unknown parameter '\' [ 1627.097140][T14590] overlay: Unknown parameter '\' [ 1627.102447][T14590] overlay: Unknown parameter '\' [ 1627.108125][T14590] overlay: Unknown parameter '\' [ 1627.113470][T14590] overlay: Unknown parameter '\' [ 1627.119688][T14590] overlay: Unknown parameter '\' [ 1627.125074][T14590] overlay: Unknown parameter '\' [ 1627.134009][T14590] overlay: Unknown parameter '\' [ 1627.140280][T14590] overlay: Unknown parameter '\' [ 1627.146085][T14590] overlay: Unknown parameter '\' [ 1627.151405][T14590] overlay: Unknown parameter '\' [ 1627.158488][T14590] overlay: Unknown parameter '\' [ 1627.163942][T14590] overlay: Unknown parameter '\' [ 1627.169707][T14590] overlay: Unknown parameter '\' [ 1627.175116][T14590] overlay: Unknown parameter '\' [ 1627.180761][T14590] overlay: Unknown parameter '\' [ 1627.186199][T14590] overlay: Unknown parameter '\' 14:42:36 executing program 2: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000040), 0x115e03, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/module/vub300', 0x0, 0x1c1) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) fcntl$getownex(r1, 0x10, &(0x7f0000000180)) 14:42:36 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000140)='./file0/file0\x00', 0x1400) 14:42:36 executing program 0: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) faccessat(r0, &(0x7f0000000100)='./file0/file0\x00', 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) openat(r1, &(0x7f0000000040)='./file0\x00', 0x201042, 0x52) 14:42:36 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 15) 14:42:36 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES16=r0, @ANYRESHEX=r0, @ANYRES16=r0, @ANYRES16=r1, @ANYRES8=r0, @ANYRES32=r2, @ANYRESOCT=r2]) 14:42:36 executing program 4: openat$random(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) read$ptp(0xffffffffffffffff, 0x0, 0x0) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000040)='-\x00', 0x0, r0) [ 1627.335836][T14608] FAULT_INJECTION: forcing a failure. [ 1627.335836][T14608] name failslab, interval 1, probability 0, space 0, times 0 [ 1627.357231][T14613] fuse: Bad value for 'fd' [ 1627.375032][T14612] fuse: Bad value for 'fd' [ 1627.391049][T14615] overlay: Unknown parameter 'ÿÿ0xffffffffffffffffÿÿ' [ 1627.401120][T14614] fuse: Bad value for 'fd' [ 1627.405864][T14608] CPU: 1 PID: 14608 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1627.415972][T14608] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1627.426058][T14608] Call Trace: [ 1627.429367][T14608] [ 1627.432330][T14608] dump_stack_lvl+0x1e7/0x2d0 14:42:36 executing program 0: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:36 executing program 4: openat$random(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) read$ptp(0xffffffffffffffff, 0x0, 0x0) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000040)='-\x00', 0x0, r0) openat$random(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) (async) read$ptp(0xffffffffffffffff, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000040)='-\x00', 0x0, r0) (async) 14:42:36 executing program 3: lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="823c612f40c617cc450a", @ANYRESDEC=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) mount$pvfs2(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8, &(0x7f0000000240)={[{'*,[--:(@\xf9{.'}], [{@fowner_gt={'fowner>', r2}}, {@appraise_type}]}) [ 1627.437051][T14608] ? nf_tcp_handle_invalid+0x650/0x650 [ 1627.442552][T14608] ? panic+0x850/0x850 [ 1627.446670][T14608] ? __might_sleep+0xc0/0xc0 [ 1627.451319][T14608] should_fail_ex+0x3aa/0x4e0 [ 1627.456038][T14608] ? smk_fetch+0x92/0x140 [ 1627.460411][T14608] should_failslab+0x9/0x20 [ 1627.465047][T14608] __kmem_cache_alloc_node+0x6d/0x300 [ 1627.470487][T14608] ? smk_fetch+0x92/0x140 [ 1627.474850][T14608] kmalloc_trace+0x2a/0xe0 [ 1627.479323][T14608] smk_fetch+0x92/0x140 [ 1627.483613][T14608] smack_d_instantiate+0x841/0xa50 14:42:36 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6665dc", @ANYRESHEX, @ANYBLOB="2c726f6f818011f60fc6af7d94746d6f64653d3030303030303030303030303030303030302c753065725f69643dd99aeaab9767b0d2470ddc", @ANYRESDEC=0x0, @ANYBLOB='d=\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=0x0, @ANYBLOB="0400"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1627.488772][T14608] ? ext4_blocks_for_truncate+0x270/0x270 [ 1627.494532][T14608] ? smack_sem_semop+0x230/0x230 [ 1627.499540][T14608] security_d_instantiate+0x9b/0xf0 [ 1627.504871][T14608] d_instantiate_new+0x65/0x120 [ 1627.509794][T14608] ext4_add_nondir+0x21e/0x290 [ 1627.514610][T14608] ext4_create+0x376/0x550 [ 1627.519079][T14608] ? ext4_lookup+0x750/0x750 [ 1627.523731][T14608] ? bpf_lsm_inode_create+0x9/0x10 [ 1627.528883][T14608] ? security_inode_create+0xb8/0x100 [ 1627.534310][T14608] ? ext4_lookup+0x750/0x750 [ 1627.538950][T14608] path_openat+0x13fa/0x3280 [ 1627.543628][T14608] ? do_filp_open+0x490/0x490 [ 1627.543688][T14623] fuse: Bad value for 'fd' [ 1627.548338][T14608] do_filp_open+0x234/0x490 [ 1627.548378][T14608] ? vfs_tmpfile+0x500/0x500 [ 1627.548426][T14608] ? _raw_spin_unlock+0x28/0x40 [ 1627.562735][T14623] fuse: Bad value for 'user_id' [ 1627.566772][T14608] ? alloc_fd+0x59c/0x640 [ 1627.566816][T14608] do_sys_openat2+0x13e/0x1d0 [ 1627.566840][T14608] ? mutex_unlock+0x10/0x10 [ 1627.566861][T14608] ? do_sys_open+0x230/0x230 [ 1627.566898][T14608] __x64_sys_openat+0x247/0x290 [ 1627.566919][T14608] ? __ia32_sys_open+0x270/0x270 [ 1627.566942][T14608] ? syscall_enter_from_user_mode+0x32/0x230 [ 1627.566969][T14608] ? lockdep_hardirqs_on+0x98/0x140 [ 1627.566993][T14608] ? syscall_enter_from_user_mode+0x32/0x230 [ 1627.567020][T14608] do_syscall_64+0x44/0x110 [ 1627.567040][T14608] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1627.567064][T14608] RIP: 0033:0x7fad1fe7cae9 14:42:36 executing program 0: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) [ 1627.567082][T14608] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1627.567099][T14608] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1627.567141][T14608] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1627.567156][T14608] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 1627.567170][T14608] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 14:42:36 executing program 4: openat$random(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) read$ptp(0xffffffffffffffff, 0x0, 0x0) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000040)='-\x00', 0x0, r0) openat$random(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) (async) read$ptp(0xffffffffffffffff, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000040)='-\x00', 0x0, r0) (async) 14:42:36 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES16=r0, @ANYRESHEX=r0, @ANYRES16=r0, @ANYRES16=r1, @ANYRES8=r0, @ANYRES32=r2, @ANYRESOCT=r2]) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r1, &(0x7f0000003880)) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES16=r0, @ANYRESHEX=r0, @ANYRES16=r0, @ANYRES16=r1, @ANYRES8=r0, @ANYRES32=r2, @ANYRESOCT=r2]) (async) [ 1627.567184][T14608] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1627.567197][T14608] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1627.567228][T14608] [ 1627.570852][T14625] fuse: Unknown parameter 'feÜ0xffffffffffffffff' 14:42:36 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 16) 14:42:36 executing program 0: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:36 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {r3}}, './file0\x00'}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) read$ptp(r4, 0x0, 0x44) 14:42:36 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES16=r0, @ANYRESHEX=r0, @ANYRES16=r0, @ANYRES16=r1, @ANYRES8=r0, @ANYRES32=r2, @ANYRESOCT=r2]) [ 1627.764030][T14636] overlay: Unknown parameter 'ÿÿ0xffffffffffffffffÿÿ' [ 1627.777067][T14636] overlay: Unknown parameter 'ÿÿ0xffffffffffffffffÿÿ' 14:42:36 executing program 0: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, 0x0, 0x0) 14:42:36 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6665dc", @ANYRESHEX, @ANYBLOB="2c726f6f818011f60fc6af7d94746d6f64653d3030303030303030303030303030303030302c753065725f69643dd99aeaab9767b0d2470ddc", @ANYRESDEC=0x0, @ANYBLOB='d=\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=0x0, @ANYBLOB="0400"], 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6665dc", @ANYRESHEX, @ANYBLOB="2c726f6f818011f60fc6af7d94746d6f64653d3030303030303030303030303030303030302c753065725f69643dd99aeaab9767b0d2470ddc", @ANYRESDEC=0x0, @ANYBLOB='d=\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=0x0, @ANYBLOB="0400"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1627.869721][T14647] FAULT_INJECTION: forcing a failure. [ 1627.869721][T14647] name failslab, interval 1, probability 0, space 0, times 0 [ 1627.885844][T14647] CPU: 1 PID: 14647 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1627.895980][T14647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1627.906071][T14647] Call Trace: [ 1627.909389][T14647] [ 1627.912353][T14647] dump_stack_lvl+0x1e7/0x2d0 [ 1627.917076][T14647] ? nf_tcp_handle_invalid+0x650/0x650 [ 1627.922574][T14647] ? panic+0x850/0x850 [ 1627.926684][T14647] ? __might_sleep+0xc0/0xc0 [ 1627.931324][T14647] should_fail_ex+0x3aa/0x4e0 [ 1627.936143][T14647] ? smk_fetch+0x92/0x140 [ 1627.940515][T14647] should_failslab+0x9/0x20 [ 1627.945061][T14647] __kmem_cache_alloc_node+0x6d/0x300 [ 1627.950479][T14647] ? smk_fetch+0x92/0x140 [ 1627.954821][T14647] kmalloc_trace+0x2a/0xe0 [ 1627.959243][T14647] smk_fetch+0x92/0x140 [ 1627.963402][T14647] smack_d_instantiate+0x8b0/0xa50 [ 1627.968523][T14647] ? ext4_blocks_for_truncate+0x270/0x270 [ 1627.974254][T14647] ? smack_sem_semop+0x230/0x230 [ 1627.979211][T14647] security_d_instantiate+0x9b/0xf0 [ 1627.984424][T14647] d_instantiate_new+0x65/0x120 [ 1627.989288][T14647] ext4_add_nondir+0x21e/0x290 [ 1627.994071][T14647] ext4_create+0x376/0x550 [ 1627.998503][T14647] ? ext4_lookup+0x750/0x750 [ 1628.003106][T14647] ? bpf_lsm_inode_create+0x9/0x10 [ 1628.008312][T14647] ? security_inode_create+0xb8/0x100 [ 1628.013688][T14647] ? ext4_lookup+0x750/0x750 [ 1628.018281][T14647] path_openat+0x13fa/0x3280 [ 1628.022902][T14647] ? do_filp_open+0x490/0x490 [ 1628.027606][T14647] do_filp_open+0x234/0x490 [ 1628.032121][T14647] ? vfs_tmpfile+0x500/0x500 [ 1628.036736][T14647] ? _raw_spin_unlock+0x28/0x40 [ 1628.041595][T14647] ? alloc_fd+0x59c/0x640 [ 1628.045969][T14647] do_sys_openat2+0x13e/0x1d0 [ 1628.050650][T14647] ? mutex_unlock+0x10/0x10 [ 1628.055154][T14647] ? do_sys_open+0x230/0x230 [ 1628.059757][T14647] __x64_sys_openat+0x247/0x290 [ 1628.064611][T14647] ? __ia32_sys_open+0x270/0x270 [ 1628.069554][T14647] ? syscall_enter_from_user_mode+0x32/0x230 [ 1628.075536][T14647] ? lockdep_hardirqs_on+0x98/0x140 [ 1628.080740][T14647] ? syscall_enter_from_user_mode+0x32/0x230 [ 1628.086815][T14647] do_syscall_64+0x44/0x110 [ 1628.091324][T14647] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1628.097234][T14647] RIP: 0033:0x7fad1fe7cae9 [ 1628.101648][T14647] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1628.121257][T14647] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1628.129680][T14647] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1628.137653][T14647] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 1628.145628][T14647] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1628.153601][T14647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1628.161660][T14647] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 14:42:37 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {r3}}, './file0\x00'}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async, rerun: 64) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (rerun: 64) read$ptp(r4, 0x0, 0x44) [ 1628.169649][T14647] [ 1628.175498][T14649] overlay: Unknown parameter 'ÿÿ0xffffffffffffffffÿÿ' [ 1628.199191][T14654] fuse: Unknown parameter 'feÜ0xffffffffffffffff' [ 1628.205596][T14656] fuse: Unknown parameter 'feÜ0xffffffffffffffff' 14:42:37 executing program 3: lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="823c612f40c617cc450a", @ANYRESDEC=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async, rerun: 32) mount$pvfs2(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8, &(0x7f0000000240)={[{'*,[--:(@\xf9{.'}], [{@fowner_gt={'fowner>', r2}}, {@appraise_type}]}) (rerun: 32) 14:42:37 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6665dc", @ANYRESHEX, @ANYBLOB="2c726f6f818011f60fc6af7d94746d6f64653d3030303030303030303030303030303030302c753065725f69643dd99aeaab9767b0d2470ddc", @ANYRESDEC=0x0, @ANYBLOB='d=\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=0x0, @ANYBLOB="0400"], 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6665dc", @ANYRESHEX, @ANYBLOB="2c726f6f818011f60fc6af7d94746d6f64653d3030303030303030303030303030303030302c753065725f69643dd99aeaab9767b0d2470ddc", @ANYRESDEC=0x0, @ANYBLOB='d=\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=0x0, @ANYBLOB="0400"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:37 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 17) 14:42:37 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) 14:42:37 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {r3}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {r3}}, './file0\x00'}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) read$ptp(r4, 0x0, 0x44) (async) read$ptp(r4, 0x0, 0x44) [ 1628.361839][T14623] orangefs_mount: mount request failed with -4 [ 1628.394429][T14661] FAULT_INJECTION: forcing a failure. [ 1628.394429][T14661] name failslab, interval 1, probability 0, space 0, times 0 [ 1628.421191][T14661] CPU: 0 PID: 14661 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1628.431332][T14661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1628.441420][T14661] Call Trace: [ 1628.444732][T14661] [ 1628.447706][T14661] dump_stack_lvl+0x1e7/0x2d0 [ 1628.452428][T14661] ? nf_tcp_handle_invalid+0x650/0x650 [ 1628.457926][T14661] ? panic+0x850/0x850 [ 1628.462056][T14661] should_fail_ex+0x3aa/0x4e0 [ 1628.466782][T14661] ? tomoyo_realpath_from_path+0xcf/0x5e0 [ 1628.472555][T14661] should_failslab+0x9/0x20 [ 1628.474835][T14671] fuse: Bad value for 'fd' [ 1628.477112][T14661] __kmem_cache_alloc_node+0x6d/0x300 [ 1628.477158][T14661] ? tomoyo_realpath_from_path+0xcf/0x5e0 [ 1628.477184][T14661] __kmalloc+0xa8/0x230 [ 1628.477209][T14661] ? rcu_is_watching+0x15/0xb0 [ 1628.477237][T14661] tomoyo_realpath_from_path+0xcf/0x5e0 [ 1628.477269][T14661] tomoyo_check_open_permission+0x255/0x500 [ 1628.477295][T14661] ? tomoyo_check_open_permission+0x204/0x500 [ 1628.477318][T14661] ? tomoyo_check_path_number_acl+0x280/0x280 [ 1628.499839][T14672] fuse: Bad value for 'user_id' [ 1628.501874][T14661] ? mnt_get_write_access+0x68/0x2a0 [ 1628.512955][T14672] fuse: Bad value for 'user_id' [ 1628.513302][T14661] ? mnt_get_write_access+0x68/0x2a0 [ 1628.531557][T14672] fuse: Bad value for 'user_id' [ 1628.535630][T14661] ? tomoyo_file_open+0xea/0x170 [ 1628.535666][T14661] security_file_open+0x63/0xa0 [ 1628.535692][T14661] do_dentry_open+0x327/0x1590 [ 1628.535727][T14661] path_openat+0x2845/0x3280 14:42:37 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) r6 = openat$incfs(r4, &(0x7f0000000140)='.pending_reads\x00', 0x2, 0x0) fstat(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r6, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0xee01, r7}}, './file0\x00'}) r8 = fsmount(r2, 0x0, 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r8, {0x7}}, './file0\x00'}) linkat(r1, &(0x7f0000000040)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00', 0x9e7c620f3d2b1c4d) [ 1628.535781][T14661] ? do_filp_open+0x490/0x490 [ 1628.535824][T14661] do_filp_open+0x234/0x490 [ 1628.544640][T14672] fuse: Bad value for 'user_id' [ 1628.545931][T14661] ? vfs_tmpfile+0x500/0x500 [ 1628.545989][T14661] ? _raw_spin_unlock+0x28/0x40 [ 1628.546014][T14661] ? alloc_fd+0x59c/0x640 [ 1628.546045][T14661] do_sys_openat2+0x13e/0x1d0 [ 1628.546065][T14661] ? mutex_unlock+0x10/0x10 [ 1628.546086][T14661] ? do_sys_open+0x230/0x230 [ 1628.546121][T14661] __x64_sys_openat+0x247/0x290 [ 1628.546144][T14661] ? __ia32_sys_open+0x270/0x270 [ 1628.546165][T14661] ? syscall_enter_from_user_mode+0x32/0x230 [ 1628.557608][T14672] fuse: Bad value for 'user_id' [ 1628.560780][T14661] ? lockdep_hardirqs_on+0x98/0x140 [ 1628.560814][T14661] ? syscall_enter_from_user_mode+0x32/0x230 [ 1628.560842][T14661] do_syscall_64+0x44/0x110 [ 1628.560864][T14661] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1628.572559][T14672] fuse: Bad value for 'user_id' [ 1628.574854][T14661] RIP: 0033:0x7fad1fe7cae9 [ 1628.574878][T14661] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1628.574895][T14661] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1628.574918][T14661] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1628.574933][T14661] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 1628.582147][T14672] fuse: Bad value for 'user_id' 14:42:37 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 18) 14:42:37 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) unlinkat(r0, &(0x7f0000000040)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:37 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async, rerun: 64) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (rerun: 64) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) [ 1628.584274][T14661] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1628.584293][T14661] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1628.584306][T14661] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1628.584338][T14661] [ 1628.588959][T14665] fuse: Unknown parameter 'feÜ0xffffffffffffffff' [ 1628.591725][T14666] overlay: Unknown parameter '\' [ 1628.595837][T14674] fuse: Unknown parameter 'feÜ0xffffffffffffffff' [ 1628.626718][T14661] ERROR: Out of memory at tomoyo_realpath_from_path. 14:42:37 executing program 0: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, 0x0, 0x0) [ 1628.659530][T14672] fuse: Bad value for 'user_id' [ 1628.781588][T14672] fuse: Bad value for 'user_id' [ 1628.815027][T14672] fuse: Bad value for 'user_id' [ 1628.828900][T14672] fuse: Bad value for 'user_id' [ 1628.834029][T14689] FAULT_INJECTION: forcing a failure. [ 1628.834029][T14689] name failslab, interval 1, probability 0, space 0, times 0 [ 1628.836733][T14691] fuse: Bad value for 'fd' [ 1628.847658][T14685] overlay: Unknown parameter '\' [ 1628.851839][T14672] fuse: Bad value for 'user_id' [ 1628.861827][T14672] fuse: Bad value for 'user_id' [ 1628.864259][T14689] CPU: 0 PID: 14689 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1628.873548][T14672] fuse: Bad value for 'user_id' [ 1628.876758][T14689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1628.876774][T14689] Call Trace: [ 1628.876783][T14689] [ 1628.876792][T14689] dump_stack_lvl+0x1e7/0x2d0 [ 1628.876821][T14689] ? nf_tcp_handle_invalid+0x650/0x650 [ 1628.876842][T14689] ? panic+0x850/0x850 14:42:38 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) unlinkat(r0, &(0x7f0000000040)='./file0\x00', 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1628.876866][T14689] ? __might_sleep+0xc0/0xc0 [ 1628.876886][T14689] ? prepend_path+0xa10/0xbe0 [ 1628.876910][T14689] should_fail_ex+0x3aa/0x4e0 [ 1628.876937][T14689] ? tomoyo_encode+0x26f/0x530 [ 1628.891902][T14672] fuse: Bad value for 'user_id' [ 1628.895134][T14689] should_failslab+0x9/0x20 [ 1628.895167][T14689] __kmem_cache_alloc_node+0x6d/0x300 [ 1628.895191][T14689] ? d_absolute_path+0x1c6/0x300 [ 1628.895212][T14689] ? tomoyo_encode+0x26f/0x530 [ 1628.895235][T14689] __kmalloc+0xa8/0x230 [ 1628.895260][T14689] tomoyo_encode+0x26f/0x530 [ 1628.895287][T14689] tomoyo_realpath_from_path+0x598/0x5e0 [ 1628.895320][T14689] tomoyo_check_open_permission+0x255/0x500 [ 1628.895346][T14689] ? tomoyo_check_open_permission+0x204/0x500 [ 1628.895370][T14689] ? tomoyo_check_path_number_acl+0x280/0x280 [ 1628.895430][T14689] ? mnt_get_write_access+0x68/0x2a0 [ 1628.895453][T14689] ? mnt_get_write_access+0x68/0x2a0 [ 1628.895483][T14689] ? tomoyo_file_open+0xea/0x170 [ 1628.895509][T14689] security_file_open+0x63/0xa0 14:42:38 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async, rerun: 64) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) unlinkat(r0, &(0x7f0000000040)='./file0\x00', 0x0) (async, rerun: 32) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (rerun: 32) [ 1628.895536][T14689] do_dentry_open+0x327/0x1590 [ 1628.895575][T14689] path_openat+0x2845/0x3280 [ 1628.895633][T14689] ? do_filp_open+0x490/0x490 [ 1628.895679][T14689] do_filp_open+0x234/0x490 [ 1628.895708][T14689] ? vfs_tmpfile+0x500/0x500 [ 1628.895757][T14689] ? _raw_spin_unlock+0x28/0x40 [ 1628.895781][T14689] ? alloc_fd+0x59c/0x640 [ 1628.895813][T14689] do_sys_openat2+0x13e/0x1d0 [ 1628.895835][T14689] ? mutex_unlock+0x10/0x10 [ 1628.895856][T14689] ? do_sys_open+0x230/0x230 [ 1628.895890][T14689] __x64_sys_openat+0x247/0x290 [ 1628.895914][T14689] ? __ia32_sys_open+0x270/0x270 [ 1628.895939][T14689] ? syscall_enter_from_user_mode+0x32/0x230 [ 1628.895963][T14689] ? lockdep_hardirqs_on+0x98/0x140 [ 1628.895987][T14689] ? syscall_enter_from_user_mode+0x32/0x230 [ 1628.896015][T14689] do_syscall_64+0x44/0x110 [ 1628.896033][T14689] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1628.896058][T14689] RIP: 0033:0x7fad1fe7cae9 [ 1628.896078][T14689] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1628.896095][T14689] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1628.896118][T14689] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1628.896133][T14689] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 1628.896147][T14689] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1628.896161][T14689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1628.896174][T14689] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1628.896204][T14689] [ 1628.898517][T14685] overlay: Unknown parameter '\' [ 1628.907213][T14672] fuse: Bad value for 'user_id' [ 1628.967260][T14689] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1628.979443][T14694] fuse: Bad value for 'fd' [ 1628.990665][T14685] overlay: Unknown parameter '\' [ 1628.991708][T14672] fuse: Bad value for 'user_id' [ 1629.037725][T14696] fuse: Bad value for 'fd' [ 1629.041431][T14685] overlay: Unknown parameter '\' [ 1629.112372][T14672] fuse: Bad value for 'user_id' [ 1629.225067][T14685] overlay: Unknown parameter '\' [ 1629.231224][T14672] fuse: Bad value for 'user_id' [ 1629.236876][T14685] overlay: Unknown parameter '\' [ 1629.236906][T14672] fuse: Bad value for 'user_id' [ 1629.247472][T14672] fuse: Bad value for 'user_id' [ 1629.247489][T14685] overlay: Unknown parameter '\' [ 1629.252885][T14672] fuse: Bad value for 'user_id' 14:42:38 executing program 3: lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="823c612f40c617cc450a", @ANYRESDEC=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) mount$pvfs2(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8, &(0x7f0000000240)={[{'*,[--:(@\xf9{.'}], [{@fowner_gt={'fowner>', r2}}, {@appraise_type}]}) 14:42:38 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 19) 14:42:38 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1000000, &(0x7f0000000380)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@hash}]}}, 0x0, 0x0, &(0x7f0000000280)="b7b4bfe11a5aa3b3f4704ed672477def5f2a7dcf62a2c0b4d3ff583e678cb71c24a29193a8faa25cc88045bcd3c8d22e786879475215d3e477b33f168f03a7313dd9d300f06277db6c420e1c8b0471383268b4434538467f9b990af55cfe101284a5") r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1629.264023][T14685] overlay: Unknown parameter '\' [ 1629.265109][T14672] fuse: Bad value for 'user_id' [ 1629.274447][T14685] overlay: Unknown parameter '\' [ 1629.274488][T14672] fuse: Bad value for 'user_id' [ 1629.285007][T14672] fuse: Bad value for 'user_id' [ 1629.290470][T14685] overlay: Unknown parameter '\' [ 1629.290821][T14672] fuse: Bad value for 'user_id' [ 1629.301123][T14673] orangefs_mount: mount request failed with -4 [ 1629.308964][T14685] overlay: Unknown parameter '\' [ 1629.335698][T14685] overlay: Unknown parameter '\' [ 1629.352848][T14685] overlay: Unknown parameter '\' [ 1629.354941][T14701] FAULT_INJECTION: forcing a failure. [ 1629.354941][T14701] name failslab, interval 1, probability 0, space 0, times 0 [ 1629.376831][T14703] fuse: Bad value for 'fd' [ 1629.381264][T14701] CPU: 0 PID: 14701 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1629.381828][T14705] fuse: Bad value for 'fd' [ 1629.391483][T14701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1629.391506][T14701] Call Trace: [ 1629.391516][T14701] [ 1629.391526][T14701] dump_stack_lvl+0x1e7/0x2d0 [ 1629.391557][T14701] ? nf_tcp_handle_invalid+0x650/0x650 [ 1629.391577][T14701] ? panic+0x850/0x850 [ 1629.391600][T14701] ? __might_sleep+0xc0/0xc0 [ 1629.391629][T14701] should_fail_ex+0x3aa/0x4e0 [ 1629.391655][T14701] ? ext4_inode_attach_jinode+0xe8/0x1c0 [ 1629.391677][T14701] should_failslab+0x9/0x20 [ 1629.401075][T14704] fuse: Bad value for 'user_id' [ 1629.406163][T14701] kmem_cache_alloc+0x6d/0x350 [ 1629.406204][T14701] ext4_inode_attach_jinode+0xe8/0x1c0 [ 1629.406230][T14701] ext4_file_open+0x2d1/0x750 [ 1629.406252][T14701] ? ext4_file_mmap+0x5a0/0x5a0 [ 1629.406270][T14701] ? __fsnotify_update_child_dentry_flags+0x2a0/0x2a0 [ 1629.406293][T14701] ? mnt_get_write_access+0x68/0x2a0 [ 1629.406314][T14701] ? mnt_get_write_access+0x68/0x2a0 [ 1629.406339][T14701] ? fsnotify_perm+0x480/0x5a0 [ 1629.406361][T14701] ? ext4_file_mmap+0x5a0/0x5a0 [ 1629.406382][T14701] do_dentry_open+0x8fd/0x1590 [ 1629.406414][T14701] path_openat+0x2845/0x3280 [ 1629.406469][T14701] ? do_filp_open+0x490/0x490 [ 1629.406512][T14701] do_filp_open+0x234/0x490 [ 1629.406541][T14701] ? vfs_tmpfile+0x500/0x500 [ 1629.406588][T14701] ? _raw_spin_unlock+0x28/0x40 [ 1629.406612][T14701] ? alloc_fd+0x59c/0x640 14:42:38 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (fail_nth: 20) 14:42:38 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) fstat(r0, &(0x7f0000000140)) (async) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1000000, &(0x7f0000000380)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@hash}]}}, 0x0, 0x0, &(0x7f0000000280)="b7b4bfe11a5aa3b3f4704ed672477def5f2a7dcf62a2c0b4d3ff583e678cb71c24a29193a8faa25cc88045bcd3c8d22e786879475215d3e477b33f168f03a7313dd9d300f06277db6c420e1c8b0471383268b4434538467f9b990af55cfe101284a5") openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) (async) r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:38 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) r6 = openat$incfs(r4, &(0x7f0000000140)='.pending_reads\x00', 0x2, 0x0) fstat(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r6, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0xee01, r7}}, './file0\x00'}) fsmount(r2, 0x0, 0x4) (async) r8 = fsmount(r2, 0x0, 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r8, {0x7}}, './file0\x00'}) linkat(r1, &(0x7f0000000040)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00', 0x9e7c620f3d2b1c4d) [ 1629.406643][T14701] do_sys_openat2+0x13e/0x1d0 [ 1629.406664][T14701] ? mutex_unlock+0x10/0x10 [ 1629.406685][T14701] ? do_sys_open+0x230/0x230 [ 1629.406718][T14701] __x64_sys_openat+0x247/0x290 [ 1629.406741][T14701] ? __ia32_sys_open+0x270/0x270 [ 1629.406766][T14701] ? syscall_enter_from_user_mode+0x32/0x230 [ 1629.406790][T14701] ? lockdep_hardirqs_on+0x98/0x140 [ 1629.406814][T14701] ? syscall_enter_from_user_mode+0x32/0x230 [ 1629.406841][T14701] do_syscall_64+0x44/0x110 [ 1629.406862][T14701] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1629.406891][T14701] RIP: 0033:0x7fad1fe7cae9 [ 1629.406910][T14701] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1629.406944][T14701] RSP: 002b:00007fad20b030c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1629.406972][T14701] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7cae9 [ 1629.406987][T14701] RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c [ 1629.407001][T14701] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1629.407014][T14701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1629.407027][T14701] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1629.407055][T14701] [ 1629.477309][T14705] fuse: Bad value for 'fd' [ 1629.482886][T14685] overlay: Unknown parameter '\' [ 1629.581174][T14708] FAULT_INJECTION: forcing a failure. [ 1629.581174][T14708] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1629.636194][T14712] fuse: Bad value for 'fd' [ 1629.644602][T14708] CPU: 0 PID: 14708 Comm: syz-executor.1 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1629.699964][T14708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1629.710025][T14708] Call Trace: [ 1629.713307][T14708] [ 1629.716257][T14708] dump_stack_lvl+0x1e7/0x2d0 [ 1629.721331][T14708] ? nf_tcp_handle_invalid+0x650/0x650 [ 1629.726792][T14708] ? panic+0x850/0x850 [ 1629.730870][T14708] ? snprintf+0xda/0x120 [ 1629.735116][T14708] should_fail_ex+0x3aa/0x4e0 [ 1629.739805][T14708] _copy_to_user+0x2f/0xa0 [ 1629.744226][T14708] simple_read_from_buffer+0xca/0x150 [ 1629.749610][T14708] proc_fail_nth_read+0x1e9/0x250 [ 1629.754732][T14708] ? proc_fault_inject_write+0x3c0/0x3c0 [ 1629.760375][T14708] ? fsnotify_perm+0x43e/0x5a0 [ 1629.765144][T14708] ? proc_fault_inject_write+0x3c0/0x3c0 [ 1629.770841][T14708] vfs_read+0x289/0xb00 [ 1629.775014][T14708] ? __fdget_pos+0x2b0/0x340 [ 1629.779612][T14708] ? kernel_read+0x1f0/0x1f0 [ 1629.784205][T14708] ? __fget_files+0x3fe/0x480 [ 1629.789087][T14708] ? __fget_files+0x29/0x480 [ 1629.793693][T14708] ? __fdget_pos+0x2b0/0x340 [ 1629.798288][T14708] ? ksys_read+0x7b/0x2c0 [ 1629.802620][T14708] ksys_read+0x1a0/0x2c0 [ 1629.806867][T14708] ? print_irqtrace_events+0x220/0x220 [ 1629.812434][T14708] ? vfs_write+0xb20/0xb20 [ 1629.816868][T14708] ? syscall_enter_from_user_mode+0x32/0x230 [ 1629.822859][T14708] ? lockdep_hardirqs_on+0x98/0x140 [ 1629.828065][T14708] ? syscall_enter_from_user_mode+0x32/0x230 [ 1629.834051][T14708] do_syscall_64+0x44/0x110 [ 1629.838734][T14708] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1629.844657][T14708] RIP: 0033:0x7fad1fe7b78c [ 1629.849077][T14708] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 59 81 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 af 81 02 00 48 [ 1629.868703][T14708] RSP: 002b:00007fad20b030c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1629.877134][T14708] RAX: ffffffffffffffda RBX: 00007fad1ff9bf80 RCX: 00007fad1fe7b78c 14:42:39 executing program 0: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, 0x0, 0x0) [ 1629.885127][T14708] RDX: 000000000000000f RSI: 00007fad20b03130 RDI: 0000000000000003 [ 1629.893105][T14708] RBP: 00007fad20b03120 R08: 0000000000000000 R09: 0000000000000000 [ 1629.901079][T14708] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1629.909053][T14708] R13: 000000000000000b R14: 00007fad1ff9bf80 R15: 00007fff56ca45e8 [ 1629.917053][T14708] 14:42:39 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) 14:42:39 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) [ 1629.954458][T14712] fuse: Bad value for 'fd' 14:42:39 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) fstat(r0, &(0x7f0000000140)) (async) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1000000, &(0x7f0000000380)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@hash}]}}, 0x0, 0x0, &(0x7f0000000280)="b7b4bfe11a5aa3b3f4704ed672477def5f2a7dcf62a2c0b4d3ff583e678cb71c24a29193a8faa25cc88045bcd3c8d22e786879475215d3e477b33f168f03a7313dd9d300f06277db6c420e1c8b0471383268b4434538467f9b990af55cfe101284a5") r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:39 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x10001}}, './file0\x00'}) write$dsp(r1, &(0x7f0000000140)="5e3214a035ca0a3ab9cf30e4bdc6dd0ec87ed579277ca67e9eb41af14c9065261372dc71c0a53cf884bf6b9020da76db8408e4bdb57ad0df0e3d7a", 0x3b) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x202000, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:39 executing program 5: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0/file0\x00', 0x102, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1630.026544][T14721] fuse: Bad value for 'fd' [ 1630.033064][T14721] fuse: Bad value for 'fd' [ 1630.036174][T14722] overlay: Unknown parameter '\' [ 1630.118788][T14730] fuse: Bad value for 'fd' 14:42:39 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d6d77ae9cd62864d12d7d3a10dee2712060127475a20bd19beec7a4d054f29557ec7d54b0e934a955c6d01bd7116ee9972a2ecbadaf55fded49410699a2f74b0d2d1867b3a286d8913357e4b9f2580334", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000200)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 14:42:39 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x2) 14:42:39 executing program 5: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0/file0\x00', 0x102, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:39 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x10001}}, './file0\x00'}) write$dsp(r1, &(0x7f0000000140)="5e3214a035ca0a3ab9cf30e4bdc6dd0ec87ed579277ca67e9eb41af14c9065261372dc71c0a53cf884bf6b9020da76db8408e4bdb57ad0df0e3d7a", 0x3b) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x202000, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:39 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x3) [ 1630.204711][T14706] orangefs_mount: mount request failed with -4 [ 1630.267339][T14735] fuse: Bad value for 'fd' [ 1630.314576][T14741] fuse: Bad value for 'fd' 14:42:39 executing program 5: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0/file0\x00', 0x102, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0/file0\x00', 0x102, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) 14:42:39 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x4) 14:42:39 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x10001}}, './file0\x00'}) write$dsp(r1, &(0x7f0000000140)="5e3214a035ca0a3ab9cf30e4bdc6dd0ec87ed579277ca67e9eb41af14c9065261372dc71c0a53cf884bf6b9020da76db8408e4bdb57ad0df0e3d7a", 0x3b) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x202000, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x10001}}, './file0\x00'}) (async) write$dsp(r1, &(0x7f0000000140)="5e3214a035ca0a3ab9cf30e4bdc6dd0ec87ed579277ca67e9eb41af14c9065261372dc71c0a53cf884bf6b9020da76db8408e4bdb57ad0df0e3d7a", 0x3b) (async) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x202000, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:39 executing program 0: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) read$ptp(0xffffffffffffffff, &(0x7f0000000080)=""/182, 0xb6) read$ptp(0xffffffffffffffff, 0x0, 0x0) 14:42:39 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYRES16=r0, @ANYRES8=r1, @ANYRESOCT=r0, @ANYBLOB="44f0dcc19bd20ef868f68ef81a29f5c5e15b9497ac280c1499288856256ccf6ec1f66fbaa3efb587256b1a6418fd3416e32956675fffb05ad5963dda65a48ab1f1f3e123de4ab1e1a0289ee1638212ef9bd0a1f4e1d1a72a89d7b5634fed2903fe47cb2eacaea9bda6acc0ff72a81fa1918a50bec891bc8ba611a808a27eae9db5867856d7cec15222e24baafdc5d639f32f47c130392f43e9cceef9e26aa94ad7474df50a0f072a7cda496e042f6676e35de8bb836c8de9f14926801763f0f448b5b9c94456e5fcd6d9", @ANYRES16]) 14:42:39 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d6d77ae9cd62864d12d7d3a10dee2712060127475a20bd19beec7a4d054f29557ec7d54b0e934a955c6d01bd7116ee9972a2ecbadaf55fded49410699a2f74b0d2d1867b3a286d8913357e4b9f2580334", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000200)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 14:42:39 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) openat$incfs(r4, &(0x7f0000000140)='.pending_reads\x00', 0x2, 0x0) (async) r6 = openat$incfs(r4, &(0x7f0000000140)='.pending_reads\x00', 0x2, 0x0) fstat(r2, &(0x7f0000000180)) (async) fstat(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r6, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0xee01, r7}}, './file0\x00'}) r8 = fsmount(r2, 0x0, 0x4) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r8, {0x7}}, './file0\x00'}) linkat(r1, &(0x7f0000000040)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00', 0x9e7c620f3d2b1c4d) 14:42:40 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x8) 14:42:40 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d6d77ae9cd62864d12d7d3a10dee2712060127475a20bd19beec7a4d054f29557ec7d54b0e934a955c6d01bd7116ee9972a2ecbadaf55fded49410699a2f74b0d2d1867b3a286d8913357e4b9f2580334", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d6d77ae9cd62864d12d7d3a10dee2712060127475a20bd19beec7a4d054f29557ec7d54b0e934a955c6d01bd7116ee9972a2ecbadaf55fded49410699a2f74b0d2d1867b3a286d8913357e4b9f2580334", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000200)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) [ 1630.872328][T14747] fuse: Bad value for 'fd' [ 1630.882892][T14752] fuse: Bad value for 'fd' [ 1630.892475][T14751] overlay: Unknown parameter 'ÿÿ01777777777777777777777DðÜÁ›ÒøhöŽø)õÅá[”—¬( ™(ˆV%lÏnÁöoº£ïµ‡%kdý4ã)Vg_ÿ°ZÕ–' [ 1630.909477][T14752] fuse: Bad value for 'fd' 14:42:40 executing program 0: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) read$ptp(0xffffffffffffffff, &(0x7f0000000080)=""/182, 0xb6) read$ptp(0xffffffffffffffff, 0x0, 0x0) 14:42:40 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYRES16=r0, @ANYRES8=r1, @ANYRESOCT=r0, @ANYBLOB="44f0dcc19bd20ef868f68ef81a29f5c5e15b9497ac280c1499288856256ccf6ec1f66fbaa3efb587256b1a6418fd3416e32956675fffb05ad5963dda65a48ab1f1f3e123de4ab1e1a0289ee1638212ef9bd0a1f4e1d1a72a89d7b5634fed2903fe47cb2eacaea9bda6acc0ff72a81fa1918a50bec891bc8ba611a808a27eae9db5867856d7cec15222e24baafdc5d639f32f47c130392f43e9cceef9e26aa94ad7474df50a0f072a7cda496e042f6676e35de8bb836c8de9f14926801763f0f448b5b9c94456e5fcd6d9", @ANYRES16]) 14:42:40 executing program 4: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x0, 0x7, 0x1f, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r2 = syz_io_uring_setup(0x458f, &(0x7f0000000000)={0x0, 0x93f0, 0x800, 0x1, 0x176}, &(0x7f00000000c0), &(0x7f0000000100)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r3, 0x0, 0x0) 14:42:40 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) r3 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x50, &(0x7f0000000100)=ANY=[@ANYRESDEC=r1, @ANYRESHEX, @ANYRESDEC=r2, @ANYRESDEC=0x0, @ANYRES16, @ANYRESOCT=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) r6 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000180)='syz0\x00', 0x200002, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r5, 0xc0189377, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r6, {0x6, 0xffff1c8c}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) unlinkat(r3, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:40 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xc) [ 1631.035994][T14771] fuse: Bad value for 'fd' 14:42:40 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x10) 14:42:40 executing program 0: fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='}@\x00', &(0x7f0000000140)='\xa2\x00', 0x0) read$ptp(0xffffffffffffffff, &(0x7f0000000080)=""/182, 0xb6) read$ptp(0xffffffffffffffff, 0x0, 0x0) [ 1631.076766][T14773] overlay: Unknown parameter 'ÿÿ01777777777777777777777DðÜÁ›ÒøhöŽø)õÅá[”—¬( ™(ˆV%lÏnÁöoº£ïµ‡%kdý4ã)Vg_ÿ°ZÕ–' [ 1631.091014][T14777] fuse: Bad value for 'fd' 14:42:40 executing program 3: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYRES8=r0, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c6772f61155069c1e61576f1c26c6e7d7e4", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x100001d, 0x40010, r1, 0xd351c000) 14:42:40 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYRES16=r0, @ANYRES8=r1, @ANYRESOCT=r0, @ANYBLOB="44f0dcc19bd20ef868f68ef81a29f5c5e15b9497ac280c1499288856256ccf6ec1f66fbaa3efb587256b1a6418fd3416e32956675fffb05ad5963dda65a48ab1f1f3e123de4ab1e1a0289ee1638212ef9bd0a1f4e1d1a72a89d7b5634fed2903fe47cb2eacaea9bda6acc0ff72a81fa1918a50bec891bc8ba611a808a27eae9db5867856d7cec15222e24baafdc5d639f32f47c130392f43e9cceef9e26aa94ad7474df50a0f072a7cda496e042f6676e35de8bb836c8de9f14926801763f0f448b5b9c94456e5fcd6d9", @ANYRES16]) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r1, &(0x7f0000003880)) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYRES16=r0, @ANYRES8=r1, @ANYRESOCT=r0, @ANYBLOB="44f0dcc19bd20ef868f68ef81a29f5c5e15b9497ac280c1499288856256ccf6ec1f66fbaa3efb587256b1a6418fd3416e32956675fffb05ad5963dda65a48ab1f1f3e123de4ab1e1a0289ee1638212ef9bd0a1f4e1d1a72a89d7b5634fed2903fe47cb2eacaea9bda6acc0ff72a81fa1918a50bec891bc8ba611a808a27eae9db5867856d7cec15222e24baafdc5d639f32f47c130392f43e9cceef9e26aa94ad7474df50a0f072a7cda496e042f6676e35de8bb836c8de9f14926801763f0f448b5b9c94456e5fcd6d9", @ANYRES16]) (async) 14:42:40 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x18) 14:42:40 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:40 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) (async) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) r3 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x50, &(0x7f0000000100)=ANY=[@ANYRESDEC=r1, @ANYRESHEX, @ANYRESDEC=r2, @ANYRESDEC=0x0, @ANYRES16, @ANYRESOCT=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) r6 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000180)='syz0\x00', 0x200002, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r5, 0xc0189377, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r6, {0x6, 0xffff1c8c}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) unlinkat(r3, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(r3, &(0x7f0000000000)='./file0\x00', 0x200) [ 1631.181483][T14783] fuse: Unknown parameter '000000000000000085760xffffffffffffffff0000000000000000000400000000000000000000ÿÿ00000000000000000000003' [ 1631.195956][T14787] fuse: Unknown parameter '0xffffffffffffffff' 14:42:40 executing program 3: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYRES8=r0, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c6772f61155069c1e61576f1c26c6e7d7e4", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x100001d, 0x40010, r1, 0xd351c000) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYRES8=r0, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c6772f61155069c1e61576f1c26c6e7d7e4", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x100001d, 0x40010, r1, 0xd351c000) (async) 14:42:40 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x2e) [ 1631.264335][T14791] overlay: Unknown parameter 'ÿÿ01777777777777777777777DðÜÁ›ÒøhöŽø)õÅá[”—¬( ™(ˆV%lÏnÁöoº£ïµ‡%kdý4ã)Vg_ÿ°ZÕ–' [ 1631.299720][T14791] overlay: Unknown parameter 'ÿÿ01777777777777777777777DðÜÁ›ÒøhöŽø)õÅá[”—¬( ™(ˆV%lÏnÁöoº£ïµ‡%kdý4ã)Vg_ÿ°ZÕ–' [ 1631.319388][T14797] fuse: Unknown parameter '000000000000000085760xffffffffffffffff0000000000000000000400000000000000000000ÿÿ00000000000000000000003' [ 1631.332730][T14798] fuse: Unknown parameter '0xffffffffffffffff' 14:42:41 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x89) 14:42:41 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:41 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x801028, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:41 executing program 4: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x0, 0x7, 0x1f, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) r2 = syz_io_uring_setup(0x458f, &(0x7f0000000000)={0x0, 0x93f0, 0x800, 0x1, 0x176}, &(0x7f00000000c0), &(0x7f0000000100)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r3, 0x0, 0x0) 14:42:41 executing program 3: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYRES8=r0, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c6772f61155069c1e61576f1c26c6e7d7e4", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r1 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x100001d, 0x40010, r1, 0xd351c000) 14:42:41 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) r3 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x50, &(0x7f0000000100)=ANY=[@ANYRESDEC=r1, @ANYRESHEX, @ANYRESDEC=r2, @ANYRESDEC=0x0, @ANYRES16, @ANYRESOCT=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) r6 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000180)='syz0\x00', 0x200002, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r5, 0xc0189377, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r6, {0x6, 0xffff1c8c}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) unlinkat(r3, &(0x7f0000000000)='./file0\x00', 0x200) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r2, &(0x7f0000003880)) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x50, &(0x7f0000000100)=ANY=[@ANYRESDEC=r1, @ANYRESHEX, @ANYRESDEC=r2, @ANYRESDEC=0x0, @ANYRES16, @ANYRESOCT=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) (async) openat$cgroup(0xffffffffffffffff, &(0x7f0000000180)='syz0\x00', 0x200002, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(r5, 0xc0189377, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r6, {0x6, 0xffff1c8c}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) unlinkat(r3, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:41 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:41 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303048303030303030303030303030302c757365725f69643dc66389726a3e8602d7752e19d8aca5973ab8e51a94be089dedc5ff98284fdd4505a6b1fc5963269b7c0d7a90fe9281c04c8bad0a2255ead4cd62c7761c440aaf4d1ba2c0537be61528952bb952640dca284dde8d91ad09e7383554a0fd6fb6fa993c964225dff7d82d99f41215dd8fc71fbd9004564907f16ec358e106b3101dc6c2cc30145fc0b21e5275668803f1477981c8e3c23797b068f721", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:41 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x91) [ 1632.016658][T14811] fuse: Unknown parameter '0xffffffffffffffff' [ 1632.016835][T14812] fuse: Unknown parameter '000000000000000085760xffffffffffffffff0000000000000000000400000000000000000000ÿÿ00000000000000000000003' [ 1632.037091][T14814] overlay: Unknown parameter '\' 14:42:41 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x801028, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:41 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x121000, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:41 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xa1) [ 1632.103085][T14822] fuse: Unknown parameter '000000000000000085760xffffffffffffffff0000000000000000000400000000000000000000ÿÿ00000000000000000000003' 14:42:41 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000400)='}q\x00', &(0x7f0000000440)='/sys/kernel/debug/damon/attrs\x00', 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x100000001}}]}}, 0x0, 0x0, &(0x7f0000000240)="05f0fb64282053a99e6137e12167261644eb51dceedad96af88f60e8c72e6a6b503ef8bf4c05713a1ec339023380251596b0b76298f9147eef34578569a8b2d448dfc0b58507d30b520ab7a51e2ed3401bc99441b67cb1086e2705d6e2079439ec3afd30c7532d84f2fe503a9b01d0d6476e190ca8a8aa") openat$damon_attrs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40800, 0x5) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1632.167212][T14833] fuse: Bad value for 'fd' 14:42:41 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xc0) [ 1632.234137][T14837] overlay: Unknown parameter '\' [ 1632.237487][T14839] fuse: Bad value for 'fd' [ 1632.251411][T14839] fuse: Bad value for 'user_id' [ 1632.262191][T14839] fuse: Bad value for 'user_id' 14:42:41 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303048303030303030303030303030302c757365725f69643dc66389726a3e8602d7752e19d8aca5973ab8e51a94be089dedc5ff98284fdd4505a6b1fc5963269b7c0d7a90fe9281c04c8bad0a2255ead4cd62c7761c440aaf4d1ba2c0537be61528952bb952640dca284dde8d91ad09e7383554a0fd6fb6fa993c964225dff7d82d99f41215dd8fc71fbd9004564907f16ec358e106b3101dc6c2cc30145fc0b21e5275668803f1477981c8e3c23797b068f721", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303048303030303030303030303030302c757365725f69643dc66389726a3e8602d7752e19d8aca5973ab8e51a94be089dedc5ff98284fdd4505a6b1fc5963269b7c0d7a90fe9281c04c8bad0a2255ead4cd62c7761c440aaf4d1ba2c0537be61528952bb952640dca284dde8d91ad09e7383554a0fd6fb6fa993c964225dff7d82d99f41215dd8fc71fbd9004564907f16ec358e106b3101dc6c2cc30145fc0b21e5275668803f1477981c8e3c23797b068f721", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:41 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:41 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x801028, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:41 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x300) 14:42:41 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000400)='}q\x00', &(0x7f0000000440)='/sys/kernel/debug/damon/attrs\x00', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000400)='}q\x00', &(0x7f0000000440)='/sys/kernel/debug/damon/attrs\x00', 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x100000001}}]}}, 0x0, 0x0, &(0x7f0000000240)="05f0fb64282053a99e6137e12167261644eb51dceedad96af88f60e8c72e6a6b503ef8bf4c05713a1ec339023380251596b0b76298f9147eef34578569a8b2d448dfc0b58507d30b520ab7a51e2ed3401bc99441b67cb1086e2705d6e2079439ec3afd30c7532d84f2fe503a9b01d0d6476e190ca8a8aa") openat$damon_attrs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40800, 0x5) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:41 executing program 4: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x0, 0x7, 0x1f, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r2 = syz_io_uring_setup(0x458f, &(0x7f0000000000)={0x0, 0x93f0, 0x800, 0x1, 0x176}, &(0x7f00000000c0), &(0x7f0000000100)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) (async) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r3, 0x0, 0x0) [ 1632.905304][T14844] fuse: Bad value for 'fd' 14:42:42 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(0xffffffffffffffff, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:42 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x408) 14:42:42 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303048303030303030303030303030302c757365725f69643dc66389726a3e8602d7752e19d8aca5973ab8e51a94be089dedc5ff98284fdd4505a6b1fc5963269b7c0d7a90fe9281c04c8bad0a2255ead4cd62c7761c440aaf4d1ba2c0537be61528952bb952640dca284dde8d91ad09e7383554a0fd6fb6fa993c964225dff7d82d99f41215dd8fc71fbd9004564907f16ec358e106b3101dc6c2cc30145fc0b21e5275668803f1477981c8e3c23797b068f721", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async, rerun: 64) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) (async, rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1632.925713][T14847] overlay: Unknown parameter '\' [ 1632.933568][T14844] fuse: Bad value for 'fd' [ 1632.944830][T14852] fuse: Bad value for 'fd' 14:42:42 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) openat$incfs(r1, &(0x7f0000000080)='.log\x00', 0x424400, 0x4) 14:42:42 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) openat$incfs(r1, &(0x7f0000000080)='.log\x00', 0x424400, 0x4) [ 1633.025985][T14860] fuse: Bad value for 'user_id' [ 1633.026008][T14852] fuse: Bad value for 'user_id' [ 1633.044993][T14862] fuse: Bad value for 'fd' [ 1633.054348][T14866] overlay: Unknown parameter '\' [ 1633.063629][T14852] fuse: Bad value for 'user_id' 14:42:42 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x804) 14:42:42 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000400)='}q\x00', &(0x7f0000000440)='/sys/kernel/debug/damon/attrs\x00', 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x100000001}}]}}, 0x0, 0x0, &(0x7f0000000240)="05f0fb64282053a99e6137e12167261644eb51dceedad96af88f60e8c72e6a6b503ef8bf4c05713a1ec339023380251596b0b76298f9147eef34578569a8b2d448dfc0b58507d30b520ab7a51e2ed3401bc99441b67cb1086e2705d6e2079439ec3afd30c7532d84f2fe503a9b01d0d6476e190ca8a8aa") openat$damon_attrs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40800, 0x5) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:42 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000240)={{0x1, 0x1, 0x18, r0, {0xee01, 0xee01}}, './file0\x00'}) mount$nfs4(&(0x7f0000000040)=',%]\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x80400, &(0x7f0000000380)={[{'-.&\n-'}, {'\':[\'\x8d\'#]#.+\'{*^'}, {'group_id'}, {'user_id'}, {'fd'}, {'\\-,'}], [{@appraise}, {@fowner_eq={'fowner', 0x3d, r1}}, {@obj_user={'obj_user', 0x3d, 'group_id'}}, {@euid_eq={'euid', 0x3d, r2}}, {@pcr={'pcr', 0x3d, 0xf}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@context={'context', 0x3d, 'user_u'}}]}) 14:42:42 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) openat$incfs(r1, &(0x7f0000000080)='.log\x00', 0x424400, 0x4) [ 1633.166699][T14872] fuse: Bad value for 'fd' [ 1633.167775][T14871] overlay: Unknown parameter '\' [ 1633.187788][T14876] fuse: Bad value for 'user_id' [ 1633.202621][T14872] fuse: Bad value for 'user_id' 14:42:42 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xc00) 14:42:42 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) [ 1633.225061][T14879] fuse: Bad value for 'fd' [ 1633.292895][T14884] fuse: Bad value for 'fd' [ 1633.308524][T14886] overlay: Unknown parameter '\' 14:42:42 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) 14:42:42 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) r1 = fspick(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f00000001c0)='\\2-.){&](){-[/\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:42 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x1800) 14:42:42 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000240)={{0x1, 0x1, 0x18, r0, {0xee01, 0xee01}}, './file0\x00'}) mount$nfs4(&(0x7f0000000040)=',%]\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x80400, &(0x7f0000000380)={[{'-.&\n-'}, {'\':[\'\x8d\'#]#.+\'{*^'}, {'group_id'}, {'user_id'}, {'fd'}, {'\\-,'}], [{@appraise}, {@fowner_eq={'fowner', 0x3d, r1}}, {@obj_user={'obj_user', 0x3d, 'group_id'}}, {@euid_eq={'euid', 0x3d, r2}}, {@pcr={'pcr', 0x3d, 0xf}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@context={'context', 0x3d, 'user_u'}}]}) 14:42:42 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x9900) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) read$ptp(r0, 0x0, 0x0) [ 1633.812537][T14889] fuse: Bad value for 'fd' [ 1633.823687][T14890] fuse: Bad value for 'fd' 14:42:42 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) 14:42:42 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(0xffffffffffffffff, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:43 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x1d2c) 14:42:43 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x9900) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) read$ptp(r0, 0x0, 0x0) 14:42:43 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000240)={{0x1, 0x1, 0x18, r0, {0xee01, 0xee01}}, './file0\x00'}) mount$nfs4(&(0x7f0000000040)=',%]\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x80400, &(0x7f0000000380)={[{'-.&\n-'}, {'\':[\'\x8d\'#]#.+\'{*^'}, {'group_id'}, {'user_id'}, {'fd'}, {'\\-,'}], [{@appraise}, {@fowner_eq={'fowner', 0x3d, r1}}, {@obj_user={'obj_user', 0x3d, 'group_id'}}, {@euid_eq={'euid', 0x3d, r2}}, {@pcr={'pcr', 0x3d, 0xf}}, {@defcontext={'defcontext', 0x3d, 'system_u'}}, {@context={'context', 0x3d, 'user_u'}}]}) [ 1633.908086][T14900] fuse: Bad value for 'fd' [ 1633.917381][T14898] overlay: Unknown parameter '\' 14:42:43 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) (async) r1 = fspick(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f00000001c0)='\\2-.){&](){-[/\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1633.969433][T14905] fuse: Bad value for 'fd' 14:42:43 executing program 2: fsmount(0xffffffffffffffff, 0x1, 0x0) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000100)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x4, 0xffffffffffffffff, 0x30, 0x0, @in={0x2, 0x4e23, @remote}}}, 0xa0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mount(&(0x7f00000001c0)=@nullb, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='zonefs\x00', 0xa1, 0x0) [ 1634.002385][T14910] fuse: Bad value for 'fd' 14:42:43 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="66643db0d1746ce43cd3bbfb6eaf80", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000280)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) fchownat(r0, &(0x7f0000000240)='.\x00', r2, r4, 0x1000) mount$nfs4(&(0x7f0000000040)='group_id', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x40000, &(0x7f0000000180)={[{'fd'}, {'user_id'}, {}, {'group_id'}, {'group_id'}], [{@hash}, {@smackfsdef}]}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000022c0)={{0x1, 0x1, 0x18, r1, {0x3}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:43 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x2c1d) 14:42:43 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x9900) (async, rerun: 64) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (rerun: 64) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) read$ptp(r0, 0x0, 0x0) 14:42:43 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) r1 = fspick(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f00000001c0)='\\2-.){&](){-[/\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1634.077462][T14915] overlay: Unknown parameter '\' [ 1634.086485][T14920] fuse: Bad value for 'fd' 14:42:43 executing program 2: fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000100)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x4, 0xffffffffffffffff, 0x30, 0x0, @in={0x2, 0x4e23, @remote}}}, 0xa0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mount(&(0x7f00000001c0)=@nullb, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='zonefs\x00', 0xa1, 0x0) [ 1634.153173][T14922] fuse: Bad value for 'fd' 14:42:43 executing program 4: ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000001480)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000015c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000001640)={0x14, 0x88, 0xfa00, {r1, 0x10, 0x0, @in6={0xa, 0x4e24, 0x6, @private1={0xfc, 0x1, '\x00', 0x4}, 0x2}}}, 0x90) r2 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='net_cls.classid\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000013c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x4e23, 0x8000, @mcast1, 0x7}}}, 0x90) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000000140)={{r3}, 0x0, 0xe12b9d492d67b4cc, @inherit={0x68, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000004000000000000000100000000000000ffffff7f000000001000000000000000f8ffffffffffffff0600000000000000020000000000000009000000000000000500ffffffffffffffff00000600000001000004000000000500000000ff8200"]}, @devid}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) fstat(r5, &(0x7f0000001700)) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000001140)={{0x1, 0x1, 0x18, r4, {0xa1}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x101000, 0x0) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) read$ptp(r7, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r6, 0xc0189372, &(0x7f0000001280)={{0x1, 0x1, 0x18, r4}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) [ 1634.188063][T14928] overlay: Unknown parameter '\' [ 1634.188770][T14922] fuse: Bad value for 'user_id' 14:42:43 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(0xffffffffffffffff, &(0x7f0000000080)=""/182, 0xb6) read$ptp(r0, 0x0, 0x0) 14:42:43 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x2e00) 14:42:43 executing program 2: fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000100)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x4, 0xffffffffffffffff, 0x30, 0x0, @in={0x2, 0x4e23, @remote}}}, 0xa0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async, rerun: 32) mount(&(0x7f00000001c0)=@nullb, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='zonefs\x00', 0xa1, 0x0) (rerun: 32) 14:42:43 executing program 5: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/bus/mdio_bus', 0x400, 0x192) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000140)={0x0, 0x80000001, 0x51be}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000540)={{r1}, 0x0, 0xa, @unused=[0x7f, 0x6, 0xa2c1, 0x3], @devid=r2}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0xb0000, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="a75c"]) 14:42:43 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="66643db0d1746ce43cd3bbfb6eaf80", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="66643db0d1746ce43cd3bbfb6eaf80", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000280)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) fchownat(r0, &(0x7f0000000240)='.\x00', r2, r4, 0x1000) (async) fchownat(r0, &(0x7f0000000240)='.\x00', r2, r4, 0x1000) mount$nfs4(&(0x7f0000000040)='group_id', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x40000, &(0x7f0000000180)={[{'fd'}, {'user_id'}, {}, {'group_id'}, {'group_id'}], [{@hash}, {@smackfsdef}]}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000022c0)={{0x1, 0x1, 0x18, r1, {0x3}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:43 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x3f00) 14:42:43 executing program 5: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/bus/mdio_bus', 0x400, 0x192) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000140)={0x0, 0x80000001, 0x51be}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000540)={{r1}, 0x0, 0xa, @unused=[0x7f, 0x6, 0xa2c1, 0x3], @devid=r2}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0xb0000, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="a75c"]) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/bus/mdio_bus', 0x400, 0x192) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000140)={0x0, 0x80000001, 0x51be}) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000540)={{r1}, 0x0, 0xa, @unused=[0x7f, 0x6, 0xa2c1, 0x3], @devid=r2}) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0xb0000, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="a75c"]) (async) [ 1634.816653][T14941] fuse: Bad value for 'fd' [ 1634.830762][T14947] fuse: Bad value for 'fd' [ 1634.833039][T14948] overlay: Unknown parameter '§\' [ 1634.846384][T14950] fuse: Bad value for 'fd' [ 1634.859754][T14947] fuse: Bad value for 'user_id' 14:42:44 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x200008, &(0x7f0000000400)={{}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x400}}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions}, {@allow_other}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0xc00}}, {@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}, {@allow_other}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'nfs4\x00'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '}'}}, {@hash}, {@subj_role={'subj_role', 0x3d, '#'}}, {@appraise_type}]}}, 0x1, 0x0, &(0x7f00000005c0)="0feac238c3ad1a5b4ee670872f5faed4863ce3cea79cefc3a097d72f2848c50a05af92c02956f9623ffc55bb899d64fe7999d3c7ccd139e826751b494255") fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=000 0000000000000100000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000000,blksize=0x0000000000000000,default_permissions,allow_other,default_permissions,\x00'], 0x0, 0x0, 0x0) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000600)='./file0\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@blksize}]}}, 0x0, 0x0, 0x0) mount$nfs4(&(0x7f0000000040)='/%\'\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x40000, &(0x7f0000000180)={[{}, {'group_id'}, {'{'}, {'#$/{))'}, {'#'}, {'group_id'}], [{@subj_user={'subj_user', 0x3d, '#^\\'}}, {@measure}, {@uid_eq={'uid', 0x3d, r1}}, {@smackfshat={'smackfshat', 0x3d, 'fuse\x00'}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@fowner_eq={'fowner', 0x3d, r4}}, {@measure}, {@subj_user={'subj_user', 0x3d, '+,&#\',,'}}, {@fowner_lt={'fowner<', 0xee00}}]}) 14:42:44 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="66643db0d1746ce43cd3bbfb6eaf80", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000000280)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) fchownat(r0, &(0x7f0000000240)='.\x00', r2, r4, 0x1000) mount$nfs4(&(0x7f0000000040)='group_id', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x40000, &(0x7f0000000180)={[{'fd'}, {'user_id'}, {}, {'group_id'}, {'group_id'}], [{@hash}, {@smackfsdef}]}) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000022c0)={{0x1, 0x1, 0x18, r1, {0x3}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) (async, rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (rerun: 64) [ 1634.870315][T14950] fuse: Bad value for 'user_id' 14:42:44 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x8900) 14:42:44 executing program 5: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/bus/mdio_bus', 0x400, 0x192) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000140)={0x0, 0x80000001, 0x51be}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000540)={{r1}, 0x0, 0xa, @unused=[0x7f, 0x6, 0xa2c1, 0x3], @devid=r2}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0xb0000, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="a75c"]) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/bus/mdio_bus', 0x400, 0x192) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000140)={0x0, 0x80000001, 0x51be}) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000540)={{r1}, 0x0, 0xa, @unused=[0x7f, 0x6, 0xa2c1, 0x3], @devid=r2}) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0xb0000, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="a75c"]) (async) [ 1634.953171][T14953] overlay: Unknown parameter '§\' [ 1634.954567][T14957] fuse: Bad value for 'fd' [ 1634.978758][T14958] fuse: Bad value for 'fd' [ 1634.979419][T14959] fuse: Bad value for 'user_id' [ 1634.989913][T14963] overlay: Unknown parameter '§\' [ 1634.990101][T14957] fuse: Bad value for 'fd' [ 1635.018672][T14957] fuse: Bad value for 'rootmode' [ 1635.033094][T14957] fuse: Bad value for 'user_id' [ 1635.066881][T14967] overlay: Unknown parameter '§\' 14:42:44 executing program 4: ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000001480)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000015c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000001640)={0x14, 0x88, 0xfa00, {r1, 0x10, 0x0, @in6={0xa, 0x4e24, 0x6, @private1={0xfc, 0x1, '\x00', 0x4}, 0x2}}}, 0x90) (async) r2 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='net_cls.classid\x00', 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000013c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x4e23, 0x8000, @mcast1, 0x7}}}, 0x90) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000000140)={{r3}, 0x0, 0xe12b9d492d67b4cc, @inherit={0x68, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000004000000000000000100000000000000ffffff7f000000001000000000000000f8ffffffffffffff0600000000000000020000000000000009000000000000000500ffffffffffffffff00000600000001000004000000000500000000ff8200"]}, @devid}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) (async) fstat(r5, &(0x7f0000001700)) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000001140)={{0x1, 0x1, 0x18, r4, {0xa1}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) (async) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x101000, 0x0) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) (async) read$ptp(r7, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r6, 0xc0189372, &(0x7f0000001280)={{0x1, 0x1, 0x18, r4}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) [ 1635.092932][T14967] overlay: Unknown parameter '§\' 14:42:44 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) read$ptp(r0, 0x0, 0x0) 14:42:44 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:44 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x200008, &(0x7f0000000400)={{}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x400}}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions}, {@allow_other}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0xc00}}, {@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}, {@allow_other}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'nfs4\x00'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '}'}}, {@hash}, {@subj_role={'subj_role', 0x3d, '#'}}, {@appraise_type}]}}, 0x1, 0x0, &(0x7f00000005c0)="0feac238c3ad1a5b4ee670872f5faed4863ce3cea79cefc3a097d72f2848c50a05af92c02956f9623ffc55bb899d64fe7999d3c7ccd139e826751b494255") fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=000 0000000000000100000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000000,blksize=0x0000000000000000,default_permissions,allow_other,default_permissions,\x00'], 0x0, 0x0, 0x0) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000600)='./file0\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@blksize}]}}, 0x0, 0x0, 0x0) mount$nfs4(&(0x7f0000000040)='/%\'\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x40000, &(0x7f0000000180)={[{}, {'group_id'}, {'{'}, {'#$/{))'}, {'#'}, {'group_id'}], [{@subj_user={'subj_user', 0x3d, '#^\\'}}, {@measure}, {@uid_eq={'uid', 0x3d, r1}}, {@smackfshat={'smackfshat', 0x3d, 'fuse\x00'}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@fowner_eq={'fowner', 0x3d, r4}}, {@measure}, {@subj_user={'subj_user', 0x3d, '+,&#\',,'}}, {@fowner_lt={'fowner<', 0xee00}}]}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x200008, &(0x7f0000000400)={{}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x400}}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions}, {@allow_other}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0xc00}}, {@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}, {@allow_other}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'nfs4\x00'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '}'}}, {@hash}, {@subj_role={'subj_role', 0x3d, '#'}}, {@appraise_type}]}}, 0x1, 0x0, &(0x7f00000005c0)="0feac238c3ad1a5b4ee670872f5faed4863ce3cea79cefc3a097d72f2848c50a05af92c02956f9623ffc55bb899d64fe7999d3c7ccd139e826751b494255") (async) fstat(r0, &(0x7f0000003880)) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=000 0000000000000100000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000000,blksize=0x0000000000000000,default_permissions,allow_other,default_permissions,\x00'], 0x0, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r3, &(0x7f0000003880)) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000600)='./file0\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@blksize}]}}, 0x0, 0x0, 0x0) (async) mount$nfs4(&(0x7f0000000040)='/%\'\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x40000, &(0x7f0000000180)={[{}, {'group_id'}, {'{'}, {'#$/{))'}, {'#'}, {'group_id'}], [{@subj_user={'subj_user', 0x3d, '#^\\'}}, {@measure}, {@uid_eq={'uid', 0x3d, r1}}, {@smackfshat={'smackfshat', 0x3d, 'fuse\x00'}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@fowner_eq={'fowner', 0x3d, r4}}, {@measure}, {@subj_user={'subj_user', 0x3d, '+,&#\',,'}}, {@fowner_lt={'fowner<', 0xee00}}]}) (async) 14:42:44 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x9100) 14:42:44 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x0, 0x0) r2 = openat$incfs(r0, &(0x7f0000000180)='.log\x00', 0x2, 0x4) linkat(r1, &(0x7f0000000100)='./file0\x00', r2, &(0x7f00000001c0)='./file0\x00', 0x1000) 14:42:44 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1635.696343][T14979] fuse: Bad value for 'fd' [ 1635.701143][T14980] fuse: Bad value for 'fd' [ 1635.711421][T14979] fuse: Bad value for 'fd' [ 1635.717152][T14981] overlay: Unknown parameter '\' [ 1635.727533][T14979] fuse: Bad value for 'rootmode' [ 1635.741860][T14979] fuse: Bad value for 'user_id' 14:42:44 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xa1ff) 14:42:44 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x0, 0x0) (async) r2 = openat$incfs(r0, &(0x7f0000000180)='.log\x00', 0x2, 0x4) linkat(r1, &(0x7f0000000100)='./file0\x00', r2, &(0x7f00000001c0)='./file0\x00', 0x1000) 14:42:44 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000280), &(0x7f00000002c0)='./file0\x00', 0x200008, &(0x7f0000000400)={{}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x400}}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions}, {@allow_other}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0xc00}}, {@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}, {@allow_other}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'nfs4\x00'}}, {@smackfstransmute={'smackfstransmute', 0x3d, '}'}}, {@hash}, {@subj_role={'subj_role', 0x3d, '#'}}, {@appraise_type}]}}, 0x1, 0x0, &(0x7f00000005c0)="0feac238c3ad1a5b4ee670872f5faed4863ce3cea79cefc3a097d72f2848c50a05af92c02956f9623ffc55bb899d64fe7999d3c7ccd139e826751b494255") (async) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (rerun: 32) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=000 0000000000000100000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000000,blksize=0x0000000000000000,default_permissions,allow_other,default_permissions,\x00'], 0x0, 0x0, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000600)='./file0\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@blksize}]}}, 0x0, 0x0, 0x0) mount$nfs4(&(0x7f0000000040)='/%\'\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x40000, &(0x7f0000000180)={[{}, {'group_id'}, {'{'}, {'#$/{))'}, {'#'}, {'group_id'}], [{@subj_user={'subj_user', 0x3d, '#^\\'}}, {@measure}, {@uid_eq={'uid', 0x3d, r1}}, {@smackfshat={'smackfshat', 0x3d, 'fuse\x00'}}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@fowner_eq={'fowner', 0x3d, r4}}, {@measure}, {@subj_user={'subj_user', 0x3d, '+,&#\',,'}}, {@fowner_lt={'fowner<', 0xee00}}]}) [ 1635.763998][T14979] fuse: Bad value for 'fd' [ 1635.783212][T14990] fuse: Bad value for 'fd' 14:42:44 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:44 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x0, 0x0) openat$incfs(r0, &(0x7f0000000180)='.log\x00', 0x2, 0x4) (async) r2 = openat$incfs(r0, &(0x7f0000000180)='.log\x00', 0x2, 0x4) linkat(r1, &(0x7f0000000100)='./file0\x00', r2, &(0x7f00000001c0)='./file0\x00', 0x1000) [ 1635.881371][T15002] overlay: Unknown parameter '\' [ 1635.887402][T14999] fuse: Bad value for 'fd' [ 1635.895135][T15003] fuse: Bad value for 'fd' [ 1635.910961][T15006] fuse: Bad value for 'fd' 14:42:45 executing program 4: ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000001480)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xffffffffffffffff}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000015c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000001640)={0x14, 0x88, 0xfa00, {r1, 0x10, 0x0, @in6={0xa, 0x4e24, 0x6, @private1={0xfc, 0x1, '\x00', 0x4}, 0x2}}}, 0x90) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='net_cls.classid\x00', 0x2, 0x0) (async) r2 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='net_cls.classid\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000013c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x4e23, 0x8000, @mcast1, 0x7}}}, 0x90) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000000140)={{r3}, 0x0, 0xe12b9d492d67b4cc, @inherit={0x68, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000004000000000000000100000000000000ffffff7f000000001000000000000000f8ffffffffffffff0600000000000000020000000000000009000000000000000500ffffffffffffffff00000600000001000004000000000500000000ff8200"]}, @devid}) (async) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000000140)={{r3}, 0x0, 0xe12b9d492d67b4cc, @inherit={0x68, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000000000000004000000000000000100000000000000ffffff7f000000001000000000000000f8ffffffffffffff0600000000000000020000000000000009000000000000000500ffffffffffffffff00000600000001000004000000000500000000ff8200"]}, @devid}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) fstat(r5, &(0x7f0000001700)) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000001140)={{0x1, 0x1, 0x18, r4, {0xa1}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x101000, 0x0) (async) r7 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x101000, 0x0) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) read$ptp(r7, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r6, 0xc0189372, &(0x7f0000001280)={{0x1, 0x1, 0x18, r4}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r6, 0xc0189372, &(0x7f0000001280)={{0x1, 0x1, 0x18, r4}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) 14:42:45 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) read$ptp(r0, 0x0, 0x0) 14:42:45 executing program 3: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000001e07317eb000000", @ANYRES32, @ANYRES32=0xee01, @ANYRES32=0xffffffffffffffff, @ANYBLOB='./file0\x00']) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000280)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@blksize}, {@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}], [{@smackfsfloor={'smackfsfloor', 0x3d, ']{'}}, {@seclabel}]}}, 0x1, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$nfs(&(0x7f0000000140)='user_id', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x210080, &(0x7f0000000200)={[{'fuse\x00'}], [{@context={'context', 0x3d, 'sysadm_u'}}]}) 14:42:45 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xc000) 14:42:45 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="5c3bba5eed6ef660c61ded8ba1299fa17934135d11162e381495a51b06ae18fd90de71c35892df7ca5fe2207ef48dd99744c8d258c86df9e9d1dd827fa175476a1b193e2bb0b3971943b67b2423e51bcc61541365081c7ed7d57ec8e9aa29f3c15cb3273d484f4a23208d7be"]) 14:42:45 executing program 2: lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(0xffffffffffffffff, &(0x7f0000000240)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1e6020, &(0x7f0000002300)={{}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}, {@blksize={'blksize', 0x3d, 0x1400}}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x3}}, {}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:45 executing program 2: lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(0xffffffffffffffff, &(0x7f0000000240)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1e6020, &(0x7f0000002300)={{}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}, {@blksize={'blksize', 0x3d, 0x1400}}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x3}}, {}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:45 executing program 2: lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(0xffffffffffffffff, &(0x7f0000000240)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1e6020, &(0x7f0000002300)={{}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}, {@blksize={'blksize', 0x3d, 0x1400}}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x3}}, {}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000000240)={0x2020}, 0x2020) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1e6020, &(0x7f0000002300)={{}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}, {@blksize={'blksize', 0x3d, 0x1400}}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x3}}, {}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:45 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="5c3bba5eed6ef660c61ded8ba1299fa17934135d11162e381495a51b06ae18fd90de71c35892df7ca5fe2207ef48dd99744c8d258c86df9e9d1dd827fa175476a1b193e2bb0b3971943b67b2423e51bcc61541365081c7ed7d57ec8e9aa29f3c15cb3273d484f4a23208d7be"]) 14:42:45 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xffa1) [ 1636.602108][T15015] overlay: Unknown parameter '\;º^ínö`Æí‹¡)Ÿ¡y4].8•¥®ýÞqÃX’ß|¥þ"ïHÝ™tL%Œ†ßžØ'úTv¡±“â» 9q”;g²B>Q¼ÆA6PÇí}W쎚¢Ÿ<Ë2sÔ„ô¢2×¾' [ 1636.632130][T15016] fuse: Bad value for 'fd' 14:42:45 executing program 3: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000001e07317eb000000", @ANYRES32, @ANYRES32=0xee01, @ANYRES32=0xffffffffffffffff, @ANYBLOB='./file0\x00']) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000280)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@blksize}, {@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}], [{@smackfsfloor={'smackfsfloor', 0x3d, ']{'}}, {@seclabel}]}}, 0x1, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) mount$nfs(&(0x7f0000000140)='user_id', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x210080, &(0x7f0000000200)={[{'fuse\x00'}], [{@context={'context', 0x3d, 'sysadm_u'}}]}) 14:42:45 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mount(&(0x7f0000000040)=@sg0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='pipefs\x00', 0x40, &(0x7f0000000180)='fuse\x00') [ 1636.747733][T15032] overlay: Unknown parameter '\;º^ínö`Æí‹¡)Ÿ¡y4].8•¥®ýÞqÃX’ß|¥þ"ïHÝ™tL%Œ†ßžØ'úTv¡±“â» 9q”;g²B>Q¼ÆA6PÇí}W쎚¢Ÿ<Ë2sÔ„ô¢2×¾' [ 1636.774051][T15033] fuse: Bad value for 'fd' [ 1636.784561][T15038] fuse: Bad value for 'fd' 14:42:45 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x4) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x100010, r1, 0x10000000) 14:42:46 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) read$ptp(r0, 0x0, 0x0) 14:42:46 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="5c3bba5eed6ef660c61ded8ba1299fa17934135d11162e381495a51b06ae18fd90de71c35892df7ca5fe2207ef48dd99744c8d258c86df9e9d1dd827fa175476a1b193e2bb0b3971943b67b2423e51bcc61541365081c7ed7d57ec8e9aa29f3c15cb3273d484f4a23208d7be"]) 14:42:46 executing program 3: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000001e07317eb000000", @ANYRES32, @ANYRES32=0xee01, @ANYRES32=0xffffffffffffffff, @ANYBLOB='./file0\x00']) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000280)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@blksize}, {@max_read={'max_read', 0x3d, 0x6}}, {@default_permissions}], [{@smackfsfloor={'smackfsfloor', 0x3d, ']{'}}, {@seclabel}]}}, 0x1, 0x0, 0x0) (async, rerun: 32) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (rerun: 32) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$nfs(&(0x7f0000000140)='user_id', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x210080, &(0x7f0000000200)={[{'fuse\x00'}], [{@context={'context', 0x3d, 'sysadm_u'}}]}) 14:42:46 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mount(&(0x7f0000000040)=@sg0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='pipefs\x00', 0x40, &(0x7f0000000180)='fuse\x00') syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) mount(&(0x7f0000000040)=@sg0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='pipefs\x00', 0x40, &(0x7f0000000180)='fuse\x00') (async) 14:42:46 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x40000) 14:42:46 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x100000) 14:42:46 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000080)='overlay\x00', &(0x7f0000000100)='./file0\x00', r0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:46 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mount(&(0x7f0000000040)=@sg0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='pipefs\x00', 0x40, &(0x7f0000000180)='fuse\x00') syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) mount(&(0x7f0000000040)=@sg0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='pipefs\x00', 0x40, &(0x7f0000000180)='fuse\x00') (async) [ 1637.510407][T15048] overlay: Unknown parameter '\;º^ínö`Æí‹¡)Ÿ¡y4].8•¥®ýÞqÃX’ß|¥þ"ïHÝ™tL%Œ†ßžØ'úTv¡±“â» 9q”;g²B>Q¼ÆA6PÇí}W쎚¢Ÿ<Ë2sÔ„ô¢2×¾' [ 1637.520271][T15051] fuse: Bad value for 'fd' [ 1637.549901][T15053] fuse: Bad value for 'fd' [ 1637.551486][T15051] fuse: Bad value for 'fd' 14:42:46 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x80ffff) [ 1637.605736][T15053] fuse: Bad value for 'fd' [ 1637.635713][T15053] fuse: Bad value for 'fd' [ 1637.655115][T15063] fuse: Bad value for 'fd' [ 1637.655672][T15053] fuse: Bad value for 'fd' [ 1637.666795][T15053] fuse: Bad value for 'fd' [ 1637.672239][T15053] fuse: Bad value for 'fd' [ 1637.679325][T15053] fuse: Bad value for 'fd' 14:42:46 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="666439396c1811010207ca79708d5cadd93d", @ANYRES16=0x0, @ANYBLOB="2c726f6f746d6f64653d3030af30303030303030303030303030303030303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69649a2e6d", @ANYRESDEC=0x0, @ANYBLOB=',\x00', @ANYBLOB="7a90b7aeebcae481c8517c4d05020458790b531e933f3caffa6947a1ec27a48582cd93f83cdd4c3d99dee93bdf0c9700618645128891b71a153e2214778dd30fead4f4e769ffe963d43475c85fbccdb29ff91d98ca75b0ea9d843a31a5287e847a6e7c9398d71d12bcb16b3f81d0dd342f06587c769dca921e1ccf5bac7e6959a3860826a8dcc357b4a128d282f6f191a3ad5cc91a17058c0c0fcb75a734eaf82d05af5f5211dae9e1b6f72c189d56a8b1a1", @ANYRES64=r0], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:46 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) r1 = fsmount(r0, 0x1, 0x4) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x100010, r1, 0x10000000) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) read$ptp(r0, 0x0, 0x0) (async) fsmount(r0, 0x1, 0x4) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x100010, r1, 0x10000000) (async) [ 1637.685344][T15053] fuse: Bad value for 'fd' [ 1637.690368][T15053] fuse: Bad value for 'fd' [ 1637.704436][T15064] overlay: Unknown parameter '\' [ 1637.709445][T15053] fuse: Bad value for 'fd' [ 1637.709792][T15053] fuse: Bad value for 'fd' 14:42:46 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xc00000) [ 1637.735007][T15053] fuse: Bad value for 'fd' [ 1637.749893][T15053] fuse: Bad value for 'fd' [ 1637.761432][T15053] fuse: Bad value for 'fd' [ 1637.767454][T15070] fuse: Unknown parameter 'fd99lÊyp\­Ù' [ 1637.774629][T15053] fuse: Bad value for 'fd' [ 1637.797976][T15053] fuse: Bad value for 'fd' [ 1637.817381][T15053] fuse: Bad value for 'fd' [ 1637.830980][T15053] fuse: Bad value for 'fd' [ 1637.840400][T15053] fuse: Bad value for 'fd' [ 1637.845914][T15053] fuse: Bad value for 'fd' [ 1637.851121][T15053] fuse: Bad value for 'fd' [ 1637.857825][T15053] fuse: Bad value for 'fd' [ 1637.863121][T15053] fuse: Bad value for 'fd' [ 1637.869356][T15053] fuse: Bad value for 'fd' [ 1637.874366][T15053] fuse: Bad value for 'fd' [ 1637.885832][T15053] fuse: Bad value for 'fd' [ 1637.891057][T15053] fuse: Bad value for 'fd' [ 1637.896200][T15053] fuse: Bad value for 'fd' [ 1637.901025][T15053] fuse: Bad value for 'fd' [ 1637.907466][T15053] fuse: Bad value for 'fd' [ 1637.912317][T15053] fuse: Bad value for 'fd' [ 1637.917726][T15053] fuse: Bad value for 'fd' [ 1637.922499][T15053] fuse: Bad value for 'fd' 14:42:47 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(0xffffffffffffffff, 0x0, 0x0) 14:42:47 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) openat$smackfs_cipsonum(0xffffffffffffff9c, &(0x7f0000001400)='/sys/fs/smackfs/doi\x00', 0x2, 0x0) readlinkat(r2, &(0x7f0000000200)='./file0\x00', &(0x7f0000001380)=""/69, 0x45) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) faccessat(r5, &(0x7f0000000040)='./file0\x00', 0x44) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r7}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) fchownat(r3, &(0x7f0000000280)='./file0\x00', r7, 0x0, 0x800) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000100)={"2ddff56d775706731caea4aa15c387db", 0x0, 0x0, {0x7fffffffffffffff, 0x3}, {0x2b, 0x6}, 0xfffffffffffffffa, [0x7ffffffc, 0x4, 0x20, 0x0, 0x0, 0x80, 0x1, 0x20, 0xfff, 0x100000001, 0x20, 0x51, 0x9c8, 0x100000001, 0x7, 0x3]}) 14:42:47 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000080)='overlay\x00', &(0x7f0000000100)='./file0\x00', r0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:47 executing program 2: openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="666439396c1811010207ca79708d5cadd93d", @ANYRES16=0x0, @ANYBLOB="2c726f6f746d6f64653d3030af30303030303030303030303030303030303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69649a2e6d", @ANYRESDEC=0x0, @ANYBLOB=',\x00', @ANYBLOB="7a90b7aeebcae481c8517c4d05020458790b531e933f3caffa6947a1ec27a48582cd93f83cdd4c3d99dee93bdf0c9700618645128891b71a153e2214778dd30fead4f4e769ffe963d43475c85fbccdb29ff91d98ca75b0ea9d843a31a5287e847a6e7c9398d71d12bcb16b3f81d0dd342f06587c769dca921e1ccf5bac7e6959a3860826a8dcc357b4a128d282f6f191a3ad5cc91a17058c0c0fcb75a734eaf82d05af5f5211dae9e1b6f72c189d56a8b1a1", @ANYRES64=r0], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:47 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x1000000) 14:42:47 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) (async) r1 = fsmount(r0, 0x1, 0x4) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x100010, r1, 0x10000000) 14:42:47 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x2000000) 14:42:47 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(0xffffffffffffffff, 0x0, 0x0) [ 1638.437614][T15088] fuse: Unknown parameter 'fd99lÊyp\­Ù' [ 1638.437632][T15087] fuse: Bad value for 'fd' [ 1638.454531][T15090] overlay: Unknown parameter '\' 14:42:47 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) (async) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="666439396c1811010207ca79708d5cadd93d", @ANYRES16=0x0, @ANYBLOB="2c726f6f746d6f64653d3030af30303030303030303030303030303030303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69649a2e6d", @ANYRESDEC=0x0, @ANYBLOB=',\x00', @ANYBLOB="7a90b7aeebcae481c8517c4d05020458790b531e933f3caffa6947a1ec27a48582cd93f83cdd4c3d99dee93bdf0c9700618645128891b71a153e2214778dd30fead4f4e769ffe963d43475c85fbccdb29ff91d98ca75b0ea9d843a31a5287e847a6e7c9398d71d12bcb16b3f81d0dd342f06587c769dca921e1ccf5bac7e6959a3860826a8dcc357b4a128d282f6f191a3ad5cc91a17058c0c0fcb75a734eaf82d05af5f5211dae9e1b6f72c189d56a8b1a1", @ANYRES64=r0], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:47 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000080)='overlay\x00', &(0x7f0000000100)='./file0\x00', r0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000080)='overlay\x00', &(0x7f0000000100)='./file0\x00', r0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) [ 1638.485860][T15087] fuse: Bad value for 'user_id' 14:42:47 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) openat$smackfs_cipsonum(0xffffffffffffff9c, &(0x7f0000001400)='/sys/fs/smackfs/doi\x00', 0x2, 0x0) readlinkat(r2, &(0x7f0000000200)='./file0\x00', &(0x7f0000001380)=""/69, 0x45) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) faccessat(r5, &(0x7f0000000040)='./file0\x00', 0x44) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r7}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) fchownat(r3, &(0x7f0000000280)='./file0\x00', r7, 0x0, 0x800) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000100)={"2ddff56d775706731caea4aa15c387db", 0x0, 0x0, {0x7fffffffffffffff, 0x3}, {0x2b, 0x6}, 0xfffffffffffffffa, [0x7ffffffc, 0x4, 0x20, 0x0, 0x0, 0x80, 0x1, 0x20, 0xfff, 0x100000001, 0x20, 0x51, 0x9c8, 0x100000001, 0x7, 0x3]}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) (async) openat$smackfs_cipsonum(0xffffffffffffff9c, &(0x7f0000001400)='/sys/fs/smackfs/doi\x00', 0x2, 0x0) (async) readlinkat(r2, &(0x7f0000000200)='./file0\x00', &(0x7f0000001380)=""/69, 0x45) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) (async) faccessat(r5, &(0x7f0000000040)='./file0\x00', 0x44) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r6, &(0x7f0000003880)) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r7}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) fchownat(r3, &(0x7f0000000280)='./file0\x00', r7, 0x0, 0x800) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000100)={"2ddff56d775706731caea4aa15c387db", 0x0, 0x0, {0x7fffffffffffffff, 0x3}, {0x2b, 0x6}, 0xfffffffffffffffa, [0x7ffffffc, 0x4, 0x20, 0x0, 0x0, 0x80, 0x1, 0x20, 0xfff, 0x100000001, 0x20, 0x51, 0x9c8, 0x100000001, 0x7, 0x3]}) (async) 14:42:47 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x3000000) 14:42:47 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) read$ptp(r0, &(0x7f0000000080)=""/182, 0xb6) read$ptp(0xffffffffffffffff, 0x0, 0x0) [ 1638.594903][T15098] overlay: Unknown parameter '\' [ 1638.606025][T15101] fuse: Bad value for 'fd' [ 1638.610962][T15100] fuse: Unknown parameter 'fd99lÊyp\­Ù' [ 1638.619273][T15098] overlay: Unknown parameter '\' 14:42:47 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x4000000) 14:42:47 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x200001, 0x0) r2 = openat(r0, &(0x7f0000000100)='./file0\x00', 0x393802, 0x190) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {r0}}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1638.642022][T15101] fuse: Bad value for 'user_id' 14:42:47 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(r0, &(0x7f0000000080)='.\x00', 0x0, 0x0, 0x400) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1638.666351][T15101] fuse: Bad value for 'fd' 14:42:47 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x8000000) [ 1638.722734][T15115] fuse: Bad value for 'fd' [ 1638.782031][T15118] overlay: Unknown parameter '\' 14:42:48 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000100)={{r0}, 0x0, 0x4, @unused=[0xfff, 0x7f, 0x4599], @subvolid=0x2d66}) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f00000000c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000080)}}, 0x18) r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4008, 0x0, @desc3}}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) ioctl$BTRFS_IOC_SCRUB(r4, 0xc400941b, &(0x7f0000001100)={0x0, 0x9, 0x1, 0x1}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) read$ptp(r5, 0x0, 0x0) 14:42:48 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) (async) openat$smackfs_cipsonum(0xffffffffffffff9c, &(0x7f0000001400)='/sys/fs/smackfs/doi\x00', 0x2, 0x0) (async) readlinkat(r2, &(0x7f0000000200)='./file0\x00', &(0x7f0000001380)=""/69, 0x45) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) (async) faccessat(r5, &(0x7f0000000040)='./file0\x00', 0x44) (async) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (rerun: 64) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r7}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) fchownat(r3, &(0x7f0000000280)='./file0\x00', r7, 0x0, 0x800) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000100)={"2ddff56d775706731caea4aa15c387db", 0x0, 0x0, {0x7fffffffffffffff, 0x3}, {0x2b, 0x6}, 0xfffffffffffffffa, [0x7ffffffc, 0x4, 0x20, 0x0, 0x0, 0x80, 0x1, 0x20, 0xfff, 0x100000001, 0x20, 0x51, 0x9c8, 0x100000001, 0x7, 0x3]}) 14:42:48 executing program 0: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/bus/mdio_bus', 0x400, 0x192) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000140)={0x0, 0x80000001, 0x51be}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000540)={{r1}, 0x0, 0xa, @unused=[0x7f, 0x6, 0xa2c1, 0x3], @devid=r2}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0xb0000, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="a75c"]) 14:42:48 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x200001, 0x0) (async) r2 = openat(r0, &(0x7f0000000100)='./file0\x00', 0x393802, 0x190) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {r0}}, './file0\x00'}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:48 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(r0, &(0x7f0000000080)='.\x00', 0x0, 0x0, 0x400) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:48 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x8040000) 14:42:48 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xc000000) 14:42:48 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x200001, 0x0) (async) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x200001, 0x0) r2 = openat(r0, &(0x7f0000000100)='./file0\x00', 0x393802, 0x190) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {r0}}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:48 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat(r0, &(0x7f0000000040)='./file0\x00', 0x800, 0x118) mknodat$null(r1, &(0x7f0000000100)='./file0\x00', 0x400, 0x103) [ 1639.346860][T15135] fuse: Bad value for 'fd' [ 1639.347641][T15131] overlay: Unknown parameter '\' [ 1639.366273][T15130] overlay: Unknown parameter '§\' 14:42:48 executing program 0: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="66643db0d1746ce43cd3bbfb6eaf80", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000280)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) fchownat(r0, &(0x7f0000000240)='.\x00', r2, r4, 0x1000) mount$nfs4(&(0x7f0000000040)='group_id', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x40000, &(0x7f0000000180)={[{'fd'}, {'user_id'}, {}, {'group_id'}, {'group_id'}], [{@hash}, {@smackfsdef}]}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000022c0)={{0x1, 0x1, 0x18, r1, {0x3}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:48 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000100)={{r0}, 0x0, 0x4, @unused=[0xfff, 0x7f, 0x4599], @subvolid=0x2d66}) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f00000000c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000080)}}, 0x18) r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4008, 0x0, @desc3}}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) ioctl$BTRFS_IOC_SCRUB(r4, 0xc400941b, &(0x7f0000001100)={0x0, 0x9, 0x1, 0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) read$ptp(r5, 0x0, 0x0) 14:42:48 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(r0, &(0x7f0000000080)='.\x00', 0x0, 0x0, 0x400) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:48 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x18000000) [ 1639.456671][T15143] fuse: Bad value for 'fd' [ 1639.465679][T15143] fuse: Bad value for 'user_id' [ 1639.473457][T15144] fuse: Bad value for 'fd' [ 1639.483556][T15145] fuse: Bad value for 'fd' 14:42:48 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) r1 = fspick(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f00000001c0)='\\2-.){&](){-[/\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:48 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r1 = openat(r0, &(0x7f0000000040)='./file0\x00', 0x800, 0x118) mknodat$null(r1, &(0x7f0000000100)='./file0\x00', 0x400, 0x103) [ 1639.520992][T15148] overlay: Unknown parameter '\' 14:42:48 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000280)=ANY=[@ANYBLOB="9c2d5a1f43038981a7fa32dd15fbfb6e2f6f000010000000000000"], 0xffffffffffffffff, &(0x7f0000000140)={0x9, 0xc000000000000000, 0x7ff, 0x100000000, 0x200, 0x10001, 0x4, 0x4, 0x7}) 14:42:48 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000100)={{r0}, 0x0, 0x4, @unused=[0xfff, 0x7f, 0x4599], @subvolid=0x2d66}) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_MIGRATE_ID(r2, &(0x7f00000000c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000080)}}, 0x18) r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4008, 0x0, @desc3}}) (async) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) (async) ioctl$BTRFS_IOC_SCRUB(r4, 0xc400941b, &(0x7f0000001100)={0x0, 0x9, 0x1, 0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) read$ptp(r5, 0x0, 0x0) 14:42:48 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x2c1d0000) 14:42:48 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1639.630060][T15159] fuse: Bad value for 'fd' 14:42:48 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r1 = openat(r0, &(0x7f0000000040)='./file0\x00', 0x800, 0x118) mknodat$null(r1, &(0x7f0000000100)='./file0\x00', 0x400, 0x103) 14:42:48 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x10b900, 0x0) read$ptp(r0, 0x0, 0xfffffe04) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) read$ptp(r2, &(0x7f0000000100)=""/64, 0x40) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) openat$smackfs_logging(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:42:48 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:48 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000280)=ANY=[@ANYBLOB="9c2d5a1f43038981a7fa32dd15fbfb6e2f6f000010000000000000"], 0xffffffffffffffff, &(0x7f0000000140)={0x9, 0xc000000000000000, 0x7ff, 0x100000000, 0x200, 0x10001, 0x4, 0x4, 0x7}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) (async) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000280)=ANY=[@ANYBLOB="9c2d5a1f43038981a7fa32dd15fbfb6e2f6f000010000000000000"], 0xffffffffffffffff, &(0x7f0000000140)={0x9, 0xc000000000000000, 0x7ff, 0x100000000, 0x200, 0x10001, 0x4, 0x4, 0x7}) (async) [ 1639.666061][T15158] overlay: Unknown parameter '\' [ 1639.666619][T15165] fuse: Bad value for 'fd' [ 1639.676075][T15161] overlay: Unknown parameter 'subj_role' [ 1639.700223][T15161] overlay: Unknown parameter 'ÿÿÿÿ' 14:42:48 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x2e000000) [ 1639.747761][T15169] fuse: Bad value for 'fd' 14:42:48 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) r1 = fspick(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f00000001c0)='\\2-.){&](){-[/\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:48 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c75cc6f00705f69643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1639.772793][T15171] fuse: Bad value for 'fd' 14:42:48 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1639.861794][T15182] fuse: Bad value for 'fd' 14:42:49 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x3f000000) 14:42:49 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c75cc6f00705f69643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1639.884901][T15180] overlay: Unknown parameter 'subj_role' [ 1639.898878][T15184] overlay: Unknown parameter '\' [ 1639.926792][T15180] overlay: Unknown parameter 'ÿÿÿÿ' 14:42:49 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) r1 = fspick(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f00000001c0)='\\2-.){&](){-[/\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:49 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x89000000) [ 1639.974834][T15194] overlay: Unknown parameter 'subj_role' [ 1640.000699][T15196] overlay: Unknown parameter 'ÿÿÿÿ' [ 1640.009411][T15198] fuse: Bad value for 'fd' 14:42:49 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030306371a95d3030303030303030302cf57365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000001380)={0x0, 0x100000000, 0x100000001, 0x1}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x14, @unused=[0x100000080000001, 0x401, 0x2, 0x7955c5ab], @devid=r2}) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r4, 0x800c6613, &(0x7f0000000180)=@v1={0x0, @aes128, 0x3, @desc4}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) faccessat(r1, &(0x7f0000000040)='./file0\x00', 0x90) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1640.029303][T15199] overlay: Unknown parameter '\' [ 1640.098834][T15204] fuse: Bad value for 'fd' 14:42:49 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x10b900, 0x0) read$ptp(r0, 0x0, 0xfffffe04) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) read$ptp(r2, &(0x7f0000000100)=""/64, 0x40) (async) read$ptp(r2, &(0x7f0000000100)=""/64, 0x40) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) openat$smackfs_logging(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:42:49 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) r1 = fspick(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f00000001c0)='\\2-.){&](){-[/\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) 14:42:49 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000280)=ANY=[@ANYBLOB="9c2d5a1f43038981a7fa32dd15fbfb6e2f6f000010000000000000"], 0xffffffffffffffff, &(0x7f0000000140)={0x9, 0xc000000000000000, 0x7ff, 0x100000000, 0x200, 0x10001, 0x4, 0x4, 0x7}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) (async) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000280)=ANY=[@ANYBLOB="9c2d5a1f43038981a7fa32dd15fbfb6e2f6f000010000000000000"], 0xffffffffffffffff, &(0x7f0000000140)={0x9, 0xc000000000000000, 0x7ff, 0x100000000, 0x200, 0x10001, 0x4, 0x4, 0x7}) (async) 14:42:49 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c75cc6f00705f69643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:49 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x91000000) 14:42:49 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030306371a95d3030303030303030302cf57365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000001380)={0x0, 0x100000000, 0x100000001, 0x1}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x14, @unused=[0x100000080000001, 0x401, 0x2, 0x7955c5ab], @devid=r2}) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r4, 0x800c6613, &(0x7f0000000180)=@v1={0x0, @aes128, 0x3, @desc4}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) faccessat(r1, &(0x7f0000000040)='./file0\x00', 0x90) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030306371a95d3030303030303030302cf57365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000001380)={0x0, 0x100000000, 0x100000001, 0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x14, @unused=[0x100000080000001, 0x401, 0x2, 0x7955c5ab], @devid=r2}) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) (async) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r4, 0x800c6613, &(0x7f0000000180)=@v1={0x0, @aes128, 0x3, @desc4}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) faccessat(r1, &(0x7f0000000040)='./file0\x00', 0x90) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:49 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xa1ffffff) 14:42:49 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd?', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x1000, 0xad3) epoll_create1(0x0) [ 1640.742409][T15209] fuse: Bad value for 'fd' [ 1640.751029][T15216] overlay: Unknown parameter 'subj_role' [ 1640.764008][T15216] overlay: Unknown parameter 'ÿÿÿÿ' [ 1640.779153][T15213] fuse: Bad value for 'fd' 14:42:49 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) fspick(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x0) 14:42:49 executing program 5: write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)={[{0x2d, 'freezer'}, {0x2b, 'rdma'}]}, 0xf) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1640.799116][T15213] fuse: Bad value for 'fd' 14:42:49 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030306371a95d3030303030303030302cf57365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000001380)={0x0, 0x100000000, 0x100000001, 0x1}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x14, @unused=[0x100000080000001, 0x401, 0x2, 0x7955c5ab], @devid=r2}) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r4, 0x800c6613, &(0x7f0000000180)=@v1={0x0, @aes128, 0x3, @desc4}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) faccessat(r1, &(0x7f0000000040)='./file0\x00', 0x90) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030306371a95d3030303030303030302cf57365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000001380)={0x0, 0x100000000, 0x100000001, 0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x14, @unused=[0x100000080000001, 0x401, 0x2, 0x7955c5ab], @devid=r2}) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) (async) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r4, 0x800c6613, &(0x7f0000000180)=@v1={0x0, @aes128, 0x3, @desc4}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) faccessat(r1, &(0x7f0000000040)='./file0\x00', 0x90) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:49 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xe4ffffff) [ 1640.888437][T15234] fuse: Unknown parameter 'fd?0xffffffffffffffff' [ 1640.931114][T15236] overlay: Unknown parameter '\' [ 1640.963235][T15239] fuse: Bad value for 'fd' [ 1640.983870][T15239] fuse: Bad value for 'fd' 14:42:50 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x10b900, 0x0) read$ptp(r0, 0x0, 0xfffffe04) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) (async) read$ptp(r2, &(0x7f0000000100)=""/64, 0x40) (async) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) (async) openat$smackfs_logging(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000040)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:42:50 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:50 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd?', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async, rerun: 64) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async, rerun: 64) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x1000, 0xad3) (async) epoll_create1(0x0) 14:42:50 executing program 5: write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)={[{0x2d, 'freezer'}, {0x2b, 'rdma'}]}, 0xf) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:50 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xfbffffff) 14:42:50 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:50 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xfeffffff) 14:42:50 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mknodat$null(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:50 executing program 5: write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)={[{0x2d, 'freezer'}, {0x2b, 'rdma'}]}, 0xf) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1641.676460][T15253] fuse: Unknown parameter 'fd?0xffffffffffffffff' [ 1641.676655][T15254] fuse: Bad value for 'fd' 14:42:50 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:50 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd?', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async, rerun: 32) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (rerun: 32) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x1000, 0xad3) (async, rerun: 32) epoll_create1(0x0) (rerun: 32) 14:42:50 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xffff8000) 14:42:51 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.controllers\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x8000, 0xfffffffb) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000000100)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r5, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) write$damon_monitor_on(r6, &(0x7f00000001c0), 0x3) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) fsmount(r5, 0x0, 0x1) r7 = open_tree(r1, &(0x7f00000000c0)='./file0\x00', 0x1000) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r7, 0x84009422, &(0x7f00000008c0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {}, {0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f00000004c0)={r8, 0x8, 0x5}) read$ptp(r0, 0x0, 0x0) 14:42:51 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mknodat$null(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:51 executing program 5: mount$pvfs2(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x10000, &(0x7f00000001c0)={[{'.\\'}], [{@obj_user={'obj_user', 0x3d, '{,-{\''}}]}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:51 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:51 executing program 3: openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d7b79b378058c65051dbdaf78faed48f3e1f67d697a25316475eda1ae9709542c011ae21b83ad59613f731113e32ae7dfcccca05f328c438152bf7d8ace5c6b3872901e183fa31e7d2024cb394427840c087bdfe4c8106e516c7c4bf99d0307716b79f60a9a89c05434f016920ff07e42441f043ce809f8dbde088246fc77343247fa0e197635ff5a980e7ed9effe79a09f1fda", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000240)={@id={0x2, 0x0, @b}}) unlinkat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000900000009000000000000008000000000000000ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) linkat(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x400) 14:42:51 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xffffff7f) 14:42:51 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xffffffa1) 14:42:51 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000000)='./file0\x00', 0x0) 14:42:51 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mknodat$null(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:51 executing program 3: openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d7b79b378058c65051dbdaf78faed48f3e1f67d697a25316475eda1ae9709542c011ae21b83ad59613f731113e32ae7dfcccca05f328c438152bf7d8ace5c6b3872901e183fa31e7d2024cb394427840c087bdfe4c8106e516c7c4bf99d0307716b79f60a9a89c05434f016920ff07e42441f043ce809f8dbde088246fc77343247fa0e197635ff5a980e7ed9effe79a09f1fda", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000240)={@id={0x2, 0x0, @b}}) (async) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000240)={@id={0x2, 0x0, @b}}) unlinkat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000900000009000000000000008000000000000000ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) linkat(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x400) (async) linkat(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x400) [ 1642.564130][T15283] fuse: Bad value for 'fd' [ 1642.575925][T15287] fuse: Bad value for 'fd' [ 1642.591802][T15289] overlay: Unknown parameter '\' 14:42:51 executing program 5: mount$pvfs2(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x10000, &(0x7f00000001c0)={[{'.\\'}], [{@obj_user={'obj_user', 0x3d, '{,-{\''}}]}) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) mount$pvfs2(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x10000, &(0x7f00000001c0)={[{'.\\'}], [{@obj_user={'obj_user', 0x3d, '{,-{\''}}]}) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) 14:42:51 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000000)='./file0\x00', 0x0) [ 1642.641210][T15292] fuse: Bad value for 'fd' [ 1642.720847][T15298] fuse: Bad value for 'fd' [ 1642.729521][T15300] fuse: Bad value for 'fd' [ 1642.750289][T15302] overlay: Unknown parameter '\' [ 1642.768064][T15305] overlay: Unknown parameter '\' 14:42:52 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.controllers\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x8000, 0xfffffffb) (async) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x8000, 0xfffffffb) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) (async) fstat(r2, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000000100)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r5, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) write$damon_monitor_on(r6, &(0x7f00000001c0), 0x3) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) fsmount(r5, 0x0, 0x1) open_tree(r1, &(0x7f00000000c0)='./file0\x00', 0x1000) (async) r7 = open_tree(r1, &(0x7f00000000c0)='./file0\x00', 0x1000) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r7, 0x84009422, &(0x7f00000008c0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {}, {0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f00000004c0)={r8, 0x8, 0x5}) read$ptp(r0, 0x0, 0x0) (async) read$ptp(r0, 0x0, 0x0) 14:42:52 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:52 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xffffffe4) 14:42:52 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000000)='./file0\x00', 0x0) 14:42:52 executing program 3: openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d7b79b378058c65051dbdaf78faed48f3e1f67d697a25316475eda1ae9709542c011ae21b83ad59613f731113e32ae7dfcccca05f328c438152bf7d8ace5c6b3872901e183fa31e7d2024cb394427840c087bdfe4c8106e516c7c4bf99d0307716b79f60a9a89c05434f016920ff07e42441f043ce809f8dbde088246fc77343247fa0e197635ff5a980e7ed9effe79a09f1fda", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000240)={@id={0x2, 0x0, @b}}) unlinkat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000900000009000000000000008000000000000000ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) linkat(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x400) openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d7b79b378058c65051dbdaf78faed48f3e1f67d697a25316475eda1ae9709542c011ae21b83ad59613f731113e32ae7dfcccca05f328c438152bf7d8ace5c6b3872901e183fa31e7d2024cb394427840c087bdfe4c8106e516c7c4bf99d0307716b79f60a9a89c05434f016920ff07e42441f043ce809f8dbde088246fc77343247fa0e197635ff5a980e7ed9effe79a09f1fda", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000240)={@id={0x2, 0x0, @b}}) (async) unlinkat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x200) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000900000009000000000000008000000000000000ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) (async) linkat(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f00000002c0)='./file0\x00', 0x400) (async) 14:42:52 executing program 2: mremap(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000, 0x7, &(0x7f0000ffd000/0x1000)=nil) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:52 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xfffffffb) 14:42:52 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) [ 1643.500777][T15311] fuse: Bad value for 'fd' [ 1643.507849][T15312] fuse: Bad value for 'fd' [ 1643.524520][T15312] fuse: Bad value for 'fd' 14:42:52 executing program 5: mount$pvfs2(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x10000, &(0x7f00000001c0)={[{'.\\'}], [{@obj_user={'obj_user', 0x3d, '{,-{\''}}]}) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:42:52 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x40}}, './file0\x00'}) unlinkat(r1, &(0x7f0000000100)='./file0\x00', 0x200) 14:42:52 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xfffffffe) [ 1643.575099][T15302] orangefs_mount: mount request failed with -4 [ 1643.589060][T15325] fuse: Bad value for 'fd' 14:42:52 executing program 2: mremap(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000, 0x7, &(0x7f0000ffd000/0x1000)=nil) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1643.660086][T15329] overlay: Unknown parameter '\' [ 1643.702128][T15335] fuse: Bad value for 'fd' [ 1643.710592][T15336] fuse: Bad value for 'fd' 14:42:53 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000200)={0x0, 0x7}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000600)={r6, 0xffffffffffffffff, 0x1, [0x3, 0x666, 0x0, 0x3, 0x8], [0x8, 0x10001, 0x100, 0x8, 0x6, 0x9, 0x80000000, 0x9, 0x3, 0x3ff, 0x8, 0x3, 0x3, 0x1, 0x5, 0x7, 0x0, 0x5, 0x1, 0x5, 0xfffffffffffffff9, 0x0, 0x5bf3, 0xe8, 0xd575, 0x1, 0x10000, 0xffffffffffff0001, 0x1, 0x10000, 0x9, 0x80, 0x3, 0x5, 0x2, 0x0, 0x3, 0x6, 0xf95ce27, 0x5, 0x80000000, 0x2, 0x10000, 0xfd, 0x8, 0x3, 0x400, 0xffffffffffffff80, 0x5059e2fc, 0x3, 0x0, 0x8, 0x1, 0x0, 0x5, 0x6, 0x8001, 0xffffffffffffff01, 0x20, 0x98e, 0x5, 0xc7, 0x7f, 0x7, 0x80000000, 0x8000, 0x1, 0x21a, 0x8, 0xcc, 0xcc9c, 0x3, 0x7, 0x6, 0x10000, 0x7, 0x2, 0xfffffffffffffe00, 0x19ff, 0x1000, 0x1, 0xa1, 0x8, 0x8, 0x4f60, 0x5, 0x6, 0x8, 0xc5ca, 0x37, 0x697, 0x4, 0xd90, 0x5, 0xfffffffffffffffc, 0x9, 0x6, 0x7ff, 0x2, 0x254, 0x9, 0x1, 0x7fffffffffffffff, 0x8, 0x29e, 0x5, 0x3, 0x8, 0x6, 0x9, 0x0, 0x3, 0x7fffffff, 0x4, 0x951c, 0x101, 0x0, 0x6, 0x800, 0x9, 0x7f]}) 14:42:53 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x40}}, './file0\x00'}) unlinkat(r1, &(0x7f0000000100)='./file0\x00', 0x200) 14:42:53 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x1000000000000) 14:42:53 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:53 executing program 2: mremap(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000, 0x7, &(0x7f0000ffd000/0x1000)=nil) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mremap(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000, 0x7, &(0x7f0000ffd000/0x1000)=nil) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:53 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.controllers\x00', 0x0, 0x0) mknodat(r1, &(0x7f0000000040)='./file0\x00', 0x8000, 0xfffffffb) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) (async) fstat(r2, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000000100)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) (async) fstat(r3, &(0x7f0000003880)) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r5, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) write$damon_monitor_on(r6, &(0x7f00000001c0), 0x3) (async) write$damon_monitor_on(r6, &(0x7f00000001c0), 0x3) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) fsmount(r5, 0x0, 0x1) r7 = open_tree(r1, &(0x7f00000000c0)='./file0\x00', 0x1000) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r7, 0x84009422, &(0x7f00000008c0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {}, {0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f00000004c0)={r8, 0x8, 0x5}) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f00000004c0)={r8, 0x8, 0x5}) read$ptp(r0, 0x0, 0x0) (async) read$ptp(r0, 0x0, 0x0) [ 1644.403835][T15342] fuse: Bad value for 'fd' 14:42:53 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x4000000000000) 14:42:53 executing program 0: syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:53 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1644.433337][T15343] fuse: Bad value for 'fd' 14:42:53 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x40}}, './file0\x00'}) unlinkat(r1, &(0x7f0000000100)='./file0\x00', 0x200) [ 1644.498448][T15351] overlay: Unknown parameter '' 14:42:53 executing program 0: syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:53 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) (async) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) (async) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) (async) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000200)={0x0, 0x7}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000600)={r6, 0xffffffffffffffff, 0x1, [0x3, 0x666, 0x0, 0x3, 0x8], [0x8, 0x10001, 0x100, 0x8, 0x6, 0x9, 0x80000000, 0x9, 0x3, 0x3ff, 0x8, 0x3, 0x3, 0x1, 0x5, 0x7, 0x0, 0x5, 0x1, 0x5, 0xfffffffffffffff9, 0x0, 0x5bf3, 0xe8, 0xd575, 0x1, 0x10000, 0xffffffffffff0001, 0x1, 0x10000, 0x9, 0x80, 0x3, 0x5, 0x2, 0x0, 0x3, 0x6, 0xf95ce27, 0x5, 0x80000000, 0x2, 0x10000, 0xfd, 0x8, 0x3, 0x400, 0xffffffffffffff80, 0x5059e2fc, 0x3, 0x0, 0x8, 0x1, 0x0, 0x5, 0x6, 0x8001, 0xffffffffffffff01, 0x20, 0x98e, 0x5, 0xc7, 0x7f, 0x7, 0x80000000, 0x8000, 0x1, 0x21a, 0x8, 0xcc, 0xcc9c, 0x3, 0x7, 0x6, 0x10000, 0x7, 0x2, 0xfffffffffffffe00, 0x19ff, 0x1000, 0x1, 0xa1, 0x8, 0x8, 0x4f60, 0x5, 0x6, 0x8, 0xc5ca, 0x37, 0x697, 0x4, 0xd90, 0x5, 0xfffffffffffffffc, 0x9, 0x6, 0x7ff, 0x2, 0x254, 0x9, 0x1, 0x7fffffffffffffff, 0x8, 0x29e, 0x5, 0x3, 0x8, 0x6, 0x9, 0x0, 0x3, 0x7fffffff, 0x4, 0x951c, 0x101, 0x0, 0x6, 0x800, 0x9, 0x7f]}) [ 1644.521491][T15356] fuse: Bad value for 'fd' 14:42:53 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) [ 1644.597140][T15362] fuse: Bad value for 'fd' [ 1644.647041][T15364] overlay: Unknown parameter '' [ 1644.671838][T15368] fuse: Bad value for 'fd' [ 1644.679779][T15368] fuse: Bad value for 'fd' 14:42:54 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x10000000000000) 14:42:54 executing program 0: syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:54 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000380)=ANY=[@ANYBLOB="011800000100000018000000831e8c9139211ad20bfe1d44f449c6c5361fadc81fc8", @ANYRES32=0xffffffffffffffff, @ANYRES64=r0, @ANYRESOCT=r0, @ANYBLOB="01ef73d9ab5880416792b358614bcf0f2ee4505fb5dc48a0d45f918fb3fd4a99a24f08469e3bb461c413e36d4c852caa92314f8e2f3d03170e27261c708d4db84be5493dc57e4a091425d3501afd5938a69379233696d478549b92714aafb98e46eb751d89764c99f359555ae86986a9a4a8c1acdfec75ab867f6a718f7c7ad29ef6159e4da2461d5657fa189024009d2440e72f6a1cfb27f22684288f5c2a8880477625285688b00e70613e624b364ac2ac331b6344229122705a007ac78d31512869d12e7998c0e6ad00948146feacafae", @ANYRES64=r0]) fchmodat(r1, &(0x7f0000000100)='./file0\x00', 0x108) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = fsmount(0xffffffffffffffff, 0x1, 0x0) r6 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000340)={{r6}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r7 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r7, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r7, &(0x7f0000000180)={0x10}) r10 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r10}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001380)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff000000000000000000000000000000000001000000000000000000000000005581c8ca7541bd06a8ca41f60b43e13f193b44cf01429c"]}, @subvolid=0x1}) r11 = fsmount(0xffffffffffffffff, 0x1, 0x0) r12 = openat$incfs(r2, &(0x7f00000024c0)='.log\x00', 0x424000, 0x13d) ioctl$BTRFS_IOC_RM_DEV_V2(r11, 0x5000943a, &(0x7f0000000340)={{r12}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r12, @ANYBLOB="04653a597fa97f3121fad97c60f2d97b6e593000"]) openat$cgroup_pressure(r12, &(0x7f0000000200)='cpu.pressure\x00', 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r6, {r8, r9}}, './file0\x00'}) r13 = openat(r12, &(0x7f0000002500)='./file0\x00', 0x141000, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r12, 0x50009418, &(0x7f00000014c0)={{r13}, 0x0, 0x0, @inherit={0x78, &(0x7f0000001440)={0x1, 0x6, 0x1, 0x9, {0x25, 0xd97a, 0x5, 0xe8e, 0x9}, [0xcfc, 0x5, 0x1f, 0x3, 0x1, 0x3d]}}, @name="9586cef2e84e8229ab92c2592af53171fe4cace30eb7c7d40ea75edb2d6457c4a6fbb8f55c8928b20e1c7fdde6ea83d53b1e4092c085edcb87457c13c141aaa45d9d5b1c6fbfeec8234144e48deb63b8ed4ca196b6e87e95c3f37480405a40d7bb75949fb347e2ff6c5eb7c09bf096b5ee7431217d6ac7dab76d40bfa2e5736a5933225e8b44f40045921ca20c3db8d9b1ff26bd52a99c9ff3587a456a1e17a4c8b16e64268dc22935a9ab7c252984b189e594ff508ffe34b67bad96c3119da894beba4ce0a6dbd28a5efc94ba52ea116e0e3b34a5b70dac828239d88ad9e1c234bf7d13f70f56860d8421f3238b7dc5d71463f3740177fe97b4d399a8bfab327042a445c60a69fe3602fd904fdff064d8042ace3e17a9c196834c0a4c70a30c7ea9e3b64a0c23f4078f3c0f1af0cb1ac89fff9ebb6bdc1ba370d3a5967aaa241b1c61da75c70bb17cdc64193a20135b30b85a7bd834326f92e2a58be28ebeed5b7cab143549a16225ac3227d4563437ec1c318719720f7dbd2ffd71b00d31d2cc97c0efcf162ef033ca4b90c349e17131566bfe2c9f6fe921eb828c057be5b48759e2419a98f226b5ccc7f554ebfe48cd11975e412a1fa6dee2d358b2453d957c9c72427edd6c0382e6f2371ef6e76f383953393b1617bb646881450db01d12bce5b0494041a9afcb12eef303e1bb8c3b3606db633a29095059f45a65fc7ca446bd67593c2b44f6f76addce4c05c68453232fe439ea0dc6702067c7816f415b9b5b572b1c4a337010c53af374e648747d6d1b3392dc71a096f9f0ad1a7f9b21ad22882c757ac84eb549cd89febace61b61b1371400a8cdd733d818e5191aca9e1ffaa43c95b5ede01543bcf8013ffbd390860b9cbfd1eb00a8388608b2c1bda32a4128e1142251e9a3d0de35b34e26cf00c298174bce2b636afdd0dd16eed3f0e8c72dabd1a68932b65cf0f776934d20028f0982a192db61a294d075095c2b9bd61b14aa623298c0495a26f4948fa2c09aebdefac45b72370c3a6941d926140a25a98df7e30175d4d800a8d82c58acf11e3a203f2dce19c08455759121b85843eaa9a2c6825635fb2fbd51983eaad058adabdb8e93b5ffb71a400a1dfeaae5a430e6f108a14bd97246db521196c81af6ad78ffde229f6b5f24a9dc5cc56a97d33fb811342e9627e25b8ed1439984572361115fd2ded795f0389e37549a9ed3fa35a61d97caa08c3e070cdd16d41f684ad0ccee85a731cf4614e5f8840231f7e661cbfabc6eef1263f4693a2515746e37a3142cdf9ee5dc88f6ee3a35e0558fd8952e79e48806e5e939ac9182de5c91df769084b0ff089fa76d0f1b19e3556904fab3d26e2cb7b53624c51215e84ccafd5eee9cbbdb6a1e7bb0207537c7a1bc6c3ca9e8c05db36ebeebc536adefe0492970e59c47fed193849d00c100968791129f4253d9be5039669cf3bac4410635296d509dc5688cc42418553885ec18029a1fc1c3b95553ee2e163dc1f97c75ae6949648ab26a2d021ffa6b2c2d2377e3e941a21cf3f8bd9c1c8e13da1a688e2e4b33ad6e44d6cf2b3d819125210b53d8b309e6a512971e470c9e157307b0f2e4062d33f9ac3897079e448374f41ae9d92df0437ea338ee42db99c41d46f88989deb81505187378e871f2ff3ae21ed79f306035eb847c13c12115cf8e15e2c670e199cc427a9d55de19b15281aaad98eab1ca2add1a66ecf8b4fb2a071c59ef28f98af650823017b86d7eaaddc4e7a5ffe53e77cfb0de2d53c24c8e662875fe60cd2ec4c1249e7916c9bcbc925d8cb3e121f09e916dfe781449e18df83793d3a7a3a198d4f56c99b1dc0b6d78b4107c921b44720af008014d0d7e4f49cd159ed8ad85eecc9804d79afa688f8fab2f807fd412d76c6db3e001ea10a3435885c079022371e13ac2028e107203b4fbc2b0d218f4e663f0ab0cba5aead33963cbdbac766ed56538c896d5615ca82371b2969714fd1e3c9af802094e6996a51bbc25e07696f0119142944d77757610d2b1806cc996d94923beab6b33f0c442c466660af041b018ba6c020409cf5d1418b4b6c0a697a7640d1b2993e5269e6965ca05e3bb7ea8b0845c36331daaf3ae095e51c59ac575a2cf61427bacc6b8dff33945eda3096b576e96baa64aa076c4468df5d705eba8b9592b745250664e4f70ba2e9367c2755f80769e2f7148fca7eb9d0cd8a26773f6f1ad21dfe6a11d8360f0db69e0f9e12de66a167cfd2df377116ec1fb05476ebf2a4b639676bf9f2d6f9b68b9e0b9af2f5b4f47749eead1a3e9d026e30844774baf8afb791b142cc7f601f7ea3f7982abdc7d6f20d2a02359157bce75bc48328eca9cb6c4fb9f2ea1afe750ffe08977c0a6c7fa2203b985b3c883901f3228a3f40a5edeb0db8b5f908960dfdb9066f51e2fe2e9d8ecd525e54e184f2904e6f6d2afd8a31ea21f4264c50b98ccfdea8153aca412c7d8689b82845f9323e40efd5be9629f01dcd1b84a9692d8308dafda9e263859c47eac019afecac8864dd8e4efc37257ebcc0a2e9ca70d0ee760d23e1356bf099e13a2e7e8fd1994e05d829f9fc67d6f532a9b5018f1cac5f663a8c7f62719658f4e918ee26b06f0c0a868c9920c03bde8c98b841bfd0fdf8f29da18935d93523d433351fcba237c9aaa8f4b1d1dd35381662cd31947cd87ca8491196cb8394cd784888cd0d87294033eb17482a3ddba6caf21f9e07eb4546bfbab04ca93a237a12d7b2ec9d130672502b7e5e58496c9d432a6fcee4988fc9232a419eeb61cdcff22df405b534a32f8c086dae5b93cad34c3b00e99b129c4b597da4c3fab46be046b4a42b4176ba2adba0c272c4bbebd61216f0db74eaa3009cad4208eae8db0168752f29afc16ffa1c756f8fe5cc1939dc532eec60154c5c8d7fde1af5bd58661ab292e47416ddda58f08364b2e7042feb4a21c4da2f30d506f063313ebfca07cfe2e395967539050cbe94b876779851255f761722bb0e493ca03b03828b6b9f889405fcaa9f2d6e57ac29361bec1f5a2938182d2a6d8b6d45d1feedb83ac02c4da62c4cea644a62a31f8981b19ea093378a21bfdd1b3ec850d1fef5aecca5ab79a92a91b5f30af69b36a6a2f060738be50cc989e5539ea57eea1e74124cc0b68bf145ad6be606c04e6a9ffb979b195f8035f97465d5b2472625332b763286d7fe4e71924158faf710dca6916dc520ba9a389fbe2ab785b932721dccdf435d0c11ab722d63adec972327ed83aed7d3e8ba1d6e38bfbdbf29008cc7528e136aa7072fb283cee408dcabfded091780ef42880ed8df352ea2acb90105bd2ef41481b57502490ad3626e16f5c621c868b0e7d5ea668dfec4f842e00968771cfc14df3ce5782503cf437327caef383aa80a27602b7dd06d7a8ea37b7b8d5ea10c86009558b6a7fec4bb91456fcafa548e30f2d502a7bc6997c4b09c2f9fecf248f7957c4f78486f4c27484fdd6b1fb6eaaa314432ebe961b3ecfd933cbfdb7c268347bf1b2c942b1c1d494e739bef524785d7185922d9294463af0a5f006b7e2c6891a7090207fb8f16e6323d6e5d6951d850c91dec787d869ebab2c12850cb913f33914c243cd1302ad6e4b1d175164be1a036807956c5f3770fc164c5d8e47ba7c615ae23236c62ec4c316e3b23e558e6b6e307184e966a30615a50c0e7bd836135f72c3a1955ef597d4d7b74ca7819ca2698a6507734add4fe1c58feb009a369185c0413164f6dbe14b850994d433636f0336bd2d93b4f2cd1f205e5e5f6920f24daf310f2e64b55e694fedf4046a63b714bb61d90d72e9ac182a9a009b91f95ffd5b9973e31a29cd06f31e816638a991cf4f3669a037e9663e98ae0eeaa218933c5492f96888f2144a9bc73dbc89c81ad7fd7485602b78a631b4c61542a1274d37d44a50d3d73a606cf93e0b2091fbf9f1bc9c8e022395766b831331d2a0efc52faf4aea26c877c3af0596419b13e1c25405bd60a9070d6a8c10326e3c2d6016c917c2ee53dccb4c579615f5c74fddb28fb0f2288f81eaa13726499b1556b30e504559959a69062413d01e12eacde3dfb6e96ea64d1dba88cf06b48530dd526dbd20bd3b4242044f72509dcac88dd8c2336ca3cd3d40e97bfa17fa22760aede3d1fe5eea0be432cd7cedf0efd65e6d59732b2d2452188f70ee89abc0e355a28f1e74eff2764399db0b648ca69726a076ae93b46960329e47cdad7a80413776ad6026d19696947f1bd2ed9c31b96b549ea5f43199d1017339cc0371b15e74e9d1605357e471abe48d0d2e647b6e25a054ad525000ea4012443366e7fd2fa01b43cef9311382d4a82a6442350e907d4404084e6dd105659840f77af34e13f3485db416cf00127adba241c5df2782b47ad1ac6b4555829a07bbe257acdde88dc8e8231fe161e170e05dc51e0c202022ebcfa02f1ce16df454a14026651acbfec11cf4893d2bc94fbb18d3dc1e05e9fee765c5c4c6199a89c2f065ceae1c0282fa4a2d15aeea836c05ac92ddca3877f4764c1453734850beea586278fc7cc80c61bccc36ccc28347a06458a5c643528ff81c09838c533d53837b909b5f9d40ddb83636ffd529604c13e9ccd7324ec3a49689d41d44654b99519e4c313bebaada5d923dd6f35ffe865fec89b9f7861bb23c0e8cd23c65576b57fcb7973ef01d5785ada046d6432b141d293741e85e35d941da92f552e15b7c3ae6c312511fb0b91080589b37c66a0789e2eccea8afd7dc0e205b289c2f2b9b110d5717db11d8aa01a2b5e6cc292ccd0a74a51062dd7fe487caa4cfade39586f75bd0e84feec11ff81b7eeb1933a9e5c7f3a6d677f03ebdb12512b1e9d622d6ba4729063a5a335a05b08d98b319f655c62a968bc4756be03589fb1f4e2e7c7e0d4cc2dc78df9f2af2c6816de91da156d2fe38808bd73aabdc18a62aed19d03dd06f6b0d2af720a4edb53cb6cecea5319305dc2e56181b299ffba2eacd026a49b81df1c6f9b859a1887878330750498e56de7c4d11023a0833d0cd6b0b45688e074e66257adadbce315a836cc4a2b8f1365361344dc626bdce243164b04675b96bead6a1d22985bc86a1f1648bf985da981dd45f540a8b0557c6748a3518d7dd3155e65e7ff724c1ad7e73b31d1ddb00182e2bbb83393788feaf0515f7b6794f113ddb9d1d827d8b2846b3e5d330b84da16bae15e6e06c1513f059dcbc2ea94236cf6eaa248bf3771b653bd1b20c510e78fc0d083dcd0eae3bb21bd2ee35b40e11b8723359ad0334d868a9ec712faf5ccbc25adf0c99028aea92f59e4f5701f5f823249dab57d60bb8d0a1e356b6698b56b43b890304e6181ab379f2d05948683208d48a4a68ab1563bd1141d5506e7fe64aebbc0f61acdffdaccbfb7b580f33e6c94768b9e90e9bc4f0079a3d8e9d08e25fe43c78cd5ac3da3ade0fb001f64c6cc6feb0d18e93dee40524168e108299a338b218f0a5de2c365abf45d9d782d768e44f103b0ee4e897859d67ea339f37b9bb0fedd49ba960c03a40a0187479230cdfb55abb9090bd26aee5eb5912ca8678488fc3eb436bcf55bb4c16c73ebcf324748dff2597a97c956c9b91a326262325238e175a0c580197669dd800ed97720bd013d81a16770050e198e7fc1b02ce72c6c8d500c9818aff7d2847c016a6a6b8acaa9abdddb8fa96598e1ed1f94cc9f9af099c9dda158720db829"}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r10, {0x4}}, './file0\x00'}) mount_setattr(r3, &(0x7f0000000040)='./file0\x00', 0x8900, &(0x7f0000000140)={0x100000, 0x1000fb, 0x1a0000, {r10}}, 0x20) 14:42:54 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) (async) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) (async) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) (async) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) (async) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000200)={0x0, 0x7}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000600)={r6, 0xffffffffffffffff, 0x1, [0x3, 0x666, 0x0, 0x3, 0x8], [0x8, 0x10001, 0x100, 0x8, 0x6, 0x9, 0x80000000, 0x9, 0x3, 0x3ff, 0x8, 0x3, 0x3, 0x1, 0x5, 0x7, 0x0, 0x5, 0x1, 0x5, 0xfffffffffffffff9, 0x0, 0x5bf3, 0xe8, 0xd575, 0x1, 0x10000, 0xffffffffffff0001, 0x1, 0x10000, 0x9, 0x80, 0x3, 0x5, 0x2, 0x0, 0x3, 0x6, 0xf95ce27, 0x5, 0x80000000, 0x2, 0x10000, 0xfd, 0x8, 0x3, 0x400, 0xffffffffffffff80, 0x5059e2fc, 0x3, 0x0, 0x8, 0x1, 0x0, 0x5, 0x6, 0x8001, 0xffffffffffffff01, 0x20, 0x98e, 0x5, 0xc7, 0x7f, 0x7, 0x80000000, 0x8000, 0x1, 0x21a, 0x8, 0xcc, 0xcc9c, 0x3, 0x7, 0x6, 0x10000, 0x7, 0x2, 0xfffffffffffffe00, 0x19ff, 0x1000, 0x1, 0xa1, 0x8, 0x8, 0x4f60, 0x5, 0x6, 0x8, 0xc5ca, 0x37, 0x697, 0x4, 0xd90, 0x5, 0xfffffffffffffffc, 0x9, 0x6, 0x7ff, 0x2, 0x254, 0x9, 0x1, 0x7fffffffffffffff, 0x8, 0x29e, 0x5, 0x3, 0x8, 0x6, 0x9, 0x0, 0x3, 0x7fffffff, 0x4, 0x951c, 0x101, 0x0, 0x6, 0x800, 0x9, 0x7f]}) 14:42:54 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:54 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/class/cuse', 0x6e0341, 0x38) read$ptp(r0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) fsmount(r0, 0x1, 0x2) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$smackfs_relabel_self(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x83, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) r4 = fsmount(r3, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff000000000000000000000000000000e33b0100"/80]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) unlinkat(r5, &(0x7f0000000140)='./file0\x00', 0x200) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)) r7 = openat$cgroup_pressure(r1, &(0x7f00000001c0)='io.pressure\x00', 0x2, 0x0) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r7}, 0x0, 0x4, @unused=[0x1, 0x7fff, 0xe1, 0xffff], @subvolid=0x1}) epoll_pwait2(r1, &(0x7f0000000040)=[{}], 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100)={[0x2]}, 0x8) [ 1645.319178][T15371] overlay: Unknown parameter '' 14:42:54 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) [ 1645.343130][T15378] fuse: Bad value for 'fd' 14:42:54 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="5c1ff5bd558f4b21fbaa10204ebdc8d580295c2ceae06295eecbe8436379ee0221fee4c6e9289465f8e41c1224c763562a901c3618fe0d1c6ab2ff4b69eb6e0f9ff78c65e153ca859b5c454f4b846ef615c70400b1c156b90c48aef791415744d49e04299ee1b5b99ff4ee5f128e107172ef8db22544bbde9bc5a8994442790bba541b4f798321844145214eadfeac2dafaee343dcef6c0e26ce4de4ecc08139340ca3e6f29ba3edde0c88350947b6d7559fc5cc317a1961a5be6a4725906a0e3d80769de1b7f3f32079ecc6079bb7da567682aabff4e123efd9e52f63961a469593a55fec0e936dfd1dd6466434491e9c4fcb455cf55106b4b0411bd8e98b60f7ebfc"]) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) fstat(r2, &(0x7f0000003880)) fstat(r1, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) [ 1645.374250][T15383] fuse: Bad value for 'fd' 14:42:54 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'], 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = fsopen(&(0x7f0000000280)='coda\x00', 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000001380)={0x0, 0x7, 0x0, [0x4, 0x6, 0x7, 0x400, 0x100000000], [0x2, 0x4, 0x3, 0xfc, 0x6a, 0x0, 0x1, 0x7fffffff, 0x7fffffff, 0x7, 0xffffffffffffffff, 0x9, 0x3, 0x100, 0x453, 0x1cb0000, 0x1, 0x5, 0x101, 0x7, 0x5, 0x800, 0x4, 0x9, 0x1, 0x0, 0x7, 0x6, 0xe44, 0xffffffffffffffff, 0x7, 0x1, 0x40, 0x5, 0x8, 0x5f, 0x1f, 0x401, 0x0, 0x7ff, 0x1, 0x1ff, 0x1, 0xffffffffffffffff, 0x5, 0x7fff, 0x700000000, 0x6, 0x7, 0x1ff, 0x5, 0x5, 0x8, 0x1231249f, 0x5, 0x1, 0x0, 0x3, 0x6, 0xff, 0xe0, 0x1, 0x3, 0x3a, 0x4, 0x7, 0x3, 0x8000, 0x1ff, 0x8, 0x3, 0x5, 0x7, 0x1f, 0x8, 0x7fff, 0x1, 0x5, 0x7, 0x2, 0x9, 0x20, 0x4, 0x10001, 0x1f, 0x1, 0x36, 0x4, 0xffffffff, 0x7fffffffffffffff, 0x5, 0x4, 0x3, 0x800, 0x4, 0x5, 0x540, 0xd8, 0x7f, 0x7fff, 0x9, 0x74f4a111, 0x8, 0x7, 0x6, 0x2, 0x0, 0x4, 0x2, 0x7, 0x0, 0xffffffffffffffc1, 0x59, 0x5, 0x4, 0x7fffffff, 0x6, 0x8, 0x3, 0x0, 0xffffffffffff8000]}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x31, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1}}, {@blksize={'blksize', 0x3d, 0xc00}}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@fowner_lt={'fowner<', r3}}, {@smackfsdef={'smackfsdef', 0x3d, 'fuse\x00'}}]}}, 0x0, 0x0, &(0x7f0000000200)="c416a1a94c68f16d391713bb2d2c5d09530b7c12b4e04434b00f3625faf80f781d0e31133fe428eadd542bee5c7a1039197269e2c7339f6cf0b318078db36d370a2cbd49df526339e994316118304084b16ecd7cbc2684282bc89a6f54d204178f04f354910e8744cfe9629675156943e897b35c") unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:54 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000380)=ANY=[@ANYBLOB="011800000100000018000000831e8c9139211ad20bfe1d44f449c6c5361fadc81fc8", @ANYRES32, @ANYRES64=r0, @ANYRESOCT=r0, @ANYBLOB="01ef73d9ab5880416792b358614bcf0f2ee4505fb5dc48a0d45f918fb3fd4a99a24f08469e3bb461c413e36d4c852caa92314f8e2f3d03170e27261c708d4db84be5493dc57e4a091425d3501afd5938a69379233696d478549b92714aafb98e46eb751d89764c99f359555ae86986a9a4a8c1acdfec75ab867f6a718f7c7ad29ef6159e4da2461d5657fa189024009d2440e72f6a1cfb27f22684288f5c2a8880477625285688b00e70613e624b364ac2ac331b6344229122705a007ac78d31512869d12e7998c0e6ad00948146feacafae", @ANYRES64=r0]) (async) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000380)=ANY=[@ANYBLOB="011800000100000018000000831e8c9139211ad20bfe1d44f449c6c5361fadc81fc8", @ANYRES32=0xffffffffffffffff, @ANYRES64=r0, @ANYRESOCT=r0, @ANYBLOB="01ef73d9ab5880416792b358614bcf0f2ee4505fb5dc48a0d45f918fb3fd4a99a24f08469e3bb461c413e36d4c852caa92314f8e2f3d03170e27261c708d4db84be5493dc57e4a091425d3501afd5938a69379233696d478549b92714aafb98e46eb751d89764c99f359555ae86986a9a4a8c1acdfec75ab867f6a718f7c7ad29ef6159e4da2461d5657fa189024009d2440e72f6a1cfb27f22684288f5c2a8880477625285688b00e70613e624b364ac2ac331b6344229122705a007ac78d31512869d12e7998c0e6ad00948146feacafae", @ANYRES64=r0]) fchmodat(r1, &(0x7f0000000100)='./file0\x00', 0x108) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = fsmount(0xffffffffffffffff, 0x1, 0x0) r6 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000340)={{r6}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r7 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r7, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r7, &(0x7f0000000180)={0x10}) r10 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r10}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001380)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff000000000000000000000000000000000001000000000000000000000000005581c8ca7541bd06a8ca41f60b43e13f193b44cf01429c"]}, @subvolid=0x1}) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r11 = fsmount(0xffffffffffffffff, 0x1, 0x0) r12 = openat$incfs(r2, &(0x7f00000024c0)='.log\x00', 0x424000, 0x13d) ioctl$BTRFS_IOC_RM_DEV_V2(r11, 0x5000943a, &(0x7f0000000340)={{r12}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r12, @ANYBLOB="04653a597fa97f3121fad97c60f2d97b6e593000"]) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r12, @ANYBLOB="04653a597fa97f3121fad97c60f2d97b6e593000"]) openat$cgroup_pressure(r12, &(0x7f0000000200)='cpu.pressure\x00', 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r6, {r8, r9}}, './file0\x00'}) r13 = openat(r12, &(0x7f0000002500)='./file0\x00', 0x141000, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r12, 0x50009418, &(0x7f00000014c0)={{r13}, 0x0, 0x0, @inherit={0x78, &(0x7f0000001440)={0x1, 0x6, 0x1, 0x9, {0x25, 0xd97a, 0x5, 0xe8e, 0x9}, [0xcfc, 0x5, 0x1f, 0x3, 0x1, 0x3d]}}, @name="9586cef2e84e8229ab92c2592af53171fe4cace30eb7c7d40ea75edb2d6457c4a6fbb8f55c8928b20e1c7fdde6ea83d53b1e4092c085edcb87457c13c141aaa45d9d5b1c6fbfeec8234144e48deb63b8ed4ca196b6e87e95c3f37480405a40d7bb75949fb347e2ff6c5eb7c09bf096b5ee7431217d6ac7dab76d40bfa2e5736a5933225e8b44f40045921ca20c3db8d9b1ff26bd52a99c9ff3587a456a1e17a4c8b16e64268dc22935a9ab7c252984b189e594ff508ffe34b67bad96c3119da894beba4ce0a6dbd28a5efc94ba52ea116e0e3b34a5b70dac828239d88ad9e1c234bf7d13f70f56860d8421f3238b7dc5d71463f3740177fe97b4d399a8bfab327042a445c60a69fe3602fd904fdff064d8042ace3e17a9c196834c0a4c70a30c7ea9e3b64a0c23f4078f3c0f1af0cb1ac89fff9ebb6bdc1ba370d3a5967aaa241b1c61da75c70bb17cdc64193a20135b30b85a7bd834326f92e2a58be28ebeed5b7cab143549a16225ac3227d4563437ec1c318719720f7dbd2ffd71b00d31d2cc97c0efcf162ef033ca4b90c349e17131566bfe2c9f6fe921eb828c057be5b48759e2419a98f226b5ccc7f554ebfe48cd11975e412a1fa6dee2d358b2453d957c9c72427edd6c0382e6f2371ef6e76f383953393b1617bb646881450db01d12bce5b0494041a9afcb12eef303e1bb8c3b3606db633a29095059f45a65fc7ca446bd67593c2b44f6f76addce4c05c68453232fe439ea0dc6702067c7816f415b9b5b572b1c4a337010c53af374e648747d6d1b3392dc71a096f9f0ad1a7f9b21ad22882c757ac84eb549cd89febace61b61b1371400a8cdd733d818e5191aca9e1ffaa43c95b5ede01543bcf8013ffbd390860b9cbfd1eb00a8388608b2c1bda32a4128e1142251e9a3d0de35b34e26cf00c298174bce2b636afdd0dd16eed3f0e8c72dabd1a68932b65cf0f776934d20028f0982a192db61a294d075095c2b9bd61b14aa623298c0495a26f4948fa2c09aebdefac45b72370c3a6941d926140a25a98df7e30175d4d800a8d82c58acf11e3a203f2dce19c08455759121b85843eaa9a2c6825635fb2fbd51983eaad058adabdb8e93b5ffb71a400a1dfeaae5a430e6f108a14bd97246db521196c81af6ad78ffde229f6b5f24a9dc5cc56a97d33fb811342e9627e25b8ed1439984572361115fd2ded795f0389e37549a9ed3fa35a61d97caa08c3e070cdd16d41f684ad0ccee85a731cf4614e5f8840231f7e661cbfabc6eef1263f4693a2515746e37a3142cdf9ee5dc88f6ee3a35e0558fd8952e79e48806e5e939ac9182de5c91df769084b0ff089fa76d0f1b19e3556904fab3d26e2cb7b53624c51215e84ccafd5eee9cbbdb6a1e7bb0207537c7a1bc6c3ca9e8c05db36ebeebc536adefe0492970e59c47fed193849d00c100968791129f4253d9be5039669cf3bac4410635296d509dc5688cc42418553885ec18029a1fc1c3b95553ee2e163dc1f97c75ae6949648ab26a2d021ffa6b2c2d2377e3e941a21cf3f8bd9c1c8e13da1a688e2e4b33ad6e44d6cf2b3d819125210b53d8b309e6a512971e470c9e157307b0f2e4062d33f9ac3897079e448374f41ae9d92df0437ea338ee42db99c41d46f88989deb81505187378e871f2ff3ae21ed79f306035eb847c13c12115cf8e15e2c670e199cc427a9d55de19b15281aaad98eab1ca2add1a66ecf8b4fb2a071c59ef28f98af650823017b86d7eaaddc4e7a5ffe53e77cfb0de2d53c24c8e662875fe60cd2ec4c1249e7916c9bcbc925d8cb3e121f09e916dfe781449e18df83793d3a7a3a198d4f56c99b1dc0b6d78b4107c921b44720af008014d0d7e4f49cd159ed8ad85eecc9804d79afa688f8fab2f807fd412d76c6db3e001ea10a3435885c079022371e13ac2028e107203b4fbc2b0d218f4e663f0ab0cba5aead33963cbdbac766ed56538c896d5615ca82371b2969714fd1e3c9af802094e6996a51bbc25e07696f0119142944d77757610d2b1806cc996d94923beab6b33f0c442c466660af041b018ba6c020409cf5d1418b4b6c0a697a7640d1b2993e5269e6965ca05e3bb7ea8b0845c36331daaf3ae095e51c59ac575a2cf61427bacc6b8dff33945eda3096b576e96baa64aa076c4468df5d705eba8b9592b745250664e4f70ba2e9367c2755f80769e2f7148fca7eb9d0cd8a26773f6f1ad21dfe6a11d8360f0db69e0f9e12de66a167cfd2df377116ec1fb05476ebf2a4b639676bf9f2d6f9b68b9e0b9af2f5b4f47749eead1a3e9d026e30844774baf8afb791b142cc7f601f7ea3f7982abdc7d6f20d2a02359157bce75bc48328eca9cb6c4fb9f2ea1afe750ffe08977c0a6c7fa2203b985b3c883901f3228a3f40a5edeb0db8b5f908960dfdb9066f51e2fe2e9d8ecd525e54e184f2904e6f6d2afd8a31ea21f4264c50b98ccfdea8153aca412c7d8689b82845f9323e40efd5be9629f01dcd1b84a9692d8308dafda9e263859c47eac019afecac8864dd8e4efc37257ebcc0a2e9ca70d0ee760d23e1356bf099e13a2e7e8fd1994e05d829f9fc67d6f532a9b5018f1cac5f663a8c7f62719658f4e918ee26b06f0c0a868c9920c03bde8c98b841bfd0fdf8f29da18935d93523d433351fcba237c9aaa8f4b1d1dd35381662cd31947cd87ca8491196cb8394cd784888cd0d87294033eb17482a3ddba6caf21f9e07eb4546bfbab04ca93a237a12d7b2ec9d130672502b7e5e58496c9d432a6fcee4988fc9232a419eeb61cdcff22df405b534a32f8c086dae5b93cad34c3b00e99b129c4b597da4c3fab46be046b4a42b4176ba2adba0c272c4bbebd61216f0db74eaa3009cad4208eae8db0168752f29afc16ffa1c756f8fe5cc1939dc532eec60154c5c8d7fde1af5bd58661ab292e47416ddda58f08364b2e7042feb4a21c4da2f30d506f063313ebfca07cfe2e395967539050cbe94b876779851255f761722bb0e493ca03b03828b6b9f889405fcaa9f2d6e57ac29361bec1f5a2938182d2a6d8b6d45d1feedb83ac02c4da62c4cea644a62a31f8981b19ea093378a21bfdd1b3ec850d1fef5aecca5ab79a92a91b5f30af69b36a6a2f060738be50cc989e5539ea57eea1e74124cc0b68bf145ad6be606c04e6a9ffb979b195f8035f97465d5b2472625332b763286d7fe4e71924158faf710dca6916dc520ba9a389fbe2ab785b932721dccdf435d0c11ab722d63adec972327ed83aed7d3e8ba1d6e38bfbdbf29008cc7528e136aa7072fb283cee408dcabfded091780ef42880ed8df352ea2acb90105bd2ef41481b57502490ad3626e16f5c621c868b0e7d5ea668dfec4f842e00968771cfc14df3ce5782503cf437327caef383aa80a27602b7dd06d7a8ea37b7b8d5ea10c86009558b6a7fec4bb91456fcafa548e30f2d502a7bc6997c4b09c2f9fecf248f7957c4f78486f4c27484fdd6b1fb6eaaa314432ebe961b3ecfd933cbfdb7c268347bf1b2c942b1c1d494e739bef524785d7185922d9294463af0a5f006b7e2c6891a7090207fb8f16e6323d6e5d6951d850c91dec787d869ebab2c12850cb913f33914c243cd1302ad6e4b1d175164be1a036807956c5f3770fc164c5d8e47ba7c615ae23236c62ec4c316e3b23e558e6b6e307184e966a30615a50c0e7bd836135f72c3a1955ef597d4d7b74ca7819ca2698a6507734add4fe1c58feb009a369185c0413164f6dbe14b850994d433636f0336bd2d93b4f2cd1f205e5e5f6920f24daf310f2e64b55e694fedf4046a63b714bb61d90d72e9ac182a9a009b91f95ffd5b9973e31a29cd06f31e816638a991cf4f3669a037e9663e98ae0eeaa218933c5492f96888f2144a9bc73dbc89c81ad7fd7485602b78a631b4c61542a1274d37d44a50d3d73a606cf93e0b2091fbf9f1bc9c8e022395766b831331d2a0efc52faf4aea26c877c3af0596419b13e1c25405bd60a9070d6a8c10326e3c2d6016c917c2ee53dccb4c579615f5c74fddb28fb0f2288f81eaa13726499b1556b30e504559959a69062413d01e12eacde3dfb6e96ea64d1dba88cf06b48530dd526dbd20bd3b4242044f72509dcac88dd8c2336ca3cd3d40e97bfa17fa22760aede3d1fe5eea0be432cd7cedf0efd65e6d59732b2d2452188f70ee89abc0e355a28f1e74eff2764399db0b648ca69726a076ae93b46960329e47cdad7a80413776ad6026d19696947f1bd2ed9c31b96b549ea5f43199d1017339cc0371b15e74e9d1605357e471abe48d0d2e647b6e25a054ad525000ea4012443366e7fd2fa01b43cef9311382d4a82a6442350e907d4404084e6dd105659840f77af34e13f3485db416cf00127adba241c5df2782b47ad1ac6b4555829a07bbe257acdde88dc8e8231fe161e170e05dc51e0c202022ebcfa02f1ce16df454a14026651acbfec11cf4893d2bc94fbb18d3dc1e05e9fee765c5c4c6199a89c2f065ceae1c0282fa4a2d15aeea836c05ac92ddca3877f4764c1453734850beea586278fc7cc80c61bccc36ccc28347a06458a5c643528ff81c09838c533d53837b909b5f9d40ddb83636ffd529604c13e9ccd7324ec3a49689d41d44654b99519e4c313bebaada5d923dd6f35ffe865fec89b9f7861bb23c0e8cd23c65576b57fcb7973ef01d5785ada046d6432b141d293741e85e35d941da92f552e15b7c3ae6c312511fb0b91080589b37c66a0789e2eccea8afd7dc0e205b289c2f2b9b110d5717db11d8aa01a2b5e6cc292ccd0a74a51062dd7fe487caa4cfade39586f75bd0e84feec11ff81b7eeb1933a9e5c7f3a6d677f03ebdb12512b1e9d622d6ba4729063a5a335a05b08d98b319f655c62a968bc4756be03589fb1f4e2e7c7e0d4cc2dc78df9f2af2c6816de91da156d2fe38808bd73aabdc18a62aed19d03dd06f6b0d2af720a4edb53cb6cecea5319305dc2e56181b299ffba2eacd026a49b81df1c6f9b859a1887878330750498e56de7c4d11023a0833d0cd6b0b45688e074e66257adadbce315a836cc4a2b8f1365361344dc626bdce243164b04675b96bead6a1d22985bc86a1f1648bf985da981dd45f540a8b0557c6748a3518d7dd3155e65e7ff724c1ad7e73b31d1ddb00182e2bbb83393788feaf0515f7b6794f113ddb9d1d827d8b2846b3e5d330b84da16bae15e6e06c1513f059dcbc2ea94236cf6eaa248bf3771b653bd1b20c510e78fc0d083dcd0eae3bb21bd2ee35b40e11b8723359ad0334d868a9ec712faf5ccbc25adf0c99028aea92f59e4f5701f5f823249dab57d60bb8d0a1e356b6698b56b43b890304e6181ab379f2d05948683208d48a4a68ab1563bd1141d5506e7fe64aebbc0f61acdffdaccbfb7b580f33e6c94768b9e90e9bc4f0079a3d8e9d08e25fe43c78cd5ac3da3ade0fb001f64c6cc6feb0d18e93dee40524168e108299a338b218f0a5de2c365abf45d9d782d768e44f103b0ee4e897859d67ea339f37b9bb0fedd49ba960c03a40a0187479230cdfb55abb9090bd26aee5eb5912ca8678488fc3eb436bcf55bb4c16c73ebcf324748dff2597a97c956c9b91a326262325238e175a0c580197669dd800ed97720bd013d81a16770050e198e7fc1b02ce72c6c8d500c9818aff7d2847c016a6a6b8acaa9abdddb8fa96598e1ed1f94cc9f9af099c9dda158720db829"}) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r12, 0x50009418, &(0x7f00000014c0)={{r13}, 0x0, 0x0, @inherit={0x78, &(0x7f0000001440)={0x1, 0x6, 0x1, 0x9, {0x25, 0xd97a, 0x5, 0xe8e, 0x9}, [0xcfc, 0x5, 0x1f, 0x3, 0x1, 0x3d]}}, @name="9586cef2e84e8229ab92c2592af53171fe4cace30eb7c7d40ea75edb2d6457c4a6fbb8f55c8928b20e1c7fdde6ea83d53b1e4092c085edcb87457c13c141aaa45d9d5b1c6fbfeec8234144e48deb63b8ed4ca196b6e87e95c3f37480405a40d7bb75949fb347e2ff6c5eb7c09bf096b5ee7431217d6ac7dab76d40bfa2e5736a5933225e8b44f40045921ca20c3db8d9b1ff26bd52a99c9ff3587a456a1e17a4c8b16e64268dc22935a9ab7c252984b189e594ff508ffe34b67bad96c3119da894beba4ce0a6dbd28a5efc94ba52ea116e0e3b34a5b70dac828239d88ad9e1c234bf7d13f70f56860d8421f3238b7dc5d71463f3740177fe97b4d399a8bfab327042a445c60a69fe3602fd904fdff064d8042ace3e17a9c196834c0a4c70a30c7ea9e3b64a0c23f4078f3c0f1af0cb1ac89fff9ebb6bdc1ba370d3a5967aaa241b1c61da75c70bb17cdc64193a20135b30b85a7bd834326f92e2a58be28ebeed5b7cab143549a16225ac3227d4563437ec1c318719720f7dbd2ffd71b00d31d2cc97c0efcf162ef033ca4b90c349e17131566bfe2c9f6fe921eb828c057be5b48759e2419a98f226b5ccc7f554ebfe48cd11975e412a1fa6dee2d358b2453d957c9c72427edd6c0382e6f2371ef6e76f383953393b1617bb646881450db01d12bce5b0494041a9afcb12eef303e1bb8c3b3606db633a29095059f45a65fc7ca446bd67593c2b44f6f76addce4c05c68453232fe439ea0dc6702067c7816f415b9b5b572b1c4a337010c53af374e648747d6d1b3392dc71a096f9f0ad1a7f9b21ad22882c757ac84eb549cd89febace61b61b1371400a8cdd733d818e5191aca9e1ffaa43c95b5ede01543bcf8013ffbd390860b9cbfd1eb00a8388608b2c1bda32a4128e1142251e9a3d0de35b34e26cf00c298174bce2b636afdd0dd16eed3f0e8c72dabd1a68932b65cf0f776934d20028f0982a192db61a294d075095c2b9bd61b14aa623298c0495a26f4948fa2c09aebdefac45b72370c3a6941d926140a25a98df7e30175d4d800a8d82c58acf11e3a203f2dce19c08455759121b85843eaa9a2c6825635fb2fbd51983eaad058adabdb8e93b5ffb71a400a1dfeaae5a430e6f108a14bd97246db521196c81af6ad78ffde229f6b5f24a9dc5cc56a97d33fb811342e9627e25b8ed1439984572361115fd2ded795f0389e37549a9ed3fa35a61d97caa08c3e070cdd16d41f684ad0ccee85a731cf4614e5f8840231f7e661cbfabc6eef1263f4693a2515746e37a3142cdf9ee5dc88f6ee3a35e0558fd8952e79e48806e5e939ac9182de5c91df769084b0ff089fa76d0f1b19e3556904fab3d26e2cb7b53624c51215e84ccafd5eee9cbbdb6a1e7bb0207537c7a1bc6c3ca9e8c05db36ebeebc536adefe0492970e59c47fed193849d00c100968791129f4253d9be5039669cf3bac4410635296d509dc5688cc42418553885ec18029a1fc1c3b95553ee2e163dc1f97c75ae6949648ab26a2d021ffa6b2c2d2377e3e941a21cf3f8bd9c1c8e13da1a688e2e4b33ad6e44d6cf2b3d819125210b53d8b309e6a512971e470c9e157307b0f2e4062d33f9ac3897079e448374f41ae9d92df0437ea338ee42db99c41d46f88989deb81505187378e871f2ff3ae21ed79f306035eb847c13c12115cf8e15e2c670e199cc427a9d55de19b15281aaad98eab1ca2add1a66ecf8b4fb2a071c59ef28f98af650823017b86d7eaaddc4e7a5ffe53e77cfb0de2d53c24c8e662875fe60cd2ec4c1249e7916c9bcbc925d8cb3e121f09e916dfe781449e18df83793d3a7a3a198d4f56c99b1dc0b6d78b4107c921b44720af008014d0d7e4f49cd159ed8ad85eecc9804d79afa688f8fab2f807fd412d76c6db3e001ea10a3435885c079022371e13ac2028e107203b4fbc2b0d218f4e663f0ab0cba5aead33963cbdbac766ed56538c896d5615ca82371b2969714fd1e3c9af802094e6996a51bbc25e07696f0119142944d77757610d2b1806cc996d94923beab6b33f0c442c466660af041b018ba6c020409cf5d1418b4b6c0a697a7640d1b2993e5269e6965ca05e3bb7ea8b0845c36331daaf3ae095e51c59ac575a2cf61427bacc6b8dff33945eda3096b576e96baa64aa076c4468df5d705eba8b9592b745250664e4f70ba2e9367c2755f80769e2f7148fca7eb9d0cd8a26773f6f1ad21dfe6a11d8360f0db69e0f9e12de66a167cfd2df377116ec1fb05476ebf2a4b639676bf9f2d6f9b68b9e0b9af2f5b4f47749eead1a3e9d026e30844774baf8afb791b142cc7f601f7ea3f7982abdc7d6f20d2a02359157bce75bc48328eca9cb6c4fb9f2ea1afe750ffe08977c0a6c7fa2203b985b3c883901f3228a3f40a5edeb0db8b5f908960dfdb9066f51e2fe2e9d8ecd525e54e184f2904e6f6d2afd8a31ea21f4264c50b98ccfdea8153aca412c7d8689b82845f9323e40efd5be9629f01dcd1b84a9692d8308dafda9e263859c47eac019afecac8864dd8e4efc37257ebcc0a2e9ca70d0ee760d23e1356bf099e13a2e7e8fd1994e05d829f9fc67d6f532a9b5018f1cac5f663a8c7f62719658f4e918ee26b06f0c0a868c9920c03bde8c98b841bfd0fdf8f29da18935d93523d433351fcba237c9aaa8f4b1d1dd35381662cd31947cd87ca8491196cb8394cd784888cd0d87294033eb17482a3ddba6caf21f9e07eb4546bfbab04ca93a237a12d7b2ec9d130672502b7e5e58496c9d432a6fcee4988fc9232a419eeb61cdcff22df405b534a32f8c086dae5b93cad34c3b00e99b129c4b597da4c3fab46be046b4a42b4176ba2adba0c272c4bbebd61216f0db74eaa3009cad4208eae8db0168752f29afc16ffa1c756f8fe5cc1939dc532eec60154c5c8d7fde1af5bd58661ab292e47416ddda58f08364b2e7042feb4a21c4da2f30d506f063313ebfca07cfe2e395967539050cbe94b876779851255f761722bb0e493ca03b03828b6b9f889405fcaa9f2d6e57ac29361bec1f5a2938182d2a6d8b6d45d1feedb83ac02c4da62c4cea644a62a31f8981b19ea093378a21bfdd1b3ec850d1fef5aecca5ab79a92a91b5f30af69b36a6a2f060738be50cc989e5539ea57eea1e74124cc0b68bf145ad6be606c04e6a9ffb979b195f8035f97465d5b2472625332b763286d7fe4e71924158faf710dca6916dc520ba9a389fbe2ab785b932721dccdf435d0c11ab722d63adec972327ed83aed7d3e8ba1d6e38bfbdbf29008cc7528e136aa7072fb283cee408dcabfded091780ef42880ed8df352ea2acb90105bd2ef41481b57502490ad3626e16f5c621c868b0e7d5ea668dfec4f842e00968771cfc14df3ce5782503cf437327caef383aa80a27602b7dd06d7a8ea37b7b8d5ea10c86009558b6a7fec4bb91456fcafa548e30f2d502a7bc6997c4b09c2f9fecf248f7957c4f78486f4c27484fdd6b1fb6eaaa314432ebe961b3ecfd933cbfdb7c268347bf1b2c942b1c1d494e739bef524785d7185922d9294463af0a5f006b7e2c6891a7090207fb8f16e6323d6e5d6951d850c91dec787d869ebab2c12850cb913f33914c243cd1302ad6e4b1d175164be1a036807956c5f3770fc164c5d8e47ba7c615ae23236c62ec4c316e3b23e558e6b6e307184e966a30615a50c0e7bd836135f72c3a1955ef597d4d7b74ca7819ca2698a6507734add4fe1c58feb009a369185c0413164f6dbe14b850994d433636f0336bd2d93b4f2cd1f205e5e5f6920f24daf310f2e64b55e694fedf4046a63b714bb61d90d72e9ac182a9a009b91f95ffd5b9973e31a29cd06f31e816638a991cf4f3669a037e9663e98ae0eeaa218933c5492f96888f2144a9bc73dbc89c81ad7fd7485602b78a631b4c61542a1274d37d44a50d3d73a606cf93e0b2091fbf9f1bc9c8e022395766b831331d2a0efc52faf4aea26c877c3af0596419b13e1c25405bd60a9070d6a8c10326e3c2d6016c917c2ee53dccb4c579615f5c74fddb28fb0f2288f81eaa13726499b1556b30e504559959a69062413d01e12eacde3dfb6e96ea64d1dba88cf06b48530dd526dbd20bd3b4242044f72509dcac88dd8c2336ca3cd3d40e97bfa17fa22760aede3d1fe5eea0be432cd7cedf0efd65e6d59732b2d2452188f70ee89abc0e355a28f1e74eff2764399db0b648ca69726a076ae93b46960329e47cdad7a80413776ad6026d19696947f1bd2ed9c31b96b549ea5f43199d1017339cc0371b15e74e9d1605357e471abe48d0d2e647b6e25a054ad525000ea4012443366e7fd2fa01b43cef9311382d4a82a6442350e907d4404084e6dd105659840f77af34e13f3485db416cf00127adba241c5df2782b47ad1ac6b4555829a07bbe257acdde88dc8e8231fe161e170e05dc51e0c202022ebcfa02f1ce16df454a14026651acbfec11cf4893d2bc94fbb18d3dc1e05e9fee765c5c4c6199a89c2f065ceae1c0282fa4a2d15aeea836c05ac92ddca3877f4764c1453734850beea586278fc7cc80c61bccc36ccc28347a06458a5c643528ff81c09838c533d53837b909b5f9d40ddb83636ffd529604c13e9ccd7324ec3a49689d41d44654b99519e4c313bebaada5d923dd6f35ffe865fec89b9f7861bb23c0e8cd23c65576b57fcb7973ef01d5785ada046d6432b141d293741e85e35d941da92f552e15b7c3ae6c312511fb0b91080589b37c66a0789e2eccea8afd7dc0e205b289c2f2b9b110d5717db11d8aa01a2b5e6cc292ccd0a74a51062dd7fe487caa4cfade39586f75bd0e84feec11ff81b7eeb1933a9e5c7f3a6d677f03ebdb12512b1e9d622d6ba4729063a5a335a05b08d98b319f655c62a968bc4756be03589fb1f4e2e7c7e0d4cc2dc78df9f2af2c6816de91da156d2fe38808bd73aabdc18a62aed19d03dd06f6b0d2af720a4edb53cb6cecea5319305dc2e56181b299ffba2eacd026a49b81df1c6f9b859a1887878330750498e56de7c4d11023a0833d0cd6b0b45688e074e66257adadbce315a836cc4a2b8f1365361344dc626bdce243164b04675b96bead6a1d22985bc86a1f1648bf985da981dd45f540a8b0557c6748a3518d7dd3155e65e7ff724c1ad7e73b31d1ddb00182e2bbb83393788feaf0515f7b6794f113ddb9d1d827d8b2846b3e5d330b84da16bae15e6e06c1513f059dcbc2ea94236cf6eaa248bf3771b653bd1b20c510e78fc0d083dcd0eae3bb21bd2ee35b40e11b8723359ad0334d868a9ec712faf5ccbc25adf0c99028aea92f59e4f5701f5f823249dab57d60bb8d0a1e356b6698b56b43b890304e6181ab379f2d05948683208d48a4a68ab1563bd1141d5506e7fe64aebbc0f61acdffdaccbfb7b580f33e6c94768b9e90e9bc4f0079a3d8e9d08e25fe43c78cd5ac3da3ade0fb001f64c6cc6feb0d18e93dee40524168e108299a338b218f0a5de2c365abf45d9d782d768e44f103b0ee4e897859d67ea339f37b9bb0fedd49ba960c03a40a0187479230cdfb55abb9090bd26aee5eb5912ca8678488fc3eb436bcf55bb4c16c73ebcf324748dff2597a97c956c9b91a326262325238e175a0c580197669dd800ed97720bd013d81a16770050e198e7fc1b02ce72c6c8d500c9818aff7d2847c016a6a6b8acaa9abdddb8fa96598e1ed1f94cc9f9af099c9dda158720db829"}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r10, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r10, {0x4}}, './file0\x00'}) mount_setattr(r3, &(0x7f0000000040)='./file0\x00', 0x8900, &(0x7f0000000140)={0x100000, 0x1000fb, 0x1a0000, {r10}}, 0x20) 14:42:54 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x80ffff00000000) 14:42:54 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/class/cuse', 0x6e0341, 0x38) (rerun: 64) read$ptp(r0, 0x0, 0x0) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) fsmount(r0, 0x1, 0x2) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 32) openat$smackfs_relabel_self(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async, rerun: 32) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x83, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) r4 = fsmount(r3, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff000000000000000000000000000000e33b0100"/80]}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) (async) unlinkat(r5, &(0x7f0000000140)='./file0\x00', 0x200) (async) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)) (async) r7 = openat$cgroup_pressure(r1, &(0x7f00000001c0)='io.pressure\x00', 0x2, 0x0) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r7}, 0x0, 0x4, @unused=[0x1, 0x7fff, 0xe1, 0xffff], @subvolid=0x1}) epoll_pwait2(r1, &(0x7f0000000040)=[{}], 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100)={[0x2]}, 0x8) 14:42:54 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) [ 1645.495387][T15388] overlay: Unknown parameter '\õ½UK!ûª N½ÈÕ€)\,êàb•îËèCcyî!þäÆé(”eøä$ÇcV*6þj²ÿKiënŸ÷ŒeáSÊ…›\EOK„nöÇ' [ 1645.522042][T15393] fuse: Bad value for 'fd' [ 1645.522309][T15394] fuse: Bad value for 'fd' [ 1645.527350][T15392] fuse: Bad value for 'fd' 14:42:54 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="5c1ff5bd558f4b21fbaa10204ebdc8d580295c2ceae06295eecbe8436379ee0221fee4c6e9289465f8e41c1224c763562a901c3618fe0d1c6ab2ff4b69eb6e0f9ff78c65e153ca859b5c454f4b846ef615c70400b1c156b90c48aef791415744d49e04299ee1b5b99ff4ee5f128e107172ef8db22544bbde9bc5a8994442790bba541b4f798321844145214eadfeac2dafaee343dcef6c0e26ce4de4ecc08139340ca3e6f29ba3edde0c88350947b6d7559fc5cc317a1961a5be6a4725906a0e3d80769de1b7f3f32079ecc6079bb7da567682aabff4e123efd9e52f63961a469593a55fec0e936dfd1dd6466434491e9c4fcb455cf55106b4b0411bd8e98b60f7ebfc"]) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) fstat(r2, &(0x7f0000003880)) fstat(r1, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) 14:42:54 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xc0000000000000) 14:42:54 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000380)=ANY=[@ANYBLOB="011800000100000018000000831e8c9139211ad20bfe1d44f449c6c5361fadc81fc8", @ANYRES32=0xffffffffffffffff, @ANYRES64=r0, @ANYRESOCT=r0, @ANYBLOB="01ef73d9ab5880416792b358614bcf0f2ee4505fb5dc48a0d45f918fb3fd4a99a24f08469e3bb461c413e36d4c852caa92314f8e2f3d03170e27261c708d4db84be5493dc57e4a091425d3501afd5938a69379233696d478549b92714aafb98e46eb751d89764c99f359555ae86986a9a4a8c1acdfec75ab867f6a718f7c7ad29ef6159e4da2461d5657fa189024009d2440e72f6a1cfb27f22684288f5c2a8880477625285688b00e70613e624b364ac2ac331b6344229122705a007ac78d31512869d12e7998c0e6ad00948146feacafae", @ANYRES64=r0]) fchmodat(r1, &(0x7f0000000100)='./file0\x00', 0x108) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r5 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r6 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000340)={{r6}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) r7 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r7, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r7, &(0x7f0000000180)={0x10}) r10 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r10}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001380)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff000000000000000000000000000000000001000000000000000000000000005581c8ca7541bd06a8ca41f60b43e13f193b44cf01429c"]}, @subvolid=0x1}) (async) r11 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r12 = openat$incfs(r2, &(0x7f00000024c0)='.log\x00', 0x424000, 0x13d) ioctl$BTRFS_IOC_RM_DEV_V2(r11, 0x5000943a, &(0x7f0000000340)={{r12}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r12, @ANYBLOB="04653a597fa97f3121fad97c60f2d97b6e593000"]) (async) openat$cgroup_pressure(r12, &(0x7f0000000200)='cpu.pressure\x00', 0x2, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r6, {r8, r9}}, './file0\x00'}) r13 = openat(r12, &(0x7f0000002500)='./file0\x00', 0x141000, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r12, 0x50009418, &(0x7f00000014c0)={{r13}, 0x0, 0x0, @inherit={0x78, &(0x7f0000001440)={0x1, 0x6, 0x1, 0x9, {0x25, 0xd97a, 0x5, 0xe8e, 0x9}, [0xcfc, 0x5, 0x1f, 0x3, 0x1, 0x3d]}}, @name="9586cef2e84e8229ab92c2592af53171fe4cace30eb7c7d40ea75edb2d6457c4a6fbb8f55c8928b20e1c7fdde6ea83d53b1e4092c085edcb87457c13c141aaa45d9d5b1c6fbfeec8234144e48deb63b8ed4ca196b6e87e95c3f37480405a40d7bb75949fb347e2ff6c5eb7c09bf096b5ee7431217d6ac7dab76d40bfa2e5736a5933225e8b44f40045921ca20c3db8d9b1ff26bd52a99c9ff3587a456a1e17a4c8b16e64268dc22935a9ab7c252984b189e594ff508ffe34b67bad96c3119da894beba4ce0a6dbd28a5efc94ba52ea116e0e3b34a5b70dac828239d88ad9e1c234bf7d13f70f56860d8421f3238b7dc5d71463f3740177fe97b4d399a8bfab327042a445c60a69fe3602fd904fdff064d8042ace3e17a9c196834c0a4c70a30c7ea9e3b64a0c23f4078f3c0f1af0cb1ac89fff9ebb6bdc1ba370d3a5967aaa241b1c61da75c70bb17cdc64193a20135b30b85a7bd834326f92e2a58be28ebeed5b7cab143549a16225ac3227d4563437ec1c318719720f7dbd2ffd71b00d31d2cc97c0efcf162ef033ca4b90c349e17131566bfe2c9f6fe921eb828c057be5b48759e2419a98f226b5ccc7f554ebfe48cd11975e412a1fa6dee2d358b2453d957c9c72427edd6c0382e6f2371ef6e76f383953393b1617bb646881450db01d12bce5b0494041a9afcb12eef303e1bb8c3b3606db633a29095059f45a65fc7ca446bd67593c2b44f6f76addce4c05c68453232fe439ea0dc6702067c7816f415b9b5b572b1c4a337010c53af374e648747d6d1b3392dc71a096f9f0ad1a7f9b21ad22882c757ac84eb549cd89febace61b61b1371400a8cdd733d818e5191aca9e1ffaa43c95b5ede01543bcf8013ffbd390860b9cbfd1eb00a8388608b2c1bda32a4128e1142251e9a3d0de35b34e26cf00c298174bce2b636afdd0dd16eed3f0e8c72dabd1a68932b65cf0f776934d20028f0982a192db61a294d075095c2b9bd61b14aa623298c0495a26f4948fa2c09aebdefac45b72370c3a6941d926140a25a98df7e30175d4d800a8d82c58acf11e3a203f2dce19c08455759121b85843eaa9a2c6825635fb2fbd51983eaad058adabdb8e93b5ffb71a400a1dfeaae5a430e6f108a14bd97246db521196c81af6ad78ffde229f6b5f24a9dc5cc56a97d33fb811342e9627e25b8ed1439984572361115fd2ded795f0389e37549a9ed3fa35a61d97caa08c3e070cdd16d41f684ad0ccee85a731cf4614e5f8840231f7e661cbfabc6eef1263f4693a2515746e37a3142cdf9ee5dc88f6ee3a35e0558fd8952e79e48806e5e939ac9182de5c91df769084b0ff089fa76d0f1b19e3556904fab3d26e2cb7b53624c51215e84ccafd5eee9cbbdb6a1e7bb0207537c7a1bc6c3ca9e8c05db36ebeebc536adefe0492970e59c47fed193849d00c100968791129f4253d9be5039669cf3bac4410635296d509dc5688cc42418553885ec18029a1fc1c3b95553ee2e163dc1f97c75ae6949648ab26a2d021ffa6b2c2d2377e3e941a21cf3f8bd9c1c8e13da1a688e2e4b33ad6e44d6cf2b3d819125210b53d8b309e6a512971e470c9e157307b0f2e4062d33f9ac3897079e448374f41ae9d92df0437ea338ee42db99c41d46f88989deb81505187378e871f2ff3ae21ed79f306035eb847c13c12115cf8e15e2c670e199cc427a9d55de19b15281aaad98eab1ca2add1a66ecf8b4fb2a071c59ef28f98af650823017b86d7eaaddc4e7a5ffe53e77cfb0de2d53c24c8e662875fe60cd2ec4c1249e7916c9bcbc925d8cb3e121f09e916dfe781449e18df83793d3a7a3a198d4f56c99b1dc0b6d78b4107c921b44720af008014d0d7e4f49cd159ed8ad85eecc9804d79afa688f8fab2f807fd412d76c6db3e001ea10a3435885c079022371e13ac2028e107203b4fbc2b0d218f4e663f0ab0cba5aead33963cbdbac766ed56538c896d5615ca82371b2969714fd1e3c9af802094e6996a51bbc25e07696f0119142944d77757610d2b1806cc996d94923beab6b33f0c442c466660af041b018ba6c020409cf5d1418b4b6c0a697a7640d1b2993e5269e6965ca05e3bb7ea8b0845c36331daaf3ae095e51c59ac575a2cf61427bacc6b8dff33945eda3096b576e96baa64aa076c4468df5d705eba8b9592b745250664e4f70ba2e9367c2755f80769e2f7148fca7eb9d0cd8a26773f6f1ad21dfe6a11d8360f0db69e0f9e12de66a167cfd2df377116ec1fb05476ebf2a4b639676bf9f2d6f9b68b9e0b9af2f5b4f47749eead1a3e9d026e30844774baf8afb791b142cc7f601f7ea3f7982abdc7d6f20d2a02359157bce75bc48328eca9cb6c4fb9f2ea1afe750ffe08977c0a6c7fa2203b985b3c883901f3228a3f40a5edeb0db8b5f908960dfdb9066f51e2fe2e9d8ecd525e54e184f2904e6f6d2afd8a31ea21f4264c50b98ccfdea8153aca412c7d8689b82845f9323e40efd5be9629f01dcd1b84a9692d8308dafda9e263859c47eac019afecac8864dd8e4efc37257ebcc0a2e9ca70d0ee760d23e1356bf099e13a2e7e8fd1994e05d829f9fc67d6f532a9b5018f1cac5f663a8c7f62719658f4e918ee26b06f0c0a868c9920c03bde8c98b841bfd0fdf8f29da18935d93523d433351fcba237c9aaa8f4b1d1dd35381662cd31947cd87ca8491196cb8394cd784888cd0d87294033eb17482a3ddba6caf21f9e07eb4546bfbab04ca93a237a12d7b2ec9d130672502b7e5e58496c9d432a6fcee4988fc9232a419eeb61cdcff22df405b534a32f8c086dae5b93cad34c3b00e99b129c4b597da4c3fab46be046b4a42b4176ba2adba0c272c4bbebd61216f0db74eaa3009cad4208eae8db0168752f29afc16ffa1c756f8fe5cc1939dc532eec60154c5c8d7fde1af5bd58661ab292e47416ddda58f08364b2e7042feb4a21c4da2f30d506f063313ebfca07cfe2e395967539050cbe94b876779851255f761722bb0e493ca03b03828b6b9f889405fcaa9f2d6e57ac29361bec1f5a2938182d2a6d8b6d45d1feedb83ac02c4da62c4cea644a62a31f8981b19ea093378a21bfdd1b3ec850d1fef5aecca5ab79a92a91b5f30af69b36a6a2f060738be50cc989e5539ea57eea1e74124cc0b68bf145ad6be606c04e6a9ffb979b195f8035f97465d5b2472625332b763286d7fe4e71924158faf710dca6916dc520ba9a389fbe2ab785b932721dccdf435d0c11ab722d63adec972327ed83aed7d3e8ba1d6e38bfbdbf29008cc7528e136aa7072fb283cee408dcabfded091780ef42880ed8df352ea2acb90105bd2ef41481b57502490ad3626e16f5c621c868b0e7d5ea668dfec4f842e00968771cfc14df3ce5782503cf437327caef383aa80a27602b7dd06d7a8ea37b7b8d5ea10c86009558b6a7fec4bb91456fcafa548e30f2d502a7bc6997c4b09c2f9fecf248f7957c4f78486f4c27484fdd6b1fb6eaaa314432ebe961b3ecfd933cbfdb7c268347bf1b2c942b1c1d494e739bef524785d7185922d9294463af0a5f006b7e2c6891a7090207fb8f16e6323d6e5d6951d850c91dec787d869ebab2c12850cb913f33914c243cd1302ad6e4b1d175164be1a036807956c5f3770fc164c5d8e47ba7c615ae23236c62ec4c316e3b23e558e6b6e307184e966a30615a50c0e7bd836135f72c3a1955ef597d4d7b74ca7819ca2698a6507734add4fe1c58feb009a369185c0413164f6dbe14b850994d433636f0336bd2d93b4f2cd1f205e5e5f6920f24daf310f2e64b55e694fedf4046a63b714bb61d90d72e9ac182a9a009b91f95ffd5b9973e31a29cd06f31e816638a991cf4f3669a037e9663e98ae0eeaa218933c5492f96888f2144a9bc73dbc89c81ad7fd7485602b78a631b4c61542a1274d37d44a50d3d73a606cf93e0b2091fbf9f1bc9c8e022395766b831331d2a0efc52faf4aea26c877c3af0596419b13e1c25405bd60a9070d6a8c10326e3c2d6016c917c2ee53dccb4c579615f5c74fddb28fb0f2288f81eaa13726499b1556b30e504559959a69062413d01e12eacde3dfb6e96ea64d1dba88cf06b48530dd526dbd20bd3b4242044f72509dcac88dd8c2336ca3cd3d40e97bfa17fa22760aede3d1fe5eea0be432cd7cedf0efd65e6d59732b2d2452188f70ee89abc0e355a28f1e74eff2764399db0b648ca69726a076ae93b46960329e47cdad7a80413776ad6026d19696947f1bd2ed9c31b96b549ea5f43199d1017339cc0371b15e74e9d1605357e471abe48d0d2e647b6e25a054ad525000ea4012443366e7fd2fa01b43cef9311382d4a82a6442350e907d4404084e6dd105659840f77af34e13f3485db416cf00127adba241c5df2782b47ad1ac6b4555829a07bbe257acdde88dc8e8231fe161e170e05dc51e0c202022ebcfa02f1ce16df454a14026651acbfec11cf4893d2bc94fbb18d3dc1e05e9fee765c5c4c6199a89c2f065ceae1c0282fa4a2d15aeea836c05ac92ddca3877f4764c1453734850beea586278fc7cc80c61bccc36ccc28347a06458a5c643528ff81c09838c533d53837b909b5f9d40ddb83636ffd529604c13e9ccd7324ec3a49689d41d44654b99519e4c313bebaada5d923dd6f35ffe865fec89b9f7861bb23c0e8cd23c65576b57fcb7973ef01d5785ada046d6432b141d293741e85e35d941da92f552e15b7c3ae6c312511fb0b91080589b37c66a0789e2eccea8afd7dc0e205b289c2f2b9b110d5717db11d8aa01a2b5e6cc292ccd0a74a51062dd7fe487caa4cfade39586f75bd0e84feec11ff81b7eeb1933a9e5c7f3a6d677f03ebdb12512b1e9d622d6ba4729063a5a335a05b08d98b319f655c62a968bc4756be03589fb1f4e2e7c7e0d4cc2dc78df9f2af2c6816de91da156d2fe38808bd73aabdc18a62aed19d03dd06f6b0d2af720a4edb53cb6cecea5319305dc2e56181b299ffba2eacd026a49b81df1c6f9b859a1887878330750498e56de7c4d11023a0833d0cd6b0b45688e074e66257adadbce315a836cc4a2b8f1365361344dc626bdce243164b04675b96bead6a1d22985bc86a1f1648bf985da981dd45f540a8b0557c6748a3518d7dd3155e65e7ff724c1ad7e73b31d1ddb00182e2bbb83393788feaf0515f7b6794f113ddb9d1d827d8b2846b3e5d330b84da16bae15e6e06c1513f059dcbc2ea94236cf6eaa248bf3771b653bd1b20c510e78fc0d083dcd0eae3bb21bd2ee35b40e11b8723359ad0334d868a9ec712faf5ccbc25adf0c99028aea92f59e4f5701f5f823249dab57d60bb8d0a1e356b6698b56b43b890304e6181ab379f2d05948683208d48a4a68ab1563bd1141d5506e7fe64aebbc0f61acdffdaccbfb7b580f33e6c94768b9e90e9bc4f0079a3d8e9d08e25fe43c78cd5ac3da3ade0fb001f64c6cc6feb0d18e93dee40524168e108299a338b218f0a5de2c365abf45d9d782d768e44f103b0ee4e897859d67ea339f37b9bb0fedd49ba960c03a40a0187479230cdfb55abb9090bd26aee5eb5912ca8678488fc3eb436bcf55bb4c16c73ebcf324748dff2597a97c956c9b91a326262325238e175a0c580197669dd800ed97720bd013d81a16770050e198e7fc1b02ce72c6c8d500c9818aff7d2847c016a6a6b8acaa9abdddb8fa96598e1ed1f94cc9f9af099c9dda158720db829"}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r10, {0x4}}, './file0\x00'}) (async) mount_setattr(r3, &(0x7f0000000040)='./file0\x00', 0x8900, &(0x7f0000000140)={0x100000, 0x1000fb, 0x1a0000, {r10}}, 0x20) 14:42:54 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'], 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = fsopen(&(0x7f0000000280)='coda\x00', 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000001380)={0x0, 0x7, 0x0, [0x4, 0x6, 0x7, 0x400, 0x100000000], [0x2, 0x4, 0x3, 0xfc, 0x6a, 0x0, 0x1, 0x7fffffff, 0x7fffffff, 0x7, 0xffffffffffffffff, 0x9, 0x3, 0x100, 0x453, 0x1cb0000, 0x1, 0x5, 0x101, 0x7, 0x5, 0x800, 0x4, 0x9, 0x1, 0x0, 0x7, 0x6, 0xe44, 0xffffffffffffffff, 0x7, 0x1, 0x40, 0x5, 0x8, 0x5f, 0x1f, 0x401, 0x0, 0x7ff, 0x1, 0x1ff, 0x1, 0xffffffffffffffff, 0x5, 0x7fff, 0x700000000, 0x6, 0x7, 0x1ff, 0x5, 0x5, 0x8, 0x1231249f, 0x5, 0x1, 0x0, 0x3, 0x6, 0xff, 0xe0, 0x1, 0x3, 0x3a, 0x4, 0x7, 0x3, 0x8000, 0x1ff, 0x8, 0x3, 0x5, 0x7, 0x1f, 0x8, 0x7fff, 0x1, 0x5, 0x7, 0x2, 0x9, 0x20, 0x4, 0x10001, 0x1f, 0x1, 0x36, 0x4, 0xffffffff, 0x7fffffffffffffff, 0x5, 0x4, 0x3, 0x800, 0x4, 0x5, 0x540, 0xd8, 0x7f, 0x7fff, 0x9, 0x74f4a111, 0x8, 0x7, 0x6, 0x2, 0x0, 0x4, 0x2, 0x7, 0x0, 0xffffffffffffffc1, 0x59, 0x5, 0x4, 0x7fffffff, 0x6, 0x8, 0x3, 0x0, 0xffffffffffff8000]}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)) (async) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x31, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1}}, {@blksize={'blksize', 0x3d, 0xc00}}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@fowner_lt={'fowner<', r3}}, {@smackfsdef={'smackfsdef', 0x3d, 'fuse\x00'}}]}}, 0x0, 0x0, &(0x7f0000000200)="c416a1a94c68f16d391713bb2d2c5d09530b7c12b4e04434b00f3625faf80f781d0e31133fe428eadd542bee5c7a1039197269e2c7339f6cf0b318078db36d370a2cbd49df526339e994316118304084b16ecd7cbc2684282bc89a6f54d204178f04f354910e8744cfe9629675156943e897b35c") unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:54 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x101000, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:54 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x100000000000000) 14:42:54 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x2) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:54 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x200000000000000) 14:42:54 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/class/cuse', 0x6e0341, 0x38) read$ptp(r0, 0x0, 0x0) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) fsmount(r0, 0x1, 0x2) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) openat$smackfs_relabel_self(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (rerun: 64) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x83, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) r4 = fsmount(r3, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff000000000000000000000000000000e33b0100"/80]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) unlinkat(r5, &(0x7f0000000140)='./file0\x00', 0x200) (async) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)) (async, rerun: 32) r7 = openat$cgroup_pressure(r1, &(0x7f00000001c0)='io.pressure\x00', 0x2, 0x0) (rerun: 32) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r7}, 0x0, 0x4, @unused=[0x1, 0x7fff, 0xe1, 0xffff], @subvolid=0x1}) (async) epoll_pwait2(r1, &(0x7f0000000040)=[{}], 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100)={[0x2]}, 0x8) [ 1645.717967][T15416] fuse: Bad value for 'fd' [ 1645.722827][T15414] overlay: Unknown parameter '\õ½UK!ûª N½ÈÕ€)\,êàb•îËèCcyî!þäÆé(”eøä$ÇcV*6þj²ÿKiënŸ÷ŒeáSÊ…›\EOK„nöÇ' [ 1645.736510][T15417] fuse: Bad value for 'fd' 14:42:54 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) mount$nfs4(&(0x7f0000000040)='+\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000380)={[{'/\x14'}, {}, {'user_id'}, {'^@&{$*'}, {'fd'}], [{@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fowner_eq={'fowner', 0x3d, 0xee01}}, {@appraise}, {@euid_eq={'euid', 0x3d, r0}}, {@appraise}, {@euid_eq={'euid', 0x3d, r2}}, {@dont_measure}, {@dont_measure}, {@defcontext={'defcontext', 0x3d, 'root'}}, {@fsuuid={'fsuuid', 0x3d, {[0x0, 0x30, 0x65, 0x61, 0x64, 0x36, 0x37, 0x65], 0x2d, [0x34, 0x62, 0x33, 0x31], 0x2d, [0x36, 0x30, 0x31, 0x66], 0x2d, [0x65, 0x31, 0x35, 0x31], 0x2d, [0x39, 0x31, 0x32, 0x38, 0x61, 0x31, 0x63, 0x62]}}}]}) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) openat$cgroup_subtree(r4, &(0x7f0000000280), 0x2, 0x0) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001340)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000000100000000000000000000000000e192f116647fdd7f31a916cc7cb7afe4da10e8ccc3cc790e3523586820c25d07d220ffae1de5255c3ec2b2f4d59423369da9a511d09945f96fc6cb6295f97ace099cada507"]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r4, 0xc0189374, &(0x7f0000000240)=ANY=[@ANYBLOB="7f8a786ae4709196b07d0000", @ANYRES32=r1, @ANYBLOB="01800000000000002e2f66696c653000"]) 14:42:54 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="5c1ff5bd558f4b21fbaa10204ebdc8d580295c2ceae06295eecbe8436379ee0221fee4c6e9289465f8e41c1224c763562a901c3618fe0d1c6ab2ff4b69eb6e0f9ff78c65e153ca859b5c454f4b846ef615c70400b1c156b90c48aef791415744d49e04299ee1b5b99ff4ee5f128e107172ef8db22544bbde9bc5a8994442790bba541b4f798321844145214eadfeac2dafaee343dcef6c0e26ce4de4ecc08139340ca3e6f29ba3edde0c88350947b6d7559fc5cc317a1961a5be6a4725906a0e3d80769de1b7f3f32079ecc6079bb7da567682aabff4e123efd9e52f63961a469593a55fec0e936dfd1dd6466434491e9c4fcb455cf55106b4b0411bd8e98b60f7ebfc"]) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) fstat(r2, &(0x7f0000003880)) fstat(r1, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) 14:42:54 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:54 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x300000000000000) 14:42:54 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'], 0x0, 0x0, 0x0) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = fsopen(&(0x7f0000000280)='coda\x00', 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000001380)={0x0, 0x7, 0x0, [0x4, 0x6, 0x7, 0x400, 0x100000000], [0x2, 0x4, 0x3, 0xfc, 0x6a, 0x0, 0x1, 0x7fffffff, 0x7fffffff, 0x7, 0xffffffffffffffff, 0x9, 0x3, 0x100, 0x453, 0x1cb0000, 0x1, 0x5, 0x101, 0x7, 0x5, 0x800, 0x4, 0x9, 0x1, 0x0, 0x7, 0x6, 0xe44, 0xffffffffffffffff, 0x7, 0x1, 0x40, 0x5, 0x8, 0x5f, 0x1f, 0x401, 0x0, 0x7ff, 0x1, 0x1ff, 0x1, 0xffffffffffffffff, 0x5, 0x7fff, 0x700000000, 0x6, 0x7, 0x1ff, 0x5, 0x5, 0x8, 0x1231249f, 0x5, 0x1, 0x0, 0x3, 0x6, 0xff, 0xe0, 0x1, 0x3, 0x3a, 0x4, 0x7, 0x3, 0x8000, 0x1ff, 0x8, 0x3, 0x5, 0x7, 0x1f, 0x8, 0x7fff, 0x1, 0x5, 0x7, 0x2, 0x9, 0x20, 0x4, 0x10001, 0x1f, 0x1, 0x36, 0x4, 0xffffffff, 0x7fffffffffffffff, 0x5, 0x4, 0x3, 0x800, 0x4, 0x5, 0x540, 0xd8, 0x7f, 0x7fff, 0x9, 0x74f4a111, 0x8, 0x7, 0x6, 0x2, 0x0, 0x4, 0x2, 0x7, 0x0, 0xffffffffffffffc1, 0x59, 0x5, 0x4, 0x7fffffff, 0x6, 0x8, 0x3, 0x0, 0xffffffffffff8000]}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x31, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1}}, {@blksize={'blksize', 0x3d, 0xc00}}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@fowner_lt={'fowner<', r3}}, {@smackfsdef={'smackfsdef', 0x3d, 'fuse\x00'}}]}}, 0x0, 0x0, &(0x7f0000000200)="c416a1a94c68f16d391713bb2d2c5d09530b7c12b4e04434b00f3625faf80f781d0e31133fe428eadd542bee5c7a1039197269e2c7339f6cf0b318078db36d370a2cbd49df526339e994316118304084b16ecd7cbc2684282bc89a6f54d204178f04f354910e8744cfe9629675156943e897b35c") (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1645.913364][T15434] fuse: Bad value for 'fd' 14:42:55 executing program 4: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r1, 0xc0406619, &(0x7f00000000c0)={@id={0x2, 0x0, @b}}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='/dev/ptp0\x00', &(0x7f0000000040)='%#\x00', 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x40202, 0x0) read$ptp(r2, 0x0, 0x0) 14:42:55 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x400000000000000) [ 1645.959808][T15441] overlay: Unknown parameter '\õ½UK!ûª N½ÈÕ€)\,êàb•îËèCcyî!þäÆé(”eøä$ÇcV*6þj²ÿKiënŸ÷ŒeáSÊ…›\EOK„nöÇ' [ 1645.963787][T15443] fuse: Bad value for 'fd' [ 1645.996935][T15434] fuse: Bad value for 'user_id' 14:42:55 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) [ 1646.013331][T15434] nfs4: Unknown parameter '/' 14:42:55 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r0]) 14:42:55 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) mount$nfs4(&(0x7f0000000040)='+\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000380)={[{'/\x14'}, {}, {'user_id'}, {'^@&{$*'}, {'fd'}], [{@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fowner_eq={'fowner', 0x3d, 0xee01}}, {@appraise}, {@euid_eq={'euid', 0x3d, r0}}, {@appraise}, {@euid_eq={'euid', 0x3d, r2}}, {@dont_measure}, {@dont_measure}, {@defcontext={'defcontext', 0x3d, 'root'}}, {@fsuuid={'fsuuid', 0x3d, {[0x0, 0x30, 0x65, 0x61, 0x64, 0x36, 0x37, 0x65], 0x2d, [0x34, 0x62, 0x33, 0x31], 0x2d, [0x36, 0x30, 0x31, 0x66], 0x2d, [0x65, 0x31, 0x35, 0x31], 0x2d, [0x39, 0x31, 0x32, 0x38, 0x61, 0x31, 0x63, 0x62]}}}]}) (async) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) openat$cgroup_subtree(r4, &(0x7f0000000280), 0x2, 0x0) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001340)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000000100000000000000000000000000e192f116647fdd7f31a916cc7cb7afe4da10e8ccc3cc790e3523586820c25d07d220ffae1de5255c3ec2b2f4d59423369da9a511d09945f96fc6cb6295f97ace099cada507"]}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r4, 0xc0189374, &(0x7f0000000240)=ANY=[@ANYBLOB="7f8a786ae4709196b07d0000", @ANYRES32=r1, @ANYBLOB="01800000000000002e2f66696c653000"]) 14:42:55 executing program 2: r0 = syz_io_uring_complete(0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000080)='nolazytime\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000700)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="01040000150000002e2f66696c673000d180330fde89651430641db1ac74de199b148598255a0dc28daadb81e058717945323e1f89627df245aa81c0efe39c43d2c938700e9a7acbd11423dba7e322a7cde5c17169b14ae68ce939471dcb4b7023f63721af33250d9d58b99bc3acb24f2320d12cf8c1a15d1094c272ebcde920e6c77fb896adf89d398393e821dd5fa8f5176f5d00baf19bfb40d0e51f28cfc20a8bc869aa7b21323fb014c8532adb7fbb31a7992e659aad674637f1a24071334b011907a7b91cf7b2c5765cdc2da3d238b16098ecb0ed8ed02c1d88a609ec348cef2a4445cb96beb493f65b3aa50ea74765eeab42416250e5d6dfe6477f7cb0dde187b4cfa92e924e53acd99d04a137eac57828dc80cace6ba8ff08bde7009bd1a67c21"]) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) fstat(r3, &(0x7f0000003880)) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000300)={0x0, 0x7fffffff, 0xa4, 0x1}) unlinkat(r0, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:55 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x800000000000000) 14:42:55 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:55 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000100)='./file0\x00', 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r0]) 14:42:55 executing program 2: syz_io_uring_complete(0x0) (async) r0 = syz_io_uring_complete(0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000080)='nolazytime\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000700)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="01040000150000002e2f66696c673000d180330fde89651430641db1ac74de199b148598255a0dc28daadb81e058717945323e1f89627df245aa81c0efe39c43d2c938700e9a7acbd11423dba7e322a7cde5c17169b14ae68ce939471dcb4b7023f63721af33250d9d58b99bc3acb24f2320d12cf8c1a15d1094c272ebcde920e6c77fb896adf89d398393e821dd5fa8f5176f5d00baf19bfb40d0e51f28cfc20a8bc869aa7b21323fb014c8532adb7fbb31a7992e659aad674637f1a24071334b011907a7b91cf7b2c5765cdc2da3d238b16098ecb0ed8ed02c1d88a609ec348cef2a4445cb96beb493f65b3aa50ea74765eeab42416250e5d6dfe6477f7cb0dde187b4cfa92e924e53acd99d04a137eac57828dc80cace6ba8ff08bde7009bd1a67c21"]) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) (async) fstat(r3, &(0x7f0000003880)) fstat(r3, &(0x7f0000003880)) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000300)={0x0, 0x7fffffff, 0xa4, 0x1}) unlinkat(r0, &(0x7f0000000000)='./file0\x00', 0x200) [ 1646.131586][T15455] overlay: Unknown parameter '0xffffffffffffffff' [ 1646.164313][T15458] fuse: Bad value for 'fd' 14:42:55 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) mount$nfs4(&(0x7f0000000040)='+\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000380)={[{'/\x14'}, {}, {'user_id'}, {'^@&{$*'}, {'fd'}], [{@fsmagic={'fsmagic', 0x3d, 0x7}}, {@fowner_eq={'fowner', 0x3d, 0xee01}}, {@appraise}, {@euid_eq={'euid', 0x3d, r0}}, {@appraise}, {@euid_eq={'euid', 0x3d, r2}}, {@dont_measure}, {@dont_measure}, {@defcontext={'defcontext', 0x3d, 'root'}}, {@fsuuid={'fsuuid', 0x3d, {[0x0, 0x30, 0x65, 0x61, 0x64, 0x36, 0x37, 0x65], 0x2d, [0x34, 0x62, 0x33, 0x31], 0x2d, [0x36, 0x30, 0x31, 0x66], 0x2d, [0x65, 0x31, 0x35, 0x31], 0x2d, [0x39, 0x31, 0x32, 0x38, 0x61, 0x31, 0x63, 0x62]}}}]}) (async) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) openat$cgroup_subtree(r4, &(0x7f0000000280), 0x2, 0x0) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001340)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000000100000000000000000000000000e192f116647fdd7f31a916cc7cb7afe4da10e8ccc3cc790e3523586820c25d07d220ffae1de5255c3ec2b2f4d59423369da9a511d09945f96fc6cb6295f97ace099cada507"]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r4, 0xc0189374, &(0x7f0000000240)=ANY=[@ANYBLOB="7f8a786ae4709196b07d0000", @ANYRES32=r1, @ANYBLOB="01800000000000002e2f66696c653000"]) 14:42:55 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x804000000000000) [ 1646.249854][T15470] overlay: Unknown parameter '0xffffffffffffffff' [ 1646.312346][T15475] fuse: Bad value for 'user_id' [ 1646.317354][T15474] fuse: Bad value for 'user_id' 14:42:55 executing program 2: r0 = syz_io_uring_complete(0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000080)='nolazytime\x00', 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000700)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="01040000150000002e2f66696c673000d180330fde89651430641db1ac74de199b148598255a0dc28daadb81e058717945323e1f89627df245aa81c0efe39c43d2c938700e9a7acbd11423dba7e322a7cde5c17169b14ae68ce939471dcb4b7023f63721af33250d9d58b99bc3acb24f2320d12cf8c1a15d1094c272ebcde920e6c77fb896adf89d398393e821dd5fa8f5176f5d00baf19bfb40d0e51f28cfc20a8bc869aa7b21323fb014c8532adb7fbb31a7992e659aad674637f1a24071334b011907a7b91cf7b2c5765cdc2da3d238b16098ecb0ed8ed02c1d88a609ec348cef2a4445cb96beb493f65b3aa50ea74765eeab42416250e5d6dfe6477f7cb0dde187b4cfa92e924e53acd99d04a137eac57828dc80cace6ba8ff08bde7009bd1a67c21"]) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) (async) fstat(r3, &(0x7f0000003880)) (async) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000300)={0x0, 0x7fffffff, 0xa4, 0x1}) unlinkat(r0, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:55 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x2000, 0x103) 14:42:55 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000100)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r0]) 14:42:55 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xc00000000000000) 14:42:55 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) quotactl$Q_GETQUOTA(0xffffffff80000701, &(0x7f0000000180)=@filename='./file0\x00', r1, &(0x7f00000001c0)) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) 14:42:56 executing program 4: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r1, 0xc0406619, &(0x7f00000000c0)={@id={0x2, 0x0, @b}}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='/dev/ptp0\x00', &(0x7f0000000040)='%#\x00', 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x40202, 0x0) read$ptp(r2, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r1, 0xc0406619, &(0x7f00000000c0)={@id={0x2, 0x0, @b}}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='/dev/ptp0\x00', &(0x7f0000000040)='%#\x00', 0x0) (async) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x40202, 0x0) (async) read$ptp(r2, 0x0, 0x0) (async) 14:42:56 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:56 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(r0, 0x0, 0x2000, 0x103) 14:42:56 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x1800000000000000) 14:42:56 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) readlinkat(r0, &(0x7f0000000080)='./file1\x00', &(0x7f0000000180)=""/183, 0xb7) [ 1646.928696][T15486] overlay: Unknown parameter '0xffffffffffffffff' [ 1646.939845][T15489] fuse: Unknown parameter '0xffffffffffffffff' [ 1646.992142][T15489] fuse: Bad value for 'user_id' 14:42:56 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(r0, 0x0, 0x2000, 0x103) 14:42:56 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x2c1d000000000000) 14:42:56 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) quotactl$Q_GETQUOTA(0xffffffff80000701, &(0x7f0000000180)=@filename='./file0\x00', r1, &(0x7f00000001c0)) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) [ 1647.040979][T15496] fuse: Bad value for 'fd' [ 1647.058178][T15503] overlay: Unknown parameter '\' 14:42:56 executing program 4: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r1, 0xc0406619, &(0x7f00000000c0)={@id={0x2, 0x0, @b}}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000000)='/dev/ptp0\x00', &(0x7f0000000040)='%#\x00', 0x0) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x40202, 0x0) read$ptp(r2, 0x0, 0x0) 14:42:56 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) readlinkat(r0, &(0x7f0000000080)='./file1\x00', &(0x7f0000000180)=""/183, 0xb7) 14:42:56 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:56 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x2e00000000000000) 14:42:56 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(r0, 0x0, 0x2000, 0x103) 14:42:56 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) readlinkat(r0, &(0x7f0000000080)='./file1\x00', &(0x7f0000000180)=""/183, 0xb7) [ 1647.176241][T15515] overlay: Unknown parameter '\' [ 1647.177110][T15514] fuse: Unknown parameter '0xffffffffffffffff' [ 1647.192186][T15516] fuse: Bad value for 'fd' [ 1647.207509][T15517] fuse: Unknown parameter '0xffffffffffffffff' [ 1647.216070][T15516] fuse: Bad value for 'fd' 14:42:56 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async, rerun: 64) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) (rerun: 64) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async, rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (rerun: 64) [ 1647.243252][T15514] fuse: Bad value for 'user_id' 14:42:56 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) (async) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) quotactl$Q_GETQUOTA(0xffffffff80000701, &(0x7f0000000180)=@filename='./file0\x00', r1, &(0x7f00000001c0)) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)) 14:42:56 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0x103) [ 1647.283258][T15525] overlay: Unknown parameter '\' 14:42:56 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x3f00000000000000) 14:42:56 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x2008029, &(0x7f0000000100)=ANY=[@ANYBLOB='\\', @ANYRES8=r1, @ANYRESOCT=r3, @ANYRESOCT=r2, @ANYRES64=r3, @ANYRES64=r2, @ANYBLOB="22611d8348f6252d7eebac9bd70b6c8f8a536cf6136707057c592721f3918e897181265b4f3de0bca80d74fa60923ab03a5c363a2a3f2dba0ac687ab95ce44a801010000111ca499dc1da5538967043a08326a4dd986196bbda9e01699b3c242d22af9731f0772fbd17bb2ba69ac873e7cd22e29e6c6d2a2289af3468cc7448823f7cb0036ebe9a8abdd058b17711b06268027818673ba0efd78c2b7175bedd63c5327c3676469d4791cf08ac2e8c83d6c562edbdccfb9f49f55507a4a939a70c718bf2f5225216291c5248dbcffab695e34defa45006adcbc667cd6d47774a76fc740fc420617762425227f0822cdeab88c31c706b6111504cadb5cca2be0d5d0e84a51e38f475435a3a4c0b1a93aea62b9bcd6a733cb21c08b19fc5526b4b4cbe82751ad9e9357b48801bd8f3ac3e0228ba51e107a2a4f872609121d66c47eb3195735de66051587616915cfa1f8f1092daf31a9925d341ceab2f57e9d96f0ffb3ac"]) [ 1647.341151][T15528] fuse: Bad value for 'fd' [ 1647.362362][T15528] fuse: Bad value for 'fd' 14:42:56 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0x103) [ 1647.382570][T15535] fuse: Unknown parameter '0xffffffffffffffff' [ 1647.390425][T15528] fuse: Bad value for 'fd' [ 1647.402297][T15537] fuse: Bad value for 'user_id' [ 1647.408036][T15528] fuse: Bad value for 'fd' [ 1647.412747][T15535] fuse: Bad value for 'user_id' 14:42:57 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000240)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x80000010001}}, {@max_read={'max_read', 0x3d, 0x28}}, {@blksize={'blksize', 0x3d, 0x400}}, {@allow_other}, {@default_permissions}, {@allow_other}, {@max_read={'max_read', 0x3d, 0xdd1}}, {}, {@blksize={'blksize', 0x3d, 0x200}}, {@default_permissions}]}}, 0x3, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, r1, &(0x7f0000000100)={0x0, 0x7fffffffffffffff, 0x8, 0x3f, 0x4, 0x1, 0x0, 0x5, 0x1000}) 14:42:57 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) (async) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x2008029, &(0x7f0000000100)=ANY=[@ANYBLOB='\\', @ANYRES8=r1, @ANYRESOCT=r3, @ANYRESOCT=r2, @ANYRES64=r3, @ANYRES64=r2, @ANYBLOB="22611d8348f6252d7eebac9bd70b6c8f8a536cf6136707057c592721f3918e897181265b4f3de0bca80d74fa60923ab03a5c363a2a3f2dba0ac687ab95ce44a801010000111ca499dc1da5538967043a08326a4dd986196bbda9e01699b3c242d22af9731f0772fbd17bb2ba69ac873e7cd22e29e6c6d2a2289af3468cc7448823f7cb0036ebe9a8abdd058b17711b06268027818673ba0efd78c2b7175bedd63c5327c3676469d4791cf08ac2e8c83d6c562edbdccfb9f49f55507a4a939a70c718bf2f5225216291c5248dbcffab695e34defa45006adcbc667cd6d47774a76fc740fc420617762425227f0822cdeab88c31c706b6111504cadb5cca2be0d5d0e84a51e38f475435a3a4c0b1a93aea62b9bcd6a733cb21c08b19fc5526b4b4cbe82751ad9e9357b48801bd8f3ac3e0228ba51e107a2a4f872609121d66c47eb3195735de66051587616915cfa1f8f1092daf31a9925d341ceab2f57e9d96f0ffb3ac"]) 14:42:57 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x44a, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0xb10}}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r1, {r3, r5}}, './file0\x00'}) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000100)={@id, 0x40, 0x0, '\x00', @b}) 14:42:57 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x8900000000000000) 14:42:57 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) mknodat$null(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0x103) 14:42:57 executing program 4: epoll_create(0xa27f) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000100)=0x0) write$damon_schemes(0xffffffffffffffff, &(0x7f0000000000)={0x800, 0x1, 0x20, 0x20, 0x4, 0x8, 0xbca0}, 0x66) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r3, 0x50009418, &(0x7f0000000140)={{r4}, r1, 0x4, @unused=[0xffffffffffffebc0, 0xd4acc3a, 0x8, 0x80000000], @subvolid=0x7fffffffffffffff}) faccessat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2) read$ptp(r2, 0x0, 0x0) 14:42:57 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000240)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x80000010001}}, {@max_read={'max_read', 0x3d, 0x28}}, {@blksize={'blksize', 0x3d, 0x400}}, {@allow_other}, {@default_permissions}, {@allow_other}, {@max_read={'max_read', 0x3d, 0xdd1}}, {}, {@blksize={'blksize', 0x3d, 0x200}}, {@default_permissions}]}}, 0x3, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, r1, &(0x7f0000000100)={0x0, 0x7fffffffffffffff, 0x8, 0x3f, 0x4, 0x1, 0x0, 0x5, 0x1000}) 14:42:57 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x2008029, &(0x7f0000000100)=ANY=[@ANYBLOB='\\', @ANYRES8=r1, @ANYRESOCT=r3, @ANYRESOCT=r2, @ANYRES64=r3, @ANYRES64=r2, @ANYBLOB="22611d8348f6252d7eebac9bd70b6c8f8a536cf6136707057c592721f3918e897181265b4f3de0bca80d74fa60923ab03a5c363a2a3f2dba0ac687ab95ce44a801010000111ca499dc1da5538967043a08326a4dd986196bbda9e01699b3c242d22af9731f0772fbd17bb2ba69ac873e7cd22e29e6c6d2a2289af3468cc7448823f7cb0036ebe9a8abdd058b17711b06268027818673ba0efd78c2b7175bedd63c5327c3676469d4791cf08ac2e8c83d6c562edbdccfb9f49f55507a4a939a70c718bf2f5225216291c5248dbcffab695e34defa45006adcbc667cd6d47774a76fc740fc420617762425227f0822cdeab88c31c706b6111504cadb5cca2be0d5d0e84a51e38f475435a3a4c0b1a93aea62b9bcd6a733cb21c08b19fc5526b4b4cbe82751ad9e9357b48801bd8f3ac3e0228ba51e107a2a4f872609121d66c47eb3195735de66051587616915cfa1f8f1092daf31a9925d341ceab2f57e9d96f0ffb3ac"]) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r2, &(0x7f0000003880)) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x2008029, &(0x7f0000000100)=ANY=[@ANYBLOB='\\', @ANYRES8=r1, @ANYRESOCT=r3, @ANYRESOCT=r2, @ANYRES64=r3, @ANYRES64=r2, @ANYBLOB="22611d8348f6252d7eebac9bd70b6c8f8a536cf6136707057c592721f3918e897181265b4f3de0bca80d74fa60923ab03a5c363a2a3f2dba0ac687ab95ce44a801010000111ca499dc1da5538967043a08326a4dd986196bbda9e01699b3c242d22af9731f0772fbd17bb2ba69ac873e7cd22e29e6c6d2a2289af3468cc7448823f7cb0036ebe9a8abdd058b17711b06268027818673ba0efd78c2b7175bedd63c5327c3676469d4791cf08ac2e8c83d6c562edbdccfb9f49f55507a4a939a70c718bf2f5225216291c5248dbcffab695e34defa45006adcbc667cd6d47774a76fc740fc420617762425227f0822cdeab88c31c706b6111504cadb5cca2be0d5d0e84a51e38f475435a3a4c0b1a93aea62b9bcd6a733cb21c08b19fc5526b4b4cbe82751ad9e9357b48801bd8f3ac3e0228ba51e107a2a4f872609121d66c47eb3195735de66051587616915cfa1f8f1092daf31a9925d341ceab2f57e9d96f0ffb3ac"]) (async) [ 1648.024849][T15544] fuse: Bad value for 'fd' [ 1648.034203][T15544] fuse: Bad value for 'user_id' [ 1648.062377][T15551] fuse: Bad value for 'fd' 14:42:57 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x9100000000000000) [ 1648.097174][T15551] fuse: Bad value for 'user_id' 14:42:57 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async, rerun: 32) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (rerun: 32) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (rerun: 32) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x44a, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0xb10}}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r1, {r3, r5}}, './file0\x00'}) (async) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000100)={@id, 0x40, 0x0, '\x00', @b}) 14:42:57 executing program 0: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'], 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = fsopen(&(0x7f0000000280)='coda\x00', 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000001380)={0x0, 0x7, 0x0, [0x4, 0x6, 0x7, 0x400, 0x100000000], [0x2, 0x4, 0x3, 0xfc, 0x6a, 0x0, 0x1, 0x7fffffff, 0x7fffffff, 0x7, 0xffffffffffffffff, 0x9, 0x3, 0x100, 0x453, 0x1cb0000, 0x1, 0x5, 0x101, 0x7, 0x5, 0x800, 0x4, 0x9, 0x1, 0x0, 0x7, 0x6, 0xe44, 0xffffffffffffffff, 0x7, 0x1, 0x40, 0x5, 0x8, 0x5f, 0x1f, 0x401, 0x0, 0x7ff, 0x1, 0x1ff, 0x1, 0xffffffffffffffff, 0x5, 0x7fff, 0x700000000, 0x6, 0x7, 0x1ff, 0x5, 0x5, 0x8, 0x1231249f, 0x5, 0x1, 0x0, 0x3, 0x6, 0xff, 0xe0, 0x1, 0x3, 0x3a, 0x4, 0x7, 0x3, 0x8000, 0x1ff, 0x8, 0x3, 0x5, 0x7, 0x1f, 0x8, 0x7fff, 0x1, 0x5, 0x7, 0x2, 0x9, 0x20, 0x4, 0x10001, 0x1f, 0x1, 0x36, 0x4, 0xffffffff, 0x7fffffffffffffff, 0x5, 0x4, 0x3, 0x800, 0x4, 0x5, 0x540, 0xd8, 0x7f, 0x7fff, 0x9, 0x74f4a111, 0x8, 0x7, 0x6, 0x2, 0x0, 0x4, 0x2, 0x7, 0x0, 0xffffffffffffffc1, 0x59, 0x5, 0x4, 0x7fffffff, 0x6, 0x8, 0x3, 0x0, 0xffffffffffff8000]}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x31, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xee01}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1}}, {@blksize={'blksize', 0x3d, 0xc00}}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@fowner_eq={'fowner', 0x3d, 0xffffffffffffffff}}, {@fowner_lt={'fowner<', r3}}, {@smackfsdef={'smackfsdef', 0x3d, 'fuse\x00'}}]}}, 0x0, 0x0, &(0x7f0000000200)="c416a1a94c68f16d391713bb2d2c5d09530b7c12b4e04434b00f3625faf80f781d0e31133fe428eadd542bee5c7a1039197269e2c7339f6cf0b318078db36d370a2cbd49df526339e994316118304084b16ecd7cbc2684282bc89a6f54d204178f04f354910e8744cfe9629675156943e897b35c") unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1648.152816][T15557] fuse: Bad value for 'fd' 14:42:57 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xa1ffffffffffffff) 14:42:57 executing program 5: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x12508d8, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='X']) mount$pvfs2(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x40000, &(0x7f00000001c0)={[], [{@hash}, {@obj_user={'obj_user', 0x3d, 'overlay\x00'}}, {@context={'context', 0x3d, 'root'}}]}) [ 1648.202491][T15563] fuse: Bad value for 'fd' [ 1648.210475][T15557] fuse: Bad value for 'user_id' [ 1648.222294][T15568] fuse: Bad value for 'fd' 14:42:57 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000240)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x80000010001}}, {@max_read={'max_read', 0x3d, 0x28}}, {@blksize={'blksize', 0x3d, 0x400}}, {@allow_other}, {@default_permissions}, {@allow_other}, {@max_read={'max_read', 0x3d, 0xdd1}}, {}, {@blksize={'blksize', 0x3d, 0x200}}, {@default_permissions}]}}, 0x3, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000240)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@allow_other}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x80000010001}}, {@max_read={'max_read', 0x3d, 0x28}}, {@blksize={'blksize', 0x3d, 0x400}}, {@allow_other}, {@default_permissions}, {@allow_other}, {@max_read={'max_read', 0x3d, 0xdd1}}, {}, {@blksize={'blksize', 0x3d, 0x200}}, {@default_permissions}]}}, 0x3, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, r1, &(0x7f0000000100)={0x0, 0x7fffffffffffffff, 0x8, 0x3f, 0x4, 0x1, 0x0, 0x5, 0x1000}) 14:42:57 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xe4ffffff00000000) 14:42:57 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x44a, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0xb10}}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r1, {r3, r5}}, './file0\x00'}) (async) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000100)={@id, 0x40, 0x0, '\x00', @b}) [ 1648.284434][T15563] fuse: Bad value for 'user_id' 14:42:57 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000200)={0x0, 0x7}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000600)={r6, 0xffffffffffffffff, 0x1, [0x3, 0x666, 0x0, 0x3, 0x8], [0x8, 0x10001, 0x100, 0x8, 0x6, 0x9, 0x80000000, 0x9, 0x3, 0x3ff, 0x8, 0x3, 0x3, 0x1, 0x5, 0x7, 0x0, 0x5, 0x1, 0x5, 0xfffffffffffffff9, 0x0, 0x5bf3, 0xe8, 0xd575, 0x1, 0x10000, 0xffffffffffff0001, 0x1, 0x10000, 0x9, 0x80, 0x3, 0x5, 0x2, 0x0, 0x3, 0x6, 0xf95ce27, 0x5, 0x80000000, 0x2, 0x10000, 0xfd, 0x8, 0x3, 0x400, 0xffffffffffffff80, 0x5059e2fc, 0x3, 0x0, 0x8, 0x1, 0x0, 0x5, 0x6, 0x8001, 0xffffffffffffff01, 0x20, 0x98e, 0x5, 0xc7, 0x7f, 0x7, 0x80000000, 0x8000, 0x1, 0x21a, 0x8, 0xcc, 0xcc9c, 0x3, 0x7, 0x6, 0x10000, 0x7, 0x2, 0xfffffffffffffe00, 0x19ff, 0x1000, 0x1, 0xa1, 0x8, 0x8, 0x4f60, 0x5, 0x6, 0x8, 0xc5ca, 0x37, 0x697, 0x4, 0xd90, 0x5, 0xfffffffffffffffc, 0x9, 0x6, 0x7ff, 0x2, 0x254, 0x9, 0x1, 0x7fffffffffffffff, 0x8, 0x29e, 0x5, 0x3, 0x8, 0x6, 0x9, 0x0, 0x3, 0x7fffffff, 0x4, 0x951c, 0x101, 0x0, 0x6, 0x800, 0x9, 0x7f]}) [ 1648.359170][T15576] overlay: Unknown parameter 'X' [ 1648.359977][T15577] fuse: Bad value for 'fd' [ 1648.362799][T15578] fuse: Bad value for 'fd' [ 1648.390756][T15577] fuse: Bad value for 'user_id' [ 1648.433553][T15582] fuse: Bad value for 'user_id' [ 1648.473817][T15585] overlay: Unknown parameter '' 14:42:58 executing program 4: epoll_create(0xa27f) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000100)=0x0) (async, rerun: 32) write$damon_schemes(0xffffffffffffffff, &(0x7f0000000000)={0x800, 0x1, 0x20, 0x20, 0x4, 0x8, 0xbca0}, 0x66) (async, rerun: 32) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) (async) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r3, 0x50009418, &(0x7f0000000140)={{r4}, r1, 0x4, @unused=[0xffffffffffffebc0, 0xd4acc3a, 0x8, 0x80000000], @subvolid=0x7fffffffffffffff}) (async) faccessat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2) read$ptp(r2, 0x0, 0x0) 14:42:58 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xfbffffff00000000) 14:42:58 executing program 5: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x12508d8, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='X']) (async) mount$pvfs2(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x40000, &(0x7f00000001c0)={[], [{@hash}, {@obj_user={'obj_user', 0x3d, 'overlay\x00'}}, {@context={'context', 0x3d, 'root'}}]}) 14:42:58 executing program 3: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee01}}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d8864653d17303030303030303030303030301bd3303030303030222c75736572243d643d2431281e386c045d7806077c8e01df1f4b828adc38f27a", @ANYRESDEC=r0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:58 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x3, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:58 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000200)={0x0, 0x7}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000600)={r6, 0xffffffffffffffff, 0x1, [0x3, 0x666, 0x0, 0x3, 0x8], [0x8, 0x10001, 0x100, 0x8, 0x6, 0x9, 0x80000000, 0x9, 0x3, 0x3ff, 0x8, 0x3, 0x3, 0x1, 0x5, 0x7, 0x0, 0x5, 0x1, 0x5, 0xfffffffffffffff9, 0x0, 0x5bf3, 0xe8, 0xd575, 0x1, 0x10000, 0xffffffffffff0001, 0x1, 0x10000, 0x9, 0x80, 0x3, 0x5, 0x2, 0x0, 0x3, 0x6, 0xf95ce27, 0x5, 0x80000000, 0x2, 0x10000, 0xfd, 0x8, 0x3, 0x400, 0xffffffffffffff80, 0x5059e2fc, 0x3, 0x0, 0x8, 0x1, 0x0, 0x5, 0x6, 0x8001, 0xffffffffffffff01, 0x20, 0x98e, 0x5, 0xc7, 0x7f, 0x7, 0x80000000, 0x8000, 0x1, 0x21a, 0x8, 0xcc, 0xcc9c, 0x3, 0x7, 0x6, 0x10000, 0x7, 0x2, 0xfffffffffffffe00, 0x19ff, 0x1000, 0x1, 0xa1, 0x8, 0x8, 0x4f60, 0x5, 0x6, 0x8, 0xc5ca, 0x37, 0x697, 0x4, 0xd90, 0x5, 0xfffffffffffffffc, 0x9, 0x6, 0x7ff, 0x2, 0x254, 0x9, 0x1, 0x7fffffffffffffff, 0x8, 0x29e, 0x5, 0x3, 0x8, 0x6, 0x9, 0x0, 0x3, 0x7fffffff, 0x4, 0x951c, 0x101, 0x0, 0x6, 0x800, 0x9, 0x7f]}) 14:42:58 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xfeffffff00000000) [ 1648.988762][T15589] fuse: Bad value for 'fd' 14:42:58 executing program 5: syz_mount_image$fuse(0x0, &(0x7f0000000080)='./file0\x00', 0x12508d8, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='X']) (async, rerun: 64) mount$pvfs2(&(0x7f00000000c0), &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x40000, &(0x7f00000001c0)={[], [{@hash}, {@obj_user={'obj_user', 0x3d, 'overlay\x00'}}, {@context={'context', 0x3d, 'root'}}]}) 14:42:58 executing program 3: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee01}}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d8864653d17303030303030303030303030301bd3303030303030222c75736572243d643d2431281e386c045d7806077c8e01df1f4b828adc38f27a", @ANYRESDEC=r0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee01}}, './file0\x00'}) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d8864653d17303030303030303030303030301bd3303030303030222c75736572243d643d2431281e386c045d7806077c8e01df1f4b828adc38f27a", @ANYRESDEC=r0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:58 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x3, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:58 executing program 4: epoll_create(0xa27f) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000100)=0x0) write$damon_schemes(0xffffffffffffffff, &(0x7f0000000000)={0x800, 0x1, 0x20, 0x20, 0x4, 0x8, 0xbca0}, 0x66) (async) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) (async) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) (async) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r3, 0x50009418, &(0x7f0000000140)={{r4}, r1, 0x4, @unused=[0xffffffffffffebc0, 0xd4acc3a, 0x8, 0x80000000], @subvolid=0x7fffffffffffffff}) (async) faccessat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x2) (async) read$ptp(r2, 0x0, 0x0) [ 1649.012234][T15596] fuse: Bad value for 'fd' [ 1649.022291][T15595] overlay: Unknown parameter 'X' [ 1649.039961][T15594] overlay: Unknown parameter '' 14:42:58 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000200)={0x0, 0x7}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000600)={r6, 0xffffffffffffffff, 0x1, [0x3, 0x666, 0x0, 0x3, 0x8], [0x8, 0x10001, 0x100, 0x8, 0x6, 0x9, 0x80000000, 0x9, 0x3, 0x3ff, 0x8, 0x3, 0x3, 0x1, 0x5, 0x7, 0x0, 0x5, 0x1, 0x5, 0xfffffffffffffff9, 0x0, 0x5bf3, 0xe8, 0xd575, 0x1, 0x10000, 0xffffffffffff0001, 0x1, 0x10000, 0x9, 0x80, 0x3, 0x5, 0x2, 0x0, 0x3, 0x6, 0xf95ce27, 0x5, 0x80000000, 0x2, 0x10000, 0xfd, 0x8, 0x3, 0x400, 0xffffffffffffff80, 0x5059e2fc, 0x3, 0x0, 0x8, 0x1, 0x0, 0x5, 0x6, 0x8001, 0xffffffffffffff01, 0x20, 0x98e, 0x5, 0xc7, 0x7f, 0x7, 0x80000000, 0x8000, 0x1, 0x21a, 0x8, 0xcc, 0xcc9c, 0x3, 0x7, 0x6, 0x10000, 0x7, 0x2, 0xfffffffffffffe00, 0x19ff, 0x1000, 0x1, 0xa1, 0x8, 0x8, 0x4f60, 0x5, 0x6, 0x8, 0xc5ca, 0x37, 0x697, 0x4, 0xd90, 0x5, 0xfffffffffffffffc, 0x9, 0x6, 0x7ff, 0x2, 0x254, 0x9, 0x1, 0x7fffffffffffffff, 0x8, 0x29e, 0x5, 0x3, 0x8, 0x6, 0x9, 0x0, 0x3, 0x7fffffff, 0x4, 0x951c, 0x101, 0x0, 0x6, 0x800, 0x9, 0x7f]}) 14:42:58 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xffffff7f00000000) [ 1649.154823][T15606] fuse: Bad value for 'fd' [ 1649.172164][T15608] overlay: Unknown parameter 'X' [ 1649.191539][T15606] fuse: Bad value for 'fd' 14:42:58 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0xffffffffffffffa1) 14:42:58 executing program 3: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee01}}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d8864653d17303030303030303030303030301bd3303030303030222c75736572243d643d2431281e386c045d7806077c8e01df1f4b828adc38f27a", @ANYRESDEC=r0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) 14:42:58 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x218201, 0x0) read$ptp(r0, 0x0, 0x0) [ 1649.202837][T15608] overlay: Unknown parameter 'X' [ 1649.208592][T15619] fuse: Bad value for 'fd' [ 1649.220826][T15608] overlay: Unknown parameter 'X' [ 1649.236578][T15608] overlay: Unknown parameter 'X' [ 1649.242190][T15608] overlay: Unknown parameter 'X' 14:42:58 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x3, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x3, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:42:58 executing program 3: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) fstat(r1, &(0x7f0000000180)) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id.', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00', @ANYRES32=r0], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x40000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000240)={{0x1, 0x1, 0x18, r2}, './file0/file0\x00'}) [ 1649.275597][T15608] overlay: Unknown parameter 'X' [ 1649.283339][T15620] overlay: Unknown parameter '' [ 1649.288705][T15625] fuse: Bad value for 'fd' [ 1649.302781][T15608] overlay: Unknown parameter 'X' 14:42:58 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x218201, 0x0) read$ptp(r0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x218201, 0x0) (async) read$ptp(r0, 0x0, 0x0) (async) [ 1649.325989][T15608] overlay: Unknown parameter 'X' [ 1649.357302][T15608] overlay: Unknown parameter 'X' [ 1649.380986][T15608] overlay: Unknown parameter 'X' [ 1649.396989][T15633] fuse: Bad value for 'fd' [ 1649.405141][T15608] overlay: Unknown parameter 'X' [ 1649.412361][T15608] overlay: Unknown parameter 'X' [ 1649.417976][T15633] fuse: Bad value for 'fd' [ 1649.422248][T15636] fuse: Bad value for 'fd' [ 1649.431764][T15608] overlay: Unknown parameter 'X' [ 1649.443348][T15608] overlay: Unknown parameter 'X' [ 1649.456453][T15608] overlay: Unknown parameter 'X' [ 1649.462069][T15608] overlay: Unknown parameter 'X' [ 1649.468649][T15608] overlay: Unknown parameter 'X' [ 1649.474389][T15608] overlay: Unknown parameter 'X' [ 1649.483625][T15608] overlay: Unknown parameter 'X' [ 1649.490099][T15608] overlay: Unknown parameter 'X' [ 1649.495977][T15608] overlay: Unknown parameter 'X' [ 1649.501263][T15608] overlay: Unknown parameter 'X' [ 1649.506943][T15608] overlay: Unknown parameter 'X' [ 1649.512182][T15608] overlay: Unknown parameter 'X' [ 1649.518080][T15608] overlay: Unknown parameter 'X' [ 1649.523449][T15608] overlay: Unknown parameter 'X' [ 1649.528858][T15608] overlay: Unknown parameter 'X' [ 1649.534488][T15608] overlay: Unknown parameter 'X' [ 1649.540071][T15608] overlay: Unknown parameter 'X' [ 1649.545882][T15608] overlay: Unknown parameter 'X' [ 1649.551529][T15608] overlay: Unknown parameter 'X' [ 1649.557077][T15608] overlay: Unknown parameter 'X' [ 1649.562592][T15608] overlay: Unknown parameter 'X' [ 1649.568463][T15608] overlay: Unknown parameter 'X' [ 1649.574222][T15608] overlay: Unknown parameter 'X' [ 1649.581813][T15608] overlay: Unknown parameter 'X' [ 1649.588434][T15608] overlay: Unknown parameter 'X' [ 1649.593760][T15608] overlay: Unknown parameter 'X' [ 1649.600277][T15608] overlay: Unknown parameter 'X' [ 1649.606168][T15608] overlay: Unknown parameter 'X' [ 1649.611756][T15608] overlay: Unknown parameter 'X' [ 1649.617572][T15608] overlay: Unknown parameter 'X' [ 1649.622873][T15608] overlay: Unknown parameter 'X' [ 1649.628461][T15608] overlay: Unknown parameter 'X' [ 1649.633822][T15608] overlay: Unknown parameter 'X' [ 1649.639767][T15608] overlay: Unknown parameter 'X' [ 1649.645116][T15608] overlay: Unknown parameter 'X' [ 1649.650780][T15608] overlay: Unknown parameter 'X' [ 1649.656598][T15608] overlay: Unknown parameter 'X' [ 1649.661996][T15608] overlay: Unknown parameter 'X' [ 1649.667950][T15608] overlay: Unknown parameter 'X' [ 1649.673344][T15608] overlay: Unknown parameter 'X' [ 1649.679032][T15608] overlay: Unknown parameter 'X' [ 1649.686402][T15608] overlay: Unknown parameter 'X' [ 1649.691899][T15608] overlay: Unknown parameter 'X' [ 1649.697759][T15608] overlay: Unknown parameter 'X' [ 1649.703212][T15608] overlay: Unknown parameter 'X' [ 1649.709038][T15608] overlay: Unknown parameter 'X' [ 1649.714551][T15608] overlay: Unknown parameter 'X' [ 1649.720178][T15608] overlay: Unknown parameter 'X' [ 1649.726919][T15608] overlay: Unknown parameter 'X' 14:42:58 executing program 1: fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000040)='\x11\x00', &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff) fchmodat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x120) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:42:58 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000200)={0x0, 0x7}) 14:42:58 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x218201, 0x0) read$ptp(r0, 0x0, 0x0) 14:42:58 executing program 3: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) (async) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) fstat(r1, &(0x7f0000000180)) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id.', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00', @ANYRES32=r0], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x40000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000240)={{0x1, 0x1, 0x18, r2}, './file0/file0\x00'}) 14:42:58 executing program 2: unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200) 14:42:58 executing program 5: ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xfaa9}}, './file0\x00'}) faccessat(r0, &(0x7f0000000100)='./file0\x00', 0xc) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="dc"]) [ 1649.732547][T15608] overlay: Unknown parameter 'X' [ 1649.738579][T15608] overlay: Unknown parameter 'X' [ 1649.744170][T15608] overlay: Unknown parameter 'X' [ 1649.749673][T15608] overlay: Unknown parameter 'X' 14:42:58 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$smackfs_cipsonum(0xffffffffffffffff, &(0x7f00000000c0), 0x14) read$ptp(r0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="02000000000000002e53365cde2f6669"]) openat$incfs(r1, &(0x7f0000000040)='.pending_reads\x00', 0x400100, 0x140) 14:42:58 executing program 1: fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000040)='\x11\x00', &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff) (async) fchmodat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x120) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:42:58 executing program 2: unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200) [ 1649.803249][T15642] overlay: Unknown parameter '' [ 1649.813919][T15647] fuse: Bad value for 'fd' 14:42:58 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder-control\x00', 0x0, 0x0) 14:42:58 executing program 3: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) (async) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) fstat(r1, &(0x7f0000000180)) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id.', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00', @ANYRES32=r0], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200), 0x40000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000240)={{0x1, 0x1, 0x18, r2}, './file0/file0\x00'}) 14:42:59 executing program 2: unlinkat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200) [ 1649.898330][T15650] overlay: Unknown parameter 'Ü' 14:42:59 executing program 1: fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000040)='\x11\x00', &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff) fchmodat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x120) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:42:59 executing program 5: ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xfaa9}}, './file0\x00'}) faccessat(r0, &(0x7f0000000100)='./file0\x00', 0xc) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="dc"]) 14:42:59 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) renameat2(r0, &(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000100)='./file0\x00', 0x6) 14:42:59 executing program 1: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/snd_intel_dspcfg', 0x50040, 0x20) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000080)=""/212, 0xd4, &(0x7f0000000180)=""/76, 0x1, 0x4}}, 0x48) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) [ 1649.959989][T15658] overlay: Unknown parameter '' [ 1649.966168][T15662] fuse: Bad value for 'fd' 14:42:59 executing program 5: ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xfaa9}}, './file0\x00'}) faccessat(r0, &(0x7f0000000100)='./file0\x00', 0xc) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="dc"]) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xfaa9}}, './file0\x00'}) (async) faccessat(r0, &(0x7f0000000100)='./file0\x00', 0xc) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="dc"]) (async) 14:42:59 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000080)={@id={0x2, 0x0, @a}}) [ 1650.023744][T15669] overlay: Unknown parameter 'Ü' [ 1650.098210][T15673] fuse: Bad value for 'fd' [ 1650.125598][T15676] overlay: Unknown parameter 'Ü' [ 1650.137422][T15677] overlay: Unknown parameter '' [ 1650.149756][T15676] overlay: Unknown parameter 'Ü' 14:42:59 executing program 1: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/snd_intel_dspcfg', 0x50040, 0x20) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000080)=""/212, 0xd4, &(0x7f0000000180)=""/76, 0x1, 0x4}}, 0x48) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:42:59 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) 14:42:59 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) renameat2(r0, &(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000100)='./file0\x00', 0x6) 14:42:59 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000140)=ANY=[]) 14:42:59 executing program 5: ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8}}, './file0\x00'}) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) r1 = openat$cgroup_pressure(r0, &(0x7f0000000240)='cpu.pressure\x00', 0x2, 0x0) r2 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x90000, &(0x7f0000000180)=ANY=[@ANYRES32=r1]) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f00000001c0)=ANY=[@ANYBLOB="93e02945b92961393c4501000021000000800018000800", @ANYRES32=r2, @ANYBLOB="02000000070000002e2f66696c653000"]) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0xc018937a, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x10001}}, './file0\x00'}) 14:42:59 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) read$smackfs_cipsonum(0xffffffffffffffff, &(0x7f00000000c0), 0x14) read$ptp(r0, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="02000000000000002e53365cde2f6669"]) openat$incfs(r1, &(0x7f0000000040)='.pending_reads\x00', 0x400100, 0x140) 14:42:59 executing program 5: ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8}}, './file0\x00'}) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) (async) r1 = openat$cgroup_pressure(r0, &(0x7f0000000240)='cpu.pressure\x00', 0x2, 0x0) (async) r2 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x90000, &(0x7f0000000180)=ANY=[@ANYRES32=r1]) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f00000001c0)=ANY=[@ANYBLOB="93e02945b92961393c4501000021000000800018000800", @ANYRES32=r2, @ANYBLOB="02000000070000002e2f66696c653000"]) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0xc018937a, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x10001}}, './file0\x00'}) [ 1650.788991][T15688] fuse: Bad value for 'fd' 14:42:59 executing program 1: r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/snd_intel_dspcfg', 0x50040, 0x20) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000080)=""/212, 0xd4, &(0x7f0000000180)=""/76, 0x1, 0x4}}, 0x48) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:42:59 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) (async) [ 1650.816308][T15685] fuse: Bad value for 'fd' [ 1650.819041][T15686] overlay: Unknown parameter '' 14:42:59 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) renameat2(r0, &(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000100)='./file0\x00', 0x6) 14:42:59 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) 14:43:00 executing program 5: ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8}}, './file0\x00'}) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) r1 = openat$cgroup_pressure(r0, &(0x7f0000000240)='cpu.pressure\x00', 0x2, 0x0) r2 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x90000, &(0x7f0000000180)=ANY=[@ANYRES32=r1]) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f00000001c0)=ANY=[@ANYBLOB="93e02945b92961393c4501000021000000800018000800", @ANYRES32=r2, @ANYBLOB="02000000070000002e2f66696c653000"]) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0xc018937a, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x10001}}, './file0\x00'}) 14:43:00 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) statfs(&(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000100)=""/30) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0xff54, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x1000, 0x10000}}}, @subvolid=0x1}) linkat(r1, &(0x7f0000000040)='./file0\x00', r3, &(0x7f0000000080)='./file0\x00', 0x400) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r5, {0x9}}, './file0/file1\x00'}) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa, 0x2010, r5, 0x43bf000) fcntl$getownex(r1, 0x10, &(0x7f0000000140)) [ 1650.939977][T15703] fuse: Bad value for 'fd' 14:43:00 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) 14:43:00 executing program 5: munmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\\', @ANYRES16=r0, @ANYRES8=r1, @ANYBLOB="0383f21f3e3149ed5b6c6764296ad157c5629cf381cb79c8f446b6cfc04bbdc10a6eaaaf9000e8f753177cbaa89cfc69ab7cdb35e980b314e664686f1ca7b4597a3ad8096fed28ea61cd7e2899b39aed7049f7656b8f2c6b0769a95375d83146b4fba45f51752c7d028b2bfce658c8d3e2b7df5e364b00efcbd1ab50323d817364d16a279eb0883f0582530bd6801ad2eb8b5722d27cb6", @ANYRES32=r2]) r3 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000080), 0x452162, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) 14:43:00 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) statfs(&(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000100)=""/30) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0xff54, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x1000, 0x10000}}}, @subvolid=0x1}) linkat(r1, &(0x7f0000000040)='./file0\x00', r3, &(0x7f0000000080)='./file0\x00', 0x400) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) (async) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r5, {0x9}}, './file0/file1\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r5, {0x9}}, './file0/file1\x00'}) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa, 0x2010, r5, 0x43bf000) (async) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa, 0x2010, r5, 0x43bf000) fcntl$getownex(r1, 0x10, &(0x7f0000000140)) [ 1650.966828][T15705] fuse: Bad value for 'fd' [ 1650.985667][T15703] fuse: Bad value for 'fd' 14:43:00 executing program 3: r0 = syz_io_uring_complete(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_create1(0x80000) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1651.084492][T15720] fuse: Bad value for 'fd' [ 1651.091961][T15718] overlay: Unknown parameter '\ÿÿƒò>1Ií[lgd)jÑWÅbœóËyÈôF¶ÏÀK½Á [ 1651.091961][T15718] nª¯' 14:43:00 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$smackfs_cipsonum(0xffffffffffffffff, &(0x7f00000000c0), 0x14) (async) read$ptp(r0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="02000000000000002e53365cde2f6669"]) openat$incfs(r1, &(0x7f0000000040)='.pending_reads\x00', 0x400100, 0x140) 14:43:00 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) 14:43:00 executing program 3: r0 = syz_io_uring_complete(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_create1(0x80000) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:00 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) 14:43:00 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) statfs(&(0x7f00000000c0)='./file0/file0\x00', &(0x7f0000000100)=""/30) (async) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0xff54, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x1000, 0x10000}}}, @subvolid=0x1}) (async) linkat(r1, &(0x7f0000000040)='./file0\x00', r3, &(0x7f0000000080)='./file0\x00', 0x400) (async) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r5, {0x9}}, './file0/file1\x00'}) (async) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xa, 0x2010, r5, 0x43bf000) fcntl$getownex(r1, 0x10, &(0x7f0000000140)) 14:43:00 executing program 5: munmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\\', @ANYRES16=r0, @ANYRES8=r1, @ANYBLOB="0383f21f3e3149ed5b6c6764296ad157c5629cf381cb79c8f446b6cfc04bbdc10a6eaaaf9000e8f753177cbaa89cfc69ab7cdb35e980b314e664686f1ca7b4597a3ad8096fed28ea61cd7e2899b39aed7049f7656b8f2c6b0769a95375d83146b4fba45f51752c7d028b2bfce658c8d3e2b7df5e364b00efcbd1ab50323d817364d16a279eb0883f0582530bd6801ad2eb8b5722d27cb6", @ANYRES32=r2]) r3 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000080), 0x452162, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) [ 1651.689067][T15725] fuse: Bad value for 'fd' 14:43:00 executing program 3: r0 = syz_io_uring_complete(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_create1(0x80000) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_io_uring_complete(0x0) (async) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) (async) epoll_create1(0x80000) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:00 executing program 1: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x307020, 0x0, 0x4, 0x0, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:00 executing program 5: munmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='\\', @ANYRES16=r0, @ANYRES8=r1, @ANYBLOB="0383f21f3e3149ed5b6c6764296ad157c5629cf381cb79c8f446b6cfc04bbdc10a6eaaaf9000e8f753177cbaa89cfc69ab7cdb35e980b314e664686f1ca7b4597a3ad8096fed28ea61cd7e2899b39aed7049f7656b8f2c6b0769a95375d83146b4fba45f51752c7d028b2bfce658c8d3e2b7df5e364b00efcbd1ab50323d817364d16a279eb0883f0582530bd6801ad2eb8b5722d27cb6", @ANYRES32=r2]) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000080), 0x452162, 0x0) (async) r3 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000080), 0x452162, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) 14:43:00 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) [ 1651.723619][T15727] overlay: Unknown parameter '\ÿÿƒò>1Ií[lgd)jÑWÅbœóËyÈôF¶ÏÀK½Á [ 1651.723619][T15727] nª¯' [ 1651.752581][T15736] fuse: Bad value for 'fd' 14:43:00 executing program 2: mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6, 0x10, 0xffffffffffffffff, 0x3) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c00d0cb8a607a1182544eea62f6bbae2247bb515c27eebf98b41cf545ae690fcc414c05cb644553c94f95a404d92a8390e8226f0de1efd540f57b394cddbab1d44eea4fcf2c12d2c3daf4caec1014c912cfcff7e85df6a3ec0f47740b5dea8bb90f06f1e3fb0fe20c6b7a5a440d2d884002bb0cec3c5c591d3de5c7120d4c32e8f3104f45fae7c7c085b2f3f0245af082bbbb094891c83f36ece678e7e05140a8a43d5fbc031b7a3e53f896bf8aa979485e9892425bc88abdf17d8ff480a1320c35dff27ce3ca955fb73b2a7920d3f77645"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:00 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1651.815861][T15744] fuse: Bad value for 'fd' [ 1651.874755][T15752] fuse: Bad value for 'fd' [ 1651.901049][T15753] overlay: Unknown parameter '\ÿÿƒò>1Ií[lgd)jÑWÅbœóËyÈôF¶ÏÀK½Á [ 1651.901049][T15753] nª¯' [ 1651.915656][T15757] fuse: Bad value for 'fd' 14:43:01 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/loop', 0x10000, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000140)={0x7, 0x8, 0xfa00, {r1, 0x1}}, 0x10) read$ptp(r0, 0x0, 0x0) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x0, @unused=[0x5, 0x3f, 0x8, 0x6388], @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r4, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, r4, {0x1, 0x4}}, './file0\x00'}) ioctl$BTRFS_IOC_START_SYNC(r4, 0x80089418, &(0x7f0000000280)) fsconfig$FSCONFIG_SET_PATH_EMPTY(r5, 0x4, &(0x7f00000001c0)='[)\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x70, 0xfff}}, './file0\x00'}) 14:43:01 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) 14:43:01 executing program 1: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x307020, 0x0, 0x4, 0x0, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:01 executing program 2: mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6, 0x10, 0xffffffffffffffff, 0x3) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c00d0cb8a607a1182544eea62f6bbae2247bb515c27eebf98b41cf545ae690fcc414c05cb644553c94f95a404d92a8390e8226f0de1efd540f57b394cddbab1d44eea4fcf2c12d2c3daf4caec1014c912cfcff7e85df6a3ec0f47740b5dea8bb90f06f1e3fb0fe20c6b7a5a440d2d884002bb0cec3c5c591d3de5c7120d4c32e8f3104f45fae7c7c085b2f3f0245af082bbbb094891c83f36ece678e7e05140a8a43d5fbc031b7a3e53f896bf8aa979485e9892425bc88abdf17d8ff480a1320c35dff27ce3ca955fb73b2a7920d3f77645"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6, 0x10, 0xffffffffffffffff, 0x3) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c00d0cb8a607a1182544eea62f6bbae2247bb515c27eebf98b41cf545ae690fcc414c05cb644553c94f95a404d92a8390e8226f0de1efd540f57b394cddbab1d44eea4fcf2c12d2c3daf4caec1014c912cfcff7e85df6a3ec0f47740b5dea8bb90f06f1e3fb0fe20c6b7a5a440d2d884002bb0cec3c5c591d3de5c7120d4c32e8f3104f45fae7c7c085b2f3f0245af082bbbb094891c83f36ece678e7e05140a8a43d5fbc031b7a3e53f896bf8aa979485e9892425bc88abdf17d8ff480a1320c35dff27ce3ca955fb73b2a7920d3f77645"], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:01 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x8400, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:01 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) [ 1652.643836][T15762] fuse: Bad value for 'fd' [ 1652.667968][T15762] fuse: Bad value for 'fd' [ 1652.672105][T15767] fuse: Bad value for 'fd' [ 1652.684338][T15769] overlay: Unknown parameter '\' 14:43:01 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/loop', 0x10000, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000140)={0x7, 0x8, 0xfa00, {r1, 0x1}}, 0x10) (async) read$ptp(r0, 0x0, 0x0) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x0, @unused=[0x5, 0x3f, 0x8, 0x6388], @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r4, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, r4, {0x1, 0x4}}, './file0\x00'}) ioctl$BTRFS_IOC_START_SYNC(r4, 0x80089418, &(0x7f0000000280)) (async) fsconfig$FSCONFIG_SET_PATH_EMPTY(r5, 0x4, &(0x7f00000001c0)='[)\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x70, 0xfff}}, './file0\x00'}) 14:43:01 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:01 executing program 1: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x307020, 0x0, 0x4, 0x0, 0x0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x307020, 0x0, 0x4, 0x0, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:01 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) fstat(r3, &(0x7f0000003880)) 14:43:01 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x8400, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:01 executing program 2: mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6, 0x10, 0xffffffffffffffff, 0x3) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c00d0cb8a607a1182544eea62f6bbae2247bb515c27eebf98b41cf545ae690fcc414c05cb644553c94f95a404d92a8390e8226f0de1efd540f57b394cddbab1d44eea4fcf2c12d2c3daf4caec1014c912cfcff7e85df6a3ec0f47740b5dea8bb90f06f1e3fb0fe20c6b7a5a440d2d884002bb0cec3c5c591d3de5c7120d4c32e8f3104f45fae7c7c085b2f3f0245af082bbbb094891c83f36ece678e7e05140a8a43d5fbc031b7a3e53f896bf8aa979485e9892425bc88abdf17d8ff480a1320c35dff27ce3ca955fb73b2a7920d3f77645"], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1652.784428][T15777] fuse: Bad value for 'fd' 14:43:01 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000a40), 0x103400, 0x0) 14:43:01 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:01 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/loop', 0x10000, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000140)={0x7, 0x8, 0xfa00, {r1, 0x1}}, 0x10) (async) read$ptp(r0, 0x0, 0x0) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x0, @unused=[0x5, 0x3f, 0x8, 0x6388], @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r4, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, r4, {0x1, 0x4}}, './file0\x00'}) ioctl$BTRFS_IOC_START_SYNC(r4, 0x80089418, &(0x7f0000000280)) (async) fsconfig$FSCONFIG_SET_PATH_EMPTY(r5, 0x4, &(0x7f00000001c0)='[)\x00', &(0x7f0000000200)='./file0\x00', 0xffffffffffffff9c) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(r3, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x70, 0xfff}}, './file0\x00'}) [ 1652.806630][T15779] overlay: Unknown parameter '\' [ 1652.824313][T15786] fuse: Bad value for 'fd' 14:43:01 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x8400, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x8400, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) 14:43:02 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) 14:43:02 executing program 1: ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f0000000180)={{}, 0x0, 0x10, @unused=[0x100000001, 0x1, 0x6, 0x7], @name="b2b71266ba9c75ab89bc28af0ed98fce27e4cb17c782265cbe7b4628733b289a4478d15b546d6e6f80a068bcf66997d650e2568746baef65a3d9a6ff8e5834addda926499abaa2c6bc3d5e4f3d0fdf4711de405c8156c4d7ebeb00f28665cd031aa376edd41d7199484b185fa71c58a5238d430773997f67df8a7a54c9e20ab206d87ed864cfe7245bd85fcde7ff74bbf0e2f60cb3592e4b91eb4ce43ae419a107d71c5d38172bdba97084e04f7b667e93f890b220c9d9c258486fdcaadc6bab0b83c7b12c2f03979f67dd19b757832830d9e476c98f6489daa35099368ce0a4ebb1b9ac9ff275971dfb8506a7c5a283e0a5a26d57c5d734d1b87b2c3032ad2200ca38e36533e41e7a00797d9f0816ff3456ee48b38103f8fadd3a91c0fdb6d85e9e5c546d4c7b36aa95425f2e7582da577c20f70cc403d2b923a09e2d04c06512d4833efe54445b8888e754cd2ddb68f34ba49c53906e39baa77ee466f79fd103b7f66f3244b6c24b2ba7d1a22592ab5d7922543b2bca3bebab91fffa6c4532ecf6f6ddfae698e574e33063912fb97f1fd08e11206a94ec100e75c69e9c484e574f10406c425d397cfd9470783ae75dcabdb0af1a5021244f3398eda0ff7b48b84228d1805e839828883585e8ce7a602ed68761197045c6b1deb107433a6784146dc46bb7c605a2985cc432e42b5ca8bb4963ba13c28f17b9bb1bf54fa664037fa0fda36c2abb26267676dd42aad2f8dc25874cf601aca4131eb751319f4c601ef49ebede5dd3929edcf7fdaf00469aa9bbae04c61a021776cf434e65fcabc7a56f9d65220e92907dfebc34882bcc4959d2c38e5c9c700047b6b87cc7f3058d2005b25e39c83cf7f6e3568dbdf5c5c7b5cecebdf158a0753e91541b0dcac0d6242ed476c2a99b4adc5367876892439515437d3c98ea4c3bbf1ae3bfbbc6dc9729461a29cbc33150296f5db2d67de45a2d97ac9197311a48247cf01bd5453d010141ab84cc8be96a6f67933f09f9a49ed5fc499b6bffc66222a3ddfe67f3818138acaeec300195a19f10ac9807b8f558660a7977c4e512978de541ff17fecc647fd7a69bd23e9e39883d9c6a71b525f8fb10531d6d45ed146e955320baad55dd7ba4d7b37bfa994c0cf0376ea9b5c77d39026b674d43e6ad35ef752d8990a4314c62684ef73bb21f13fbd5eb14077f8c6d48dcf52bfa426448f92aed67364dcd1491b628c141baea00c0335785ddf23ae30e4e65df3cc137d53175168a74ce246611233c0a6d8f4a0a80f183918fa517534426e03bc57c546e7df2958c29f7556a99827b91dc46d5c3a66eb1ec962ed0e2cde26dba3afcecf8a853c3aa764fe7112307ded54df36574cc4e924168f19a7a2395e6b097c7d51500668dac4f2c9094cbda448203e53a4653066e2e2172a051c7bdcf57c4eda6af14d74b3450064ca8774be6ba221f8e952255b939fe5b97222f86c0ebf362ed6d212b3d6aecfedd3a24e2d37bf0de159ca41a3bef350d83b30305f024c0c04a2abdf87ba91039dbeafe6d232d53e57f0afa225a58e539607baf1c7b1087536cda2ef12592780bff2d6aec491fe62068dabfd66c97392e2af29cdeac2a6ee6cd08b81265f6d13e112e82cc2dc3b3cf5f13cc2e2516d10f77df1516e9560c8406194ece567f3d574b86f0aa49efcd55f9522ab17bc0597251282e27de1802dc8d8b7c2336a4f1234ed6942c1b35f731f3cf4e3511b8703d04b6e0e0f93776c232f6c9e85b5d013e16c94f9a578f4be2a3287c88cf20f0e442d41207722ece3ea4552912c1340ab99be66cf08992881517150cc7adc918aa34e45408e217d46a430b863d2bff77005cd8cdb4534cd55dd254006134360e8ad3da84c04dd3415300b979a3822f70b6463062ef36f2b962605ad755ff349e69a0e66475320940ea73644bfa39582549b837214befbaafc0dca9779962dbb770060f8088598e0cfb8ffd2ee09119ed16a9cfca4f5aa6c3bbf2be4027bb1abe4e78149ae91a70aa61054f89fab8b6bb035bda48630d25092b9701ef39e25efec9c49363e6d54331319ef27d1718b10e2687e3de57e91fd2ecdd4ebfd3a913972b075d25fa0b58f62e06244565c0868694a415d91cea67c7c1cdb2e84c79ea0219915bf030d51d0ca050201b1115f817454fdb568d994f75a4024bc3dafe5863db9c69c9d9abc38f740dbf69d071231800bc57ec33de300b3adf1059187e93f1127b806eb365eb13aa73d3bb8e0e83639f1f9eb5c84250b97c9953c0e8d1a4a111080dee3146fbe05f117432228a503beb1117314a305428ce8095b9053338b3bc6ce8bee236e21c9c2efed4b4034ed995aa2bf153034a6c229734186acfc62771caadd5ba741b670de5afb7bcd0cc5499397681be176d56296bff71e3529def1c7e0af7c37494787505c6f215cc5b69fdf72f7fac05bc639a0c5ec9e9af52df391923c18a815806a0f5956025ca7b51a85a892a52bdbf275642d3536a7c9196fe74b92bc273f7eccdda1b803eccb6414da08205391fa27205f37ad296d26f6b696e7d0235a69b2b02307e6ffa7ff07bb2b13195e50fa2f582445cf57a89e2611cb69c38e66a55f33d31a8f8b57680d107dbca1ac643b1cdb7d3f05c8aaefe68a57331a627f7118f5dd1c365821ddc5d3cf874fe77c4cf10f7751e3cdfeba3fa6fd06520146205bf6cda06d3e405ab381094399d122f0c40eff02e5f09eb12d8ac6f2eeb3f27459e6ddc11d79b993f7d6da12d9c0bad2d7dc768bd05b6f06e35f5809decb4c75758c98db7faaa3b77e7a853a055e67d2355551f7d5f54f083cb700d77b7d93b12b7f3973a3e5a039d698908e3731b314513f85e36bc1c3f89c9c9bcf57245c367202ca6cbcd0b203894f1d8bc1d38e77c2284ceca55639dca8006e10368db7c50d411f87092eb47e196f24c4cd5eb5578880851ef52180d161b8210d62ba13e06d1fca789c1b501107605318fb8234d3216c0ef19f5719f78996363ccfaf0e34f511dd7ef027282c644b881cabf3f776cb592a9959e64da81b7f9a6c14da93b53431db7deeeae0303a3b6c6bd99ff456e3f9e7c341e5278f6bdb39003ec02fd42b7b4c2abbd6e8d4eb1f74b25f72d8fe0c238c19cfaa83f3a50857b905fe2068d8d8e3c9adf8f062b5a470db2e81c09ef26d85f47bc2de3ef34539112828cc89abf8354f43163a2c918769bffcbba23a8344f27b0a40d212a0e3436dd9ee7379953f9a815f28ce89422023f3eb389b219908c2c17af20a9105413fccf8092cd60f2284ac1df21be06c8773560b06d98e0eae070c259423d271aaf160ed757445b187d9eb2151d935fbf760c3a29e960650c2a29e9f33d47970eeabf5d522b1a39fff1dc7057c128e1c639e56905199356554498aa85d4e1ee30b23583ff65daa26fe510188f1d545634692a3ba75d4c30d58879ad597790641f5952fea3035438ac704774e994d249fe997eabc930b4caf98ba41f366b6cf6f42528f24cee3f1f3e93fb261e18859c7749fa790823b1168502ad787aca32019a2bad2ec64b22c95b00de322cc2d91bffc98d2f24b1990989b0b1b4fe1c757b7688a5863ef200c1161061ff4b3d4d9e98b061d2e94b15b460bbb6adcce2fb1e8aa2a02cf37be10be31e4326c2eb9891b9a8b352b5fdb622b612a5aa15d0a58a76d6eeec3aec7f50d4821aae1d5ddfa6b023938a2a099c575377b35ace54a65d297b6c7f7fed50819202df9d061476dc89e7a7dd9639a83cbdcebb32d4f48ca8e8a83d4e44826967684eb52b95cdb677e17cfe0b6f54dd63abc0d563309d3470d9444056dce5631d2d7d113b635a88076a51e90b22f0366af99c893ce6890d6cad6265789bad7f05e8d17aa691b932b0ae76efe732c45af5b1e7289a8bf9993c961d0a48234376f5343de19b277dced6b861e8462d0cb96167d834fd84a4b996cf8fcc7a3222f451bd4c5c6e228b6b2672c2ad9cb4cdd2c2fad7ad5ca88b789e241340c0b5efd9a3439d56953cd30d566597558848fc6b07e342650054a5dacde54aba36df7e9875a50a07d60eb899bd0012d5baa75d94b49ffb33bfbc3e87eedae600327261a2ef50fb8da6e7b7e9c96069ba20093206e10dbf1a8ebeaf24caef85b6276f639a9b6408909b5393fb55201d09eebbdd625447d8100f6dd3f4d127f78ad662b3aff6e04a73ea80c4fcf3e7e57f693f3c4bbf31fd770579aaf296f12aae3c373c2a365bd50de1fe0f6ad4a593cb6a912f03d54a807b007b72a76262e4f9ee4c0d67cadbc200b8b8df4fcea6c158b2a56f744c7eaeea3a13b7e2ee300b608b4a824465d2af4d1e9257eeb82f4d3b96aae6eceedc616c92da8f82604c9bb4fa8af4ed1055f5fecb742d27f0e71e8c48e367065fa6f016d1606fd5a88112c51bd36ac5c708c27492c22dc1d9967279dfe87888222657be05f383331046a59913aca71faac501fb7efd09dd209e3cb9e97e881503ab07a95988e2d6736c0095ad9bea3ee90051e6dc795641de72a3d86c25268551ae0ab2a66bf81d722b0f0a43da3b2d37d762862d6c4c79a5f4ba82b4dffe0a036e94a4423f2621256f5364ff568fbedec2109a7e1aef867b7e99074476df78e8041708e1d68ab7527ce3e110ecfb966b23ffac11cd31e988de61ef69432a70128bb1253155ec4f2812e6173598088da1c98fe94e959bbe4c401a16827c80ec3e015cec33a7a0c39c1a94c6d74329ecd5c05608fd4c0c3f30d63b83e6bee5e99ef77e9089c50e6abe0ef266b08c5a5d3a9c878c3d4e2f458d096958f3288dcc2d9f3cc0f9367bc4916963ecab01ddc9456f82c6e1915eaaa6d2f3414de17e6a1981725da30976a70133dffc6fd9572b58a0019de62d96383b0bc188ddaa07f1222c66513b82532326282dd9b7ebbd9b2a5bb5e0c05e05b61d8401c9b1a16ef0cd320a22426cf43b548cf5ecf41681ee5bfffb3a8bfa29ef828f29746d325d71cb9edd9f582e3fba760134c077a8107bddf095b25b74d2dfd87085d19ded4f50de44330e19e4c20210806937511cf321505cfe9ca5f551e0360d92505672e3c7bf9e419562f88832b077ee564dbea6b648140e3eea421174692fe5ff580646ff36563b568470f36fa214d02ad0f325afc560f836486814dc107f66a40b2000a6dbe987c29ff4301d769869f4a2756df29eddec5a52502533f3dfa5f99692eecba6a7db15a07013bff64186eecc41ce8fc00f7f3ed2d031668e20c028e0d6dfb7d248b6d2fd55023eb94ed1dd5c4870cef9e4a0f81469432dba99a20cc13073dfc2811abbd3449215fcc31e147559c119b5cf2e881f4c4a14d99046df6b7c2b849963a855c36ed09d5b8224d70f577047711c84b918af6f1d2c19daa1e59d2d6129e7a33b1e5492440be77ac9abd81b862740ca617b665e68f7cb021e165027f68fe50140dbcc17774f8a7291a6e630c28acf39bfaf527f03b0497e33cc2d378ebb5f1cf01475fa64f14c10f5ec539cb22236024d24b5597c4e0404396efa63383a7686298b34b83ceff6979c3c13ada26f6bd2d5583bb37d5d90aeec702362abf4fbc92002f213c14e88a57c3cc07ec38cfcb0d861adb0449532c46cadb12b6d873fa00903e13af074808670b43b331a535ad5f3212d9b8f4823a7c505e9159d6e36a4992f902dd4971d854e0e9ff9b94e4548fb4d32ee38e7f0056bf5f4c4db9a272dd1"}) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) r5 = fsmount(0xffffffffffffffff, 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r4) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000340)={{}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_READY(r5, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000080)='\x01log\x00', &(0x7f0000000100)='./file0\x00', r3) [ 1652.934396][T15792] fuse: Bad value for 'fd' 14:43:02 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000001c0)='./file0\x00', 0x0) 14:43:02 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x113300, 0x0) read$ptp(r0, 0x0, 0x0) 14:43:02 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1652.963642][T15798] fuse: Bad value for 'fd' [ 1652.980668][T15800] overlay: Unknown parameter '\' 14:43:02 executing program 1: ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f0000000180)={{}, 0x0, 0x10, @unused=[0x100000001, 0x1, 0x6, 0x7], @name="b2b71266ba9c75ab89bc28af0ed98fce27e4cb17c782265cbe7b4628733b289a4478d15b546d6e6f80a068bcf66997d650e2568746baef65a3d9a6ff8e5834addda926499abaa2c6bc3d5e4f3d0fdf4711de405c8156c4d7ebeb00f28665cd031aa376edd41d7199484b185fa71c58a5238d430773997f67df8a7a54c9e20ab206d87ed864cfe7245bd85fcde7ff74bbf0e2f60cb3592e4b91eb4ce43ae419a107d71c5d38172bdba97084e04f7b667e93f890b220c9d9c258486fdcaadc6bab0b83c7b12c2f03979f67dd19b757832830d9e476c98f6489daa35099368ce0a4ebb1b9ac9ff275971dfb8506a7c5a283e0a5a26d57c5d734d1b87b2c3032ad2200ca38e36533e41e7a00797d9f0816ff3456ee48b38103f8fadd3a91c0fdb6d85e9e5c546d4c7b36aa95425f2e7582da577c20f70cc403d2b923a09e2d04c06512d4833efe54445b8888e754cd2ddb68f34ba49c53906e39baa77ee466f79fd103b7f66f3244b6c24b2ba7d1a22592ab5d7922543b2bca3bebab91fffa6c4532ecf6f6ddfae698e574e33063912fb97f1fd08e11206a94ec100e75c69e9c484e574f10406c425d397cfd9470783ae75dcabdb0af1a5021244f3398eda0ff7b48b84228d1805e839828883585e8ce7a602ed68761197045c6b1deb107433a6784146dc46bb7c605a2985cc432e42b5ca8bb4963ba13c28f17b9bb1bf54fa664037fa0fda36c2abb26267676dd42aad2f8dc25874cf601aca4131eb751319f4c601ef49ebede5dd3929edcf7fdaf00469aa9bbae04c61a021776cf434e65fcabc7a56f9d65220e92907dfebc34882bcc4959d2c38e5c9c700047b6b87cc7f3058d2005b25e39c83cf7f6e3568dbdf5c5c7b5cecebdf158a0753e91541b0dcac0d6242ed476c2a99b4adc5367876892439515437d3c98ea4c3bbf1ae3bfbbc6dc9729461a29cbc33150296f5db2d67de45a2d97ac9197311a48247cf01bd5453d010141ab84cc8be96a6f67933f09f9a49ed5fc499b6bffc66222a3ddfe67f3818138acaeec300195a19f10ac9807b8f558660a7977c4e512978de541ff17fecc647fd7a69bd23e9e39883d9c6a71b525f8fb10531d6d45ed146e955320baad55dd7ba4d7b37bfa994c0cf0376ea9b5c77d39026b674d43e6ad35ef752d8990a4314c62684ef73bb21f13fbd5eb14077f8c6d48dcf52bfa426448f92aed67364dcd1491b628c141baea00c0335785ddf23ae30e4e65df3cc137d53175168a74ce246611233c0a6d8f4a0a80f183918fa517534426e03bc57c546e7df2958c29f7556a99827b91dc46d5c3a66eb1ec962ed0e2cde26dba3afcecf8a853c3aa764fe7112307ded54df36574cc4e924168f19a7a2395e6b097c7d51500668dac4f2c9094cbda448203e53a4653066e2e2172a051c7bdcf57c4eda6af14d74b3450064ca8774be6ba221f8e952255b939fe5b97222f86c0ebf362ed6d212b3d6aecfedd3a24e2d37bf0de159ca41a3bef350d83b30305f024c0c04a2abdf87ba91039dbeafe6d232d53e57f0afa225a58e539607baf1c7b1087536cda2ef12592780bff2d6aec491fe62068dabfd66c97392e2af29cdeac2a6ee6cd08b81265f6d13e112e82cc2dc3b3cf5f13cc2e2516d10f77df1516e9560c8406194ece567f3d574b86f0aa49efcd55f9522ab17bc0597251282e27de1802dc8d8b7c2336a4f1234ed6942c1b35f731f3cf4e3511b8703d04b6e0e0f93776c232f6c9e85b5d013e16c94f9a578f4be2a3287c88cf20f0e442d41207722ece3ea4552912c1340ab99be66cf08992881517150cc7adc918aa34e45408e217d46a430b863d2bff77005cd8cdb4534cd55dd254006134360e8ad3da84c04dd3415300b979a3822f70b6463062ef36f2b962605ad755ff349e69a0e66475320940ea73644bfa39582549b837214befbaafc0dca9779962dbb770060f8088598e0cfb8ffd2ee09119ed16a9cfca4f5aa6c3bbf2be4027bb1abe4e78149ae91a70aa61054f89fab8b6bb035bda48630d25092b9701ef39e25efec9c49363e6d54331319ef27d1718b10e2687e3de57e91fd2ecdd4ebfd3a913972b075d25fa0b58f62e06244565c0868694a415d91cea67c7c1cdb2e84c79ea0219915bf030d51d0ca050201b1115f817454fdb568d994f75a4024bc3dafe5863db9c69c9d9abc38f740dbf69d071231800bc57ec33de300b3adf1059187e93f1127b806eb365eb13aa73d3bb8e0e83639f1f9eb5c84250b97c9953c0e8d1a4a111080dee3146fbe05f117432228a503beb1117314a305428ce8095b9053338b3bc6ce8bee236e21c9c2efed4b4034ed995aa2bf153034a6c229734186acfc62771caadd5ba741b670de5afb7bcd0cc5499397681be176d56296bff71e3529def1c7e0af7c37494787505c6f215cc5b69fdf72f7fac05bc639a0c5ec9e9af52df391923c18a815806a0f5956025ca7b51a85a892a52bdbf275642d3536a7c9196fe74b92bc273f7eccdda1b803eccb6414da08205391fa27205f37ad296d26f6b696e7d0235a69b2b02307e6ffa7ff07bb2b13195e50fa2f582445cf57a89e2611cb69c38e66a55f33d31a8f8b57680d107dbca1ac643b1cdb7d3f05c8aaefe68a57331a627f7118f5dd1c365821ddc5d3cf874fe77c4cf10f7751e3cdfeba3fa6fd06520146205bf6cda06d3e405ab381094399d122f0c40eff02e5f09eb12d8ac6f2eeb3f27459e6ddc11d79b993f7d6da12d9c0bad2d7dc768bd05b6f06e35f5809decb4c75758c98db7faaa3b77e7a853a055e67d2355551f7d5f54f083cb700d77b7d93b12b7f3973a3e5a039d698908e3731b314513f85e36bc1c3f89c9c9bcf57245c367202ca6cbcd0b203894f1d8bc1d38e77c2284ceca55639dca8006e10368db7c50d411f87092eb47e196f24c4cd5eb5578880851ef52180d161b8210d62ba13e06d1fca789c1b501107605318fb8234d3216c0ef19f5719f78996363ccfaf0e34f511dd7ef027282c644b881cabf3f776cb592a9959e64da81b7f9a6c14da93b53431db7deeeae0303a3b6c6bd99ff456e3f9e7c341e5278f6bdb39003ec02fd42b7b4c2abbd6e8d4eb1f74b25f72d8fe0c238c19cfaa83f3a50857b905fe2068d8d8e3c9adf8f062b5a470db2e81c09ef26d85f47bc2de3ef34539112828cc89abf8354f43163a2c918769bffcbba23a8344f27b0a40d212a0e3436dd9ee7379953f9a815f28ce89422023f3eb389b219908c2c17af20a9105413fccf8092cd60f2284ac1df21be06c8773560b06d98e0eae070c259423d271aaf160ed757445b187d9eb2151d935fbf760c3a29e960650c2a29e9f33d47970eeabf5d522b1a39fff1dc7057c128e1c639e56905199356554498aa85d4e1ee30b23583ff65daa26fe510188f1d545634692a3ba75d4c30d58879ad597790641f5952fea3035438ac704774e994d249fe997eabc930b4caf98ba41f366b6cf6f42528f24cee3f1f3e93fb261e18859c7749fa790823b1168502ad787aca32019a2bad2ec64b22c95b00de322cc2d91bffc98d2f24b1990989b0b1b4fe1c757b7688a5863ef200c1161061ff4b3d4d9e98b061d2e94b15b460bbb6adcce2fb1e8aa2a02cf37be10be31e4326c2eb9891b9a8b352b5fdb622b612a5aa15d0a58a76d6eeec3aec7f50d4821aae1d5ddfa6b023938a2a099c575377b35ace54a65d297b6c7f7fed50819202df9d061476dc89e7a7dd9639a83cbdcebb32d4f48ca8e8a83d4e44826967684eb52b95cdb677e17cfe0b6f54dd63abc0d563309d3470d9444056dce5631d2d7d113b635a88076a51e90b22f0366af99c893ce6890d6cad6265789bad7f05e8d17aa691b932b0ae76efe732c45af5b1e7289a8bf9993c961d0a48234376f5343de19b277dced6b861e8462d0cb96167d834fd84a4b996cf8fcc7a3222f451bd4c5c6e228b6b2672c2ad9cb4cdd2c2fad7ad5ca88b789e241340c0b5efd9a3439d56953cd30d566597558848fc6b07e342650054a5dacde54aba36df7e9875a50a07d60eb899bd0012d5baa75d94b49ffb33bfbc3e87eedae600327261a2ef50fb8da6e7b7e9c96069ba20093206e10dbf1a8ebeaf24caef85b6276f639a9b6408909b5393fb55201d09eebbdd625447d8100f6dd3f4d127f78ad662b3aff6e04a73ea80c4fcf3e7e57f693f3c4bbf31fd770579aaf296f12aae3c373c2a365bd50de1fe0f6ad4a593cb6a912f03d54a807b007b72a76262e4f9ee4c0d67cadbc200b8b8df4fcea6c158b2a56f744c7eaeea3a13b7e2ee300b608b4a824465d2af4d1e9257eeb82f4d3b96aae6eceedc616c92da8f82604c9bb4fa8af4ed1055f5fecb742d27f0e71e8c48e367065fa6f016d1606fd5a88112c51bd36ac5c708c27492c22dc1d9967279dfe87888222657be05f383331046a59913aca71faac501fb7efd09dd209e3cb9e97e881503ab07a95988e2d6736c0095ad9bea3ee90051e6dc795641de72a3d86c25268551ae0ab2a66bf81d722b0f0a43da3b2d37d762862d6c4c79a5f4ba82b4dffe0a036e94a4423f2621256f5364ff568fbedec2109a7e1aef867b7e99074476df78e8041708e1d68ab7527ce3e110ecfb966b23ffac11cd31e988de61ef69432a70128bb1253155ec4f2812e6173598088da1c98fe94e959bbe4c401a16827c80ec3e015cec33a7a0c39c1a94c6d74329ecd5c05608fd4c0c3f30d63b83e6bee5e99ef77e9089c50e6abe0ef266b08c5a5d3a9c878c3d4e2f458d096958f3288dcc2d9f3cc0f9367bc4916963ecab01ddc9456f82c6e1915eaaa6d2f3414de17e6a1981725da30976a70133dffc6fd9572b58a0019de62d96383b0bc188ddaa07f1222c66513b82532326282dd9b7ebbd9b2a5bb5e0c05e05b61d8401c9b1a16ef0cd320a22426cf43b548cf5ecf41681ee5bfffb3a8bfa29ef828f29746d325d71cb9edd9f582e3fba760134c077a8107bddf095b25b74d2dfd87085d19ded4f50de44330e19e4c20210806937511cf321505cfe9ca5f551e0360d92505672e3c7bf9e419562f88832b077ee564dbea6b648140e3eea421174692fe5ff580646ff36563b568470f36fa214d02ad0f325afc560f836486814dc107f66a40b2000a6dbe987c29ff4301d769869f4a2756df29eddec5a52502533f3dfa5f99692eecba6a7db15a07013bff64186eecc41ce8fc00f7f3ed2d031668e20c028e0d6dfb7d248b6d2fd55023eb94ed1dd5c4870cef9e4a0f81469432dba99a20cc13073dfc2811abbd3449215fcc31e147559c119b5cf2e881f4c4a14d99046df6b7c2b849963a855c36ed09d5b8224d70f577047711c84b918af6f1d2c19daa1e59d2d6129e7a33b1e5492440be77ac9abd81b862740ca617b665e68f7cb021e165027f68fe50140dbcc17774f8a7291a6e630c28acf39bfaf527f03b0497e33cc2d378ebb5f1cf01475fa64f14c10f5ec539cb22236024d24b5597c4e0404396efa63383a7686298b34b83ceff6979c3c13ada26f6bd2d5583bb37d5d90aeec702362abf4fbc92002f213c14e88a57c3cc07ec38cfcb0d861adb0449532c46cadb12b6d873fa00903e13af074808670b43b331a535ad5f3212d9b8f4823a7c505e9159d6e36a4992f902dd4971d854e0e9ff9b94e4548fb4d32ee38e7f0056bf5f4c4db9a272dd1"}) (async) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) r5 = fsmount(0xffffffffffffffff, 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r4) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000340)={{}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_READY(r5, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000080)='\x01log\x00', &(0x7f0000000100)='./file0\x00', r3) 14:43:02 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) [ 1653.017613][T15802] overlay: Unknown parameter '\' 14:43:02 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000080)=0x0) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000000200)={0x0, "f70ab4ca1b762883721542ea68f7dbae"}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000001200)={{r0}, r1, 0x2, @inherit={0x50, &(0x7f0000000180)={0x0, 0x1, 0x2, 0x5, {0x10, 0xcbe, 0x3, 0x80000001, 0x2}, [0x8]}}, @devid=r2}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1653.095930][T15810] fuse: Bad value for 'fd' 14:43:02 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) 14:43:02 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x113300, 0x0) read$ptp(r0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x113300, 0x0) (async) read$ptp(r0, 0x0, 0x0) (async) 14:43:02 executing program 1: ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f0000000180)={{}, 0x0, 0x10, @unused=[0x100000001, 0x1, 0x6, 0x7], @name="b2b71266ba9c75ab89bc28af0ed98fce27e4cb17c782265cbe7b4628733b289a4478d15b546d6e6f80a068bcf66997d650e2568746baef65a3d9a6ff8e5834addda926499abaa2c6bc3d5e4f3d0fdf4711de405c8156c4d7ebeb00f28665cd031aa376edd41d7199484b185fa71c58a5238d430773997f67df8a7a54c9e20ab206d87ed864cfe7245bd85fcde7ff74bbf0e2f60cb3592e4b91eb4ce43ae419a107d71c5d38172bdba97084e04f7b667e93f890b220c9d9c258486fdcaadc6bab0b83c7b12c2f03979f67dd19b757832830d9e476c98f6489daa35099368ce0a4ebb1b9ac9ff275971dfb8506a7c5a283e0a5a26d57c5d734d1b87b2c3032ad2200ca38e36533e41e7a00797d9f0816ff3456ee48b38103f8fadd3a91c0fdb6d85e9e5c546d4c7b36aa95425f2e7582da577c20f70cc403d2b923a09e2d04c06512d4833efe54445b8888e754cd2ddb68f34ba49c53906e39baa77ee466f79fd103b7f66f3244b6c24b2ba7d1a22592ab5d7922543b2bca3bebab91fffa6c4532ecf6f6ddfae698e574e33063912fb97f1fd08e11206a94ec100e75c69e9c484e574f10406c425d397cfd9470783ae75dcabdb0af1a5021244f3398eda0ff7b48b84228d1805e839828883585e8ce7a602ed68761197045c6b1deb107433a6784146dc46bb7c605a2985cc432e42b5ca8bb4963ba13c28f17b9bb1bf54fa664037fa0fda36c2abb26267676dd42aad2f8dc25874cf601aca4131eb751319f4c601ef49ebede5dd3929edcf7fdaf00469aa9bbae04c61a021776cf434e65fcabc7a56f9d65220e92907dfebc34882bcc4959d2c38e5c9c700047b6b87cc7f3058d2005b25e39c83cf7f6e3568dbdf5c5c7b5cecebdf158a0753e91541b0dcac0d6242ed476c2a99b4adc5367876892439515437d3c98ea4c3bbf1ae3bfbbc6dc9729461a29cbc33150296f5db2d67de45a2d97ac9197311a48247cf01bd5453d010141ab84cc8be96a6f67933f09f9a49ed5fc499b6bffc66222a3ddfe67f3818138acaeec300195a19f10ac9807b8f558660a7977c4e512978de541ff17fecc647fd7a69bd23e9e39883d9c6a71b525f8fb10531d6d45ed146e955320baad55dd7ba4d7b37bfa994c0cf0376ea9b5c77d39026b674d43e6ad35ef752d8990a4314c62684ef73bb21f13fbd5eb14077f8c6d48dcf52bfa426448f92aed67364dcd1491b628c141baea00c0335785ddf23ae30e4e65df3cc137d53175168a74ce246611233c0a6d8f4a0a80f183918fa517534426e03bc57c546e7df2958c29f7556a99827b91dc46d5c3a66eb1ec962ed0e2cde26dba3afcecf8a853c3aa764fe7112307ded54df36574cc4e924168f19a7a2395e6b097c7d51500668dac4f2c9094cbda448203e53a4653066e2e2172a051c7bdcf57c4eda6af14d74b3450064ca8774be6ba221f8e952255b939fe5b97222f86c0ebf362ed6d212b3d6aecfedd3a24e2d37bf0de159ca41a3bef350d83b30305f024c0c04a2abdf87ba91039dbeafe6d232d53e57f0afa225a58e539607baf1c7b1087536cda2ef12592780bff2d6aec491fe62068dabfd66c97392e2af29cdeac2a6ee6cd08b81265f6d13e112e82cc2dc3b3cf5f13cc2e2516d10f77df1516e9560c8406194ece567f3d574b86f0aa49efcd55f9522ab17bc0597251282e27de1802dc8d8b7c2336a4f1234ed6942c1b35f731f3cf4e3511b8703d04b6e0e0f93776c232f6c9e85b5d013e16c94f9a578f4be2a3287c88cf20f0e442d41207722ece3ea4552912c1340ab99be66cf08992881517150cc7adc918aa34e45408e217d46a430b863d2bff77005cd8cdb4534cd55dd254006134360e8ad3da84c04dd3415300b979a3822f70b6463062ef36f2b962605ad755ff349e69a0e66475320940ea73644bfa39582549b837214befbaafc0dca9779962dbb770060f8088598e0cfb8ffd2ee09119ed16a9cfca4f5aa6c3bbf2be4027bb1abe4e78149ae91a70aa61054f89fab8b6bb035bda48630d25092b9701ef39e25efec9c49363e6d54331319ef27d1718b10e2687e3de57e91fd2ecdd4ebfd3a913972b075d25fa0b58f62e06244565c0868694a415d91cea67c7c1cdb2e84c79ea0219915bf030d51d0ca050201b1115f817454fdb568d994f75a4024bc3dafe5863db9c69c9d9abc38f740dbf69d071231800bc57ec33de300b3adf1059187e93f1127b806eb365eb13aa73d3bb8e0e83639f1f9eb5c84250b97c9953c0e8d1a4a111080dee3146fbe05f117432228a503beb1117314a305428ce8095b9053338b3bc6ce8bee236e21c9c2efed4b4034ed995aa2bf153034a6c229734186acfc62771caadd5ba741b670de5afb7bcd0cc5499397681be176d56296bff71e3529def1c7e0af7c37494787505c6f215cc5b69fdf72f7fac05bc639a0c5ec9e9af52df391923c18a815806a0f5956025ca7b51a85a892a52bdbf275642d3536a7c9196fe74b92bc273f7eccdda1b803eccb6414da08205391fa27205f37ad296d26f6b696e7d0235a69b2b02307e6ffa7ff07bb2b13195e50fa2f582445cf57a89e2611cb69c38e66a55f33d31a8f8b57680d107dbca1ac643b1cdb7d3f05c8aaefe68a57331a627f7118f5dd1c365821ddc5d3cf874fe77c4cf10f7751e3cdfeba3fa6fd06520146205bf6cda06d3e405ab381094399d122f0c40eff02e5f09eb12d8ac6f2eeb3f27459e6ddc11d79b993f7d6da12d9c0bad2d7dc768bd05b6f06e35f5809decb4c75758c98db7faaa3b77e7a853a055e67d2355551f7d5f54f083cb700d77b7d93b12b7f3973a3e5a039d698908e3731b314513f85e36bc1c3f89c9c9bcf57245c367202ca6cbcd0b203894f1d8bc1d38e77c2284ceca55639dca8006e10368db7c50d411f87092eb47e196f24c4cd5eb5578880851ef52180d161b8210d62ba13e06d1fca789c1b501107605318fb8234d3216c0ef19f5719f78996363ccfaf0e34f511dd7ef027282c644b881cabf3f776cb592a9959e64da81b7f9a6c14da93b53431db7deeeae0303a3b6c6bd99ff456e3f9e7c341e5278f6bdb39003ec02fd42b7b4c2abbd6e8d4eb1f74b25f72d8fe0c238c19cfaa83f3a50857b905fe2068d8d8e3c9adf8f062b5a470db2e81c09ef26d85f47bc2de3ef34539112828cc89abf8354f43163a2c918769bffcbba23a8344f27b0a40d212a0e3436dd9ee7379953f9a815f28ce89422023f3eb389b219908c2c17af20a9105413fccf8092cd60f2284ac1df21be06c8773560b06d98e0eae070c259423d271aaf160ed757445b187d9eb2151d935fbf760c3a29e960650c2a29e9f33d47970eeabf5d522b1a39fff1dc7057c128e1c639e56905199356554498aa85d4e1ee30b23583ff65daa26fe510188f1d545634692a3ba75d4c30d58879ad597790641f5952fea3035438ac704774e994d249fe997eabc930b4caf98ba41f366b6cf6f42528f24cee3f1f3e93fb261e18859c7749fa790823b1168502ad787aca32019a2bad2ec64b22c95b00de322cc2d91bffc98d2f24b1990989b0b1b4fe1c757b7688a5863ef200c1161061ff4b3d4d9e98b061d2e94b15b460bbb6adcce2fb1e8aa2a02cf37be10be31e4326c2eb9891b9a8b352b5fdb622b612a5aa15d0a58a76d6eeec3aec7f50d4821aae1d5ddfa6b023938a2a099c575377b35ace54a65d297b6c7f7fed50819202df9d061476dc89e7a7dd9639a83cbdcebb32d4f48ca8e8a83d4e44826967684eb52b95cdb677e17cfe0b6f54dd63abc0d563309d3470d9444056dce5631d2d7d113b635a88076a51e90b22f0366af99c893ce6890d6cad6265789bad7f05e8d17aa691b932b0ae76efe732c45af5b1e7289a8bf9993c961d0a48234376f5343de19b277dced6b861e8462d0cb96167d834fd84a4b996cf8fcc7a3222f451bd4c5c6e228b6b2672c2ad9cb4cdd2c2fad7ad5ca88b789e241340c0b5efd9a3439d56953cd30d566597558848fc6b07e342650054a5dacde54aba36df7e9875a50a07d60eb899bd0012d5baa75d94b49ffb33bfbc3e87eedae600327261a2ef50fb8da6e7b7e9c96069ba20093206e10dbf1a8ebeaf24caef85b6276f639a9b6408909b5393fb55201d09eebbdd625447d8100f6dd3f4d127f78ad662b3aff6e04a73ea80c4fcf3e7e57f693f3c4bbf31fd770579aaf296f12aae3c373c2a365bd50de1fe0f6ad4a593cb6a912f03d54a807b007b72a76262e4f9ee4c0d67cadbc200b8b8df4fcea6c158b2a56f744c7eaeea3a13b7e2ee300b608b4a824465d2af4d1e9257eeb82f4d3b96aae6eceedc616c92da8f82604c9bb4fa8af4ed1055f5fecb742d27f0e71e8c48e367065fa6f016d1606fd5a88112c51bd36ac5c708c27492c22dc1d9967279dfe87888222657be05f383331046a59913aca71faac501fb7efd09dd209e3cb9e97e881503ab07a95988e2d6736c0095ad9bea3ee90051e6dc795641de72a3d86c25268551ae0ab2a66bf81d722b0f0a43da3b2d37d762862d6c4c79a5f4ba82b4dffe0a036e94a4423f2621256f5364ff568fbedec2109a7e1aef867b7e99074476df78e8041708e1d68ab7527ce3e110ecfb966b23ffac11cd31e988de61ef69432a70128bb1253155ec4f2812e6173598088da1c98fe94e959bbe4c401a16827c80ec3e015cec33a7a0c39c1a94c6d74329ecd5c05608fd4c0c3f30d63b83e6bee5e99ef77e9089c50e6abe0ef266b08c5a5d3a9c878c3d4e2f458d096958f3288dcc2d9f3cc0f9367bc4916963ecab01ddc9456f82c6e1915eaaa6d2f3414de17e6a1981725da30976a70133dffc6fd9572b58a0019de62d96383b0bc188ddaa07f1222c66513b82532326282dd9b7ebbd9b2a5bb5e0c05e05b61d8401c9b1a16ef0cd320a22426cf43b548cf5ecf41681ee5bfffb3a8bfa29ef828f29746d325d71cb9edd9f582e3fba760134c077a8107bddf095b25b74d2dfd87085d19ded4f50de44330e19e4c20210806937511cf321505cfe9ca5f551e0360d92505672e3c7bf9e419562f88832b077ee564dbea6b648140e3eea421174692fe5ff580646ff36563b568470f36fa214d02ad0f325afc560f836486814dc107f66a40b2000a6dbe987c29ff4301d769869f4a2756df29eddec5a52502533f3dfa5f99692eecba6a7db15a07013bff64186eecc41ce8fc00f7f3ed2d031668e20c028e0d6dfb7d248b6d2fd55023eb94ed1dd5c4870cef9e4a0f81469432dba99a20cc13073dfc2811abbd3449215fcc31e147559c119b5cf2e881f4c4a14d99046df6b7c2b849963a855c36ed09d5b8224d70f577047711c84b918af6f1d2c19daa1e59d2d6129e7a33b1e5492440be77ac9abd81b862740ca617b665e68f7cb021e165027f68fe50140dbcc17774f8a7291a6e630c28acf39bfaf527f03b0497e33cc2d378ebb5f1cf01475fa64f14c10f5ec539cb22236024d24b5597c4e0404396efa63383a7686298b34b83ceff6979c3c13ada26f6bd2d5583bb37d5d90aeec702362abf4fbc92002f213c14e88a57c3cc07ec38cfcb0d861adb0449532c46cadb12b6d873fa00903e13af074808670b43b331a535ad5f3212d9b8f4823a7c505e9159d6e36a4992f902dd4971d854e0e9ff9b94e4548fb4d32ee38e7f0056bf5f4c4db9a272dd1"}) r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) r5 = fsmount(0xffffffffffffffff, 0x1, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r4) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000340)={{}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_READY(r5, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000080)='\x01log\x00', &(0x7f0000000100)='./file0\x00', r3) 14:43:02 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1653.117653][T15814] fuse: Bad value for 'fd' [ 1653.137063][T15814] fuse: Bad value for 'fd' 14:43:02 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) 14:43:02 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x113300, 0x0) read$ptp(r0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x113300, 0x0) (async) read$ptp(r0, 0x0, 0x0) (async) 14:43:02 executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) openat$incfs(r2, &(0x7f0000000040)='.log\x00', 0x58ba00, 0xe5) [ 1653.215624][T15824] overlay: Unknown parameter '\' 14:43:02 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) fstat(0xffffffffffffffff, &(0x7f0000003880)) 14:43:02 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000080)=0x0) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000000200)={0x0, "f70ab4ca1b762883721542ea68f7dbae"}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000001200)={{r0}, r1, 0x2, @inherit={0x50, &(0x7f0000000180)={0x0, 0x1, 0x2, 0x5, {0x10, 0xcbe, 0x3, 0x80000001, 0x2}, [0x8]}}, @devid=r2}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000080)) (async) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000000200)={0x0, "f70ab4ca1b762883721542ea68f7dbae"}) (async) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000001200)={{r0}, r1, 0x2, @inherit={0x50, &(0x7f0000000180)={0x0, 0x1, 0x2, 0x5, {0x10, 0xcbe, 0x3, 0x80000001, 0x2}, [0x8]}}, @devid=r2}) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) [ 1653.251163][T15827] fuse: Bad value for 'fd' [ 1653.277505][T15829] fuse: Bad value for 'fd' 14:43:02 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x2200800, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x3ff}}, {@allow_other}, {@default_permissions}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x6747}}, {@max_read={'max_read', 0x3d, 0xffffffffffffff06}}], [{@permit_directio}, {@smackfsfloor={'smackfsfloor', 0x3d, 'user_id'}}, {@euid_gt={'euid>', r4}}, {@permit_directio}, {@seclabel}, {@seclabel}]}}, 0x0, 0x0, &(0x7f0000000200)="47f1b955eab5bd77c2974f8ae52a468d2190b2469cec83866614d4afbfd399e2d5c020ee67967642ff33200767647a027b675e02659aac7bb4d9519e7f75aac1f42162400e0c88d3d0514bb6ddd3d2448e0299bdf59b93c40b3a119052119869a758c65b70") 14:43:02 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r3, 0x82307202, &(0x7f0000001340)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:02 executing program 4: r0 = openat$damon_attrs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f0000000080)={{r0}, 0x0, 0x0, @unused=[0x0, 0x7f, 0x20], @subvolid}) write$damon_attrs(r0, &(0x7f0000000000)={{' ', 0x872}, {' ', 0x80}, {' ', 0x32e8000000000000}, {' ', 0x7}, {' ', 0x6}}, 0x69) write$damon_attrs(r0, &(0x7f0000001080)={{' ', 0xa58}, {' ', 0x5}, {' ', 0x3}, {}, {' ', 0x6}}, 0x69) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r1, 0x0, 0x0) 14:43:02 executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) (async, rerun: 32) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 32) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) (async, rerun: 64) openat$incfs(r2, &(0x7f0000000040)='.log\x00', 0x58ba00, 0xe5) (rerun: 64) 14:43:02 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000a80)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000007d080000001000006f8b8462ef73a796262e00d7bb64477cdbed769e44a40609fd2502dfe295e3fbfa15524d6cd3ea7d3d144101667880c981dd5d3bda81ee993abd6462fe65d77f7e9afa724aa2fecd7e03ad2fccc07e5566d1aa0ca56b3a202aa80354d32f13bfb9c380c45f234d7168434750fa124d0b09161b01868954257f93e6777df20ab5c7f118d6bcfb883e8fea20bbdabe08806d51759c489824bafe24025c26a4d23e7c47e417c68ee7568d72b562aab74a76a87e6f682be44c8962d331c6848aa7947fa3cd30c843808ebb5f74c9b6be3f0c5a5a618c1c78cc929b7db6279d4d5bfc03db9ec7ac011969f8af53c12b5a0cdfa9b60a15741cbdf687bd9ec7975c53f63c656c087f8890766593990c710f7f3eeca024682f13746ddbe469abbc25872e674b55989e7f483c7e2d230566e50d111259ba797149c42f4edab489"]) 14:43:02 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r3, 0x82307202, &(0x7f0000001340)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r3, &(0x7f0000003880)) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r3, 0x82307202, &(0x7f0000001340)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) [ 1653.389381][T15840] fuse: Bad value for 'fd' [ 1653.392321][T15841] fuse: Bad value for 'fd' [ 1653.423418][T15841] fuse: Bad value for 'user_id' [ 1653.431276][T15838] overlay: Unknown parameter '\' [ 1653.444721][T15841] fuse: Bad value for 'fd' 14:43:02 executing program 1: openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) openat$incfs(r2, &(0x7f0000000040)='.log\x00', 0x58ba00, 0xe5) 14:43:02 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x2200800, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x3ff}}, {@allow_other}, {@default_permissions}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x6747}}, {@max_read={'max_read', 0x3d, 0xffffffffffffff06}}], [{@permit_directio}, {@smackfsfloor={'smackfsfloor', 0x3d, 'user_id'}}, {@euid_gt={'euid>', r4}}, {@permit_directio}, {@seclabel}, {@seclabel}]}}, 0x0, 0x0, &(0x7f0000000200)="47f1b955eab5bd77c2974f8ae52a468d2190b2469cec83866614d4afbfd399e2d5c020ee67967642ff33200767647a027b675e02659aac7bb4d9519e7f75aac1f42162400e0c88d3d0514bb6ddd3d2448e0299bdf59b93c40b3a119052119869a758c65b70") 14:43:02 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) [ 1653.480106][T15838] overlay: Unknown parameter '\' 14:43:02 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000080)=0x0) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000000200)={0x0, "f70ab4ca1b762883721542ea68f7dbae"}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000001200)={{r0}, r1, 0x2, @inherit={0x50, &(0x7f0000000180)={0x0, 0x1, 0x2, 0x5, {0x10, 0xcbe, 0x3, 0x80000001, 0x2}, [0x8]}}, @devid=r2}) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1653.519431][T15851] fuse: Bad value for 'fd' [ 1653.546379][T15851] fuse: Bad value for 'fd' 14:43:02 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x49) [ 1653.568541][T15860] fuse: Bad value for 'fd' 14:43:02 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r3, 0x82307202, &(0x7f0000001340)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r3, 0x82307202, &(0x7f0000001340)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:02 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) fspick(r0, &(0x7f0000000080)='./file1\x00', 0x0) [ 1653.600844][T15865] overlay: Unknown parameter '\' [ 1653.609166][T15860] fuse: Bad value for 'user_id' [ 1653.623972][T15860] fuse: Bad value for 'fd' 14:43:02 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x49) [ 1653.650817][T15871] fuse: Bad value for 'fd' [ 1653.724465][T15875] overlay: Unknown parameter '\' 14:43:03 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x2200800, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x3ff}}, {@allow_other}, {@default_permissions}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x6747}}, {@max_read={'max_read', 0x3d, 0xffffffffffffff06}}], [{@permit_directio}, {@smackfsfloor={'smackfsfloor', 0x3d, 'user_id'}}, {@euid_gt={'euid>', r4}}, {@permit_directio}, {@seclabel}, {@seclabel}]}}, 0x0, 0x0, &(0x7f0000000200)="47f1b955eab5bd77c2974f8ae52a468d2190b2469cec83866614d4afbfd399e2d5c020ee67967642ff33200767647a027b675e02659aac7bb4d9519e7f75aac1f42162400e0c88d3d0514bb6ddd3d2448e0299bdf59b93c40b3a119052119869a758c65b70") 14:43:03 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) 14:43:03 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1006050, &(0x7f0000000180)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1800}}], [{@dont_measure}, {@flag='nolazytime'}, {@smackfshat={'smackfshat', 0x3d, 'group_id'}}, {@euid_lt={'euid<', 0xee00}}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'fuse\x00'}}, {@subj_type={'subj_type', 0x3d, 'user_id'}}, {@subj_role}, {@subj_type={'subj_type', 0x3d, '/-%{[!&'}}]}}, 0x1, 0x0, &(0x7f00000002c0)="2d07ea2f") unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:03 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x49) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x49) (async) 14:43:03 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) fspick(r0, &(0x7f0000000080)='./file1\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) fspick(r0, &(0x7f0000000080)='./file1\x00', 0x0) (async) 14:43:03 executing program 4: r0 = openat$damon_attrs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f0000000080)={{r0}, 0x0, 0x0, @unused=[0x0, 0x7f, 0x20], @subvolid}) (async) write$damon_attrs(r0, &(0x7f0000000000)={{' ', 0x872}, {' ', 0x80}, {' ', 0x32e8000000000000}, {' ', 0x7}, {' ', 0x6}}, 0x69) (async) write$damon_attrs(r0, &(0x7f0000001080)={{' ', 0xa58}, {' ', 0x5}, {' ', 0x3}, {}, {' ', 0x6}}, 0x69) (async) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r1, 0x0, 0x0) 14:43:03 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1006050, &(0x7f0000000180)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1800}}], [{@dont_measure}, {@flag='nolazytime'}, {@smackfshat={'smackfshat', 0x3d, 'group_id'}}, {@euid_lt={'euid<', 0xee00}}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'fuse\x00'}}, {@subj_type={'subj_type', 0x3d, 'user_id'}}, {@subj_role}, {@subj_type={'subj_type', 0x3d, '/-%{[!&'}}]}}, 0x1, 0x0, &(0x7f00000002c0)="2d07ea2f") unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1654.355132][T15884] overlay: Unknown parameter '\' [ 1654.356681][T15883] fuse: Bad value for 'fd' [ 1654.366595][T15882] fuse: Bad value for 'fd' [ 1654.385568][T15888] overlay: Unknown parameter '\' 14:43:03 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0x2, 0x9fec) 14:43:03 executing program 0: openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) 14:43:03 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) fspick(r0, &(0x7f0000000080)='./file1\x00', 0x0) [ 1654.408337][T15882] fuse: Bad value for 'user_id' [ 1654.426087][T15891] fuse: Bad value for 'user_id' [ 1654.440323][T15882] fuse: Bad value for 'fd' 14:43:03 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) open_tree(r0, &(0x7f0000000080)='./file0\x00', 0x8000) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:03 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0x2, 0x9fec) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0x2, 0x9fec) (async) [ 1654.468983][T15894] fuse: Bad value for 'fd' 14:43:03 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1006050, &(0x7f0000000180)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1800}}], [{@dont_measure}, {@flag='nolazytime'}, {@smackfshat={'smackfshat', 0x3d, 'group_id'}}, {@euid_lt={'euid<', 0xee00}}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'fuse\x00'}}, {@subj_type={'subj_type', 0x3d, 'user_id'}}, {@subj_role}, {@subj_type={'subj_type', 0x3d, '/-%{[!&'}}]}}, 0x1, 0x0, &(0x7f00000002c0)="2d07ea2f") (async) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1006050, &(0x7f0000000180)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1800}}], [{@dont_measure}, {@flag='nolazytime'}, {@smackfshat={'smackfshat', 0x3d, 'group_id'}}, {@euid_lt={'euid<', 0xee00}}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'fuse\x00'}}, {@subj_type={'subj_type', 0x3d, 'user_id'}}, {@subj_role}, {@subj_type={'subj_type', 0x3d, '/-%{[!&'}}]}}, 0x1, 0x0, &(0x7f00000002c0)="2d07ea2f") unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:03 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='Y']) openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) [ 1654.530677][T15900] overlay: Unknown parameter '\' 14:43:03 executing program 0: openat$drirender128(0xffffffffffffff9c, 0x0, 0x80, 0x0) 14:43:03 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0x2, 0x9fec) (async) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0x2, 0x9fec) 14:43:03 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r2, 0x10, 0x0, @in={0x2, 0x4e20, @multicast1}}}, 0x90) r3 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(r3, &(0x7f0000000000)='.\x00', 0x200) [ 1654.573022][T15904] fuse: Bad value for 'fd' [ 1654.589491][T15906] fuse: Bad value for 'fd' [ 1654.629184][T15909] overlay: Unknown parameter 'Y' [ 1654.697830][T15914] fuse: Bad value for 'fd' 14:43:04 executing program 4: openat$damon_attrs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r0 = openat$damon_attrs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f0000000080)={{r0}, 0x0, 0x0, @unused=[0x0, 0x7f, 0x20], @subvolid}) write$damon_attrs(r0, &(0x7f0000000000)={{' ', 0x872}, {' ', 0x80}, {' ', 0x32e8000000000000}, {' ', 0x7}, {' ', 0x6}}, 0x69) write$damon_attrs(r0, &(0x7f0000001080)={{' ', 0xa58}, {' ', 0x5}, {' ', 0x3}, {}, {' ', 0x6}}, 0x69) r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r1, 0x0, 0x0) (async) read$ptp(r1, 0x0, 0x0) 14:43:04 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) open_tree(r0, &(0x7f0000000080)='./file0\x00', 0x8000) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) (async) open_tree(r0, &(0x7f0000000080)='./file0\x00', 0x8000) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:04 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='Y']) openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) 14:43:04 executing program 0: openat$drirender128(0xffffffffffffff9c, 0x0, 0x80, 0x0) 14:43:04 executing program 1: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000001880)={0x0, 0x0}) syz_open_procfs$userns(r0, &(0x7f00000018c0)) r1 = syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/net\x00') r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f00000000c0)) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r3, {0x80e}}, './file0\x00'}) 14:43:04 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r2, 0x10, 0x0, @in={0x2, 0x4e20, @multicast1}}}, 0x90) r3 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(r3, &(0x7f0000000000)='.\x00', 0x200) 14:43:04 executing program 0: openat$drirender128(0xffffffffffffff9c, 0x0, 0x80, 0x0) 14:43:04 executing program 1: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000001880)={0x0, 0x0}) syz_open_procfs$userns(r0, &(0x7f00000018c0)) (async) r1 = syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/net\x00') r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r1, &(0x7f00000000c0)) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r3, {0x80e}}, './file0\x00'}) 14:43:04 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r2, 0x10, 0x0, @in={0x2, 0x4e20, @multicast1}}}, 0x90) (async, rerun: 32) r3 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (rerun: 32) unlinkat(r3, &(0x7f0000000000)='.\x00', 0x200) 14:43:04 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='Y']) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='Y']) openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) 14:43:04 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) open_tree(r0, &(0x7f0000000080)='./file0\x00', 0x8000) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, 0xee01}}, 0x0, 0x0, 0x0) (async) open_tree(r0, &(0x7f0000000080)='./file0\x00', 0x8000) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) [ 1655.261467][T15924] fuse: Bad value for 'fd' [ 1655.262151][T15926] fuse: Bad value for 'fd' [ 1655.271517][T15928] overlay: Unknown parameter 'Y' [ 1655.288659][T15926] fuse: Bad value for 'fd' 14:43:04 executing program 0: openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) [ 1655.408752][T15943] fuse: Bad value for 'fd' [ 1655.414096][T15942] overlay: Unknown parameter 'Y' [ 1655.414933][T15944] overlay: Unknown parameter 'Y' [ 1655.425825][T15943] fuse: Bad value for 'fd' [ 1655.427320][T15945] fuse: Bad value for 'fd' [ 1655.431733][T15943] fuse: Bad value for 'fd' [ 1655.450301][T15945] fuse: Bad value for 'fd' [ 1655.455438][T15943] fuse: Bad value for 'fd' [ 1655.462711][T15943] fuse: Bad value for 'fd' [ 1655.473540][T15943] fuse: Bad value for 'fd' [ 1655.481906][T15943] fuse: Bad value for 'fd' [ 1655.491774][T15943] fuse: Bad value for 'fd' [ 1655.501115][T15943] fuse: Bad value for 'fd' [ 1655.511858][T15943] fuse: Bad value for 'fd' [ 1655.520502][T15943] fuse: Bad value for 'fd' [ 1655.526595][T15943] fuse: Bad value for 'fd' [ 1655.531497][T15943] fuse: Bad value for 'fd' [ 1655.538277][T15943] fuse: Bad value for 'fd' [ 1655.543225][T15943] fuse: Bad value for 'fd' [ 1655.549297][T15943] fuse: Bad value for 'fd' [ 1655.554093][T15943] fuse: Bad value for 'fd' [ 1655.559307][T15943] fuse: Bad value for 'fd' [ 1655.564097][T15943] fuse: Bad value for 'fd' [ 1655.569263][T15943] fuse: Bad value for 'fd' [ 1655.573919][T15943] fuse: Bad value for 'fd' [ 1655.578950][T15943] fuse: Bad value for 'fd' [ 1655.583633][T15943] fuse: Bad value for 'fd' [ 1655.588976][T15943] fuse: Bad value for 'fd' [ 1655.594364][T15943] fuse: Bad value for 'fd' [ 1655.599827][T15943] fuse: Bad value for 'fd' [ 1655.604649][T15943] fuse: Bad value for 'fd' [ 1655.609854][T15943] fuse: Bad value for 'fd' [ 1655.614820][T15943] fuse: Bad value for 'fd' [ 1655.624353][T15943] fuse: Bad value for 'fd' [ 1655.630213][T15943] fuse: Bad value for 'fd' [ 1655.634945][T15943] fuse: Bad value for 'fd' [ 1655.639822][T15943] fuse: Bad value for 'fd' 14:43:05 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='/dev/ptp0\x00', &(0x7f0000000040)='/dev/ptp0\x00', 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x0, 0x12a) r3 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000140), 0x109000, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6, 0x4000010, r3, 0x8000000) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f00000000c0), 0xffffffffffffffff, r1}}, 0x18) read$ptp(r0, 0x0, 0x0) 14:43:05 executing program 1: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000001880)={0x0, 0x0}) syz_open_procfs$userns(r0, &(0x7f00000018c0)) (async) r1 = syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/net\x00') r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f00000000c0)) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r3, {0x80e}}, './file0\x00'}) 14:43:05 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x121000, 0x2a) readlinkat(r0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/3, 0x3) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:05 executing program 0: openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 14:43:05 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) faccessat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x134) 14:43:05 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f84643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) fspick(r0, &(0x7f0000000040)='./file1\x00', 0x0) 14:43:05 executing program 0: openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) 14:43:05 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:05 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f84643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) fspick(r0, &(0x7f0000000040)='./file1\x00', 0x0) 14:43:05 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) faccessat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x134) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) faccessat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x134) (async) 14:43:05 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x121000, 0x2a) readlinkat(r0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/3, 0x3) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1656.195947][T15954] fuse: Bad value for 'fd' [ 1656.206322][T15960] overlay: Unknown parameter '\' [ 1656.217085][T15961] fuse: Bad value for 'fd' 14:43:05 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) [ 1656.326009][T15971] fuse: Bad value for 'fd' [ 1656.328219][T15972] overlay: Unknown parameter '\' [ 1656.347747][T15974] fuse: Bad value for 'fd' [ 1656.354736][T15977] overlay: Unknown parameter '\' [ 1656.362643][T15976] fuse: Bad value for 'fd' 14:43:06 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='/dev/ptp0\x00', &(0x7f0000000040)='/dev/ptp0\x00', 0x0) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x0, 0x12a) r3 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000140), 0x109000, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6, 0x4000010, r3, 0x8000000) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f00000000c0), 0xffffffffffffffff, r1}}, 0x18) (async) read$ptp(r0, 0x0, 0x0) 14:43:06 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f84643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f84643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) fspick(r0, &(0x7f0000000040)='./file1\x00', 0x0) 14:43:06 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) faccessat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x134) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) faccessat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x134) (async) 14:43:06 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) fspick(r0, &(0x7f0000000080)='./file1\x00', 0x0) 14:43:06 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x121000, 0x2a) readlinkat(r0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/3, 0x3) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:06 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:06 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:06 executing program 2: ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000240)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="00000002000000002e2f66696c650700000000000000f78e2744ced7d997ac31893412d0848737459e33a927e4dfab3634103da6f4a4bc8320a5f679d45b045fd504a6fe6624d1e30d1c18980e439da57281b393cfeaf7"]) linkat(r0, &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7ff}}, './file0\x00'}) linkat(r0, &(0x7f0000000180)='./file0\x00', r1, &(0x7f0000000200)='./file0\x00', 0x600) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000002c0)='./file0\x00', 0x0, &(0x7f00000004c0)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [{@measure}, {@fowner_eq={'fowner', 0x3d, r3}}, {@dont_measure}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:06 executing program 3: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) unlinkat(r3, &(0x7f0000000040)='./file1\x00', 0x200) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000180)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000001340)={"c42759d22208315a645d0e3e80572993", 0x0, r4, {0xffffffffffffffff, 0x3f}, {0x400, 0x2}, 0xff, [0xa1, 0xfff, 0x1, 0xc5a, 0x9, 0x7, 0x4, 0x9, 0xc, 0xfff, 0x1ff, 0xfffffffffffffffe, 0x8, 0x40, 0xfffffffffffffffe, 0x1]}) 14:43:06 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:06 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mknodat$null(r0, &(0x7f0000000080)='./file0\x00', 0xc000, 0x103) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="4e361e952e"]) [ 1657.093234][T15989] fuse: Bad value for 'fd' [ 1657.094864][T15990] overlay: Unknown parameter '\' [ 1657.100745][T15991] fuse: Bad value for 'fd' [ 1657.104305][T15992] overlay: Unknown parameter '\' [ 1657.114550][T15993] fuse: Bad value for 'fd' [ 1657.126657][T15996] overlay: Unknown parameter '\' 14:43:06 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000040)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$damon_init_regions(r2, &(0x7f0000002080)={{' ', r3}, {' ', 0x923c}, {' ', 0x1}}, 0x3f) [ 1657.227741][T16001] fuse: Bad value for 'user_id' [ 1657.242122][T16001] fuse: Bad value for 'user_id' [ 1657.254911][T16006] overlay: Unknown parameter 'N6•.' [ 1657.256009][T16001] fuse: Bad value for 'fd' 14:43:07 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='/dev/ptp0\x00', &(0x7f0000000040)='/dev/ptp0\x00', 0x0) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x0, 0x12a) r3 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000140), 0x109000, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x6, 0x4000010, r3, 0x8000000) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f00000000c0), 0xffffffffffffffff, r1}}, 0x18) read$ptp(r0, 0x0, 0x0) 14:43:07 executing program 3: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) (async, rerun: 64) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) unlinkat(r3, &(0x7f0000000040)='./file1\x00', 0x200) (async) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000180)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000001340)={"c42759d22208315a645d0e3e80572993", 0x0, r4, {0xffffffffffffffff, 0x3f}, {0x400, 0x2}, 0xff, [0xa1, 0xfff, 0x1, 0xc5a, 0x9, 0x7, 0x4, 0x9, 0xc, 0xfff, 0x1ff, 0xfffffffffffffffe, 0x8, 0x40, 0xfffffffffffffffe, 0x1]}) 14:43:07 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mknodat$null(r0, &(0x7f0000000080)='./file0\x00', 0xc000, 0x103) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="4e361e952e"]) 14:43:07 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) (async, rerun: 32) fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0) (async, rerun: 32) read$FUSE(r0, &(0x7f0000000040)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$damon_init_regions(r2, &(0x7f0000002080)={{' ', r3}, {' ', 0x923c}, {' ', 0x1}}, 0x3f) 14:43:07 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:07 executing program 2: ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000240)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="00000002000000002e2f66696c650700000000000000f78e2744ced7d997ac31893412d0848737459e33a927e4dfab3634103da6f4a4bc8320a5f679d45b045fd504a6fe6624d1e30d1c18980e439da57281b393cfeaf7"]) linkat(r0, &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7ff}}, './file0\x00'}) linkat(r0, &(0x7f0000000180)='./file0\x00', r1, &(0x7f0000000200)='./file0\x00', 0x600) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000002c0)='./file0\x00', 0x0, &(0x7f00000004c0)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [{@measure}, {@fowner_eq={'fowner', 0x3d, r3}}, {@dont_measure}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000240)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32, @ANYBLOB="00000002000000002e2f66696c650700000000000000f78e2744ced7d997ac31893412d0848737459e33a927e4dfab3634103da6f4a4bc8320a5f679d45b045fd504a6fe6624d1e30d1c18980e439da57281b393cfeaf7"]) (async) linkat(r0, &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7ff}}, './file0\x00'}) (async) linkat(r0, &(0x7f0000000180)='./file0\x00', r1, &(0x7f0000000200)='./file0\x00', 0x600) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r2, &(0x7f0000003880)) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r5, &(0x7f0000003880)) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000002c0)='./file0\x00', 0x0, &(0x7f00000004c0)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [{@measure}, {@fowner_eq={'fowner', 0x3d, r3}}, {@dont_measure}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) [ 1657.981707][T16017] overlay: Unknown parameter 'N6•.' [ 1658.000506][T16021] fuse: Bad value for 'user_id' [ 1658.020747][T16021] fuse: Bad value for 'user_id' 14:43:07 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:07 executing program 3: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) (async, rerun: 64) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) unlinkat(r3, &(0x7f0000000040)='./file1\x00', 0x200) (async, rerun: 32) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000180)=0x0) (rerun: 32) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000001340)={"c42759d22208315a645d0e3e80572993", 0x0, r4, {0xffffffffffffffff, 0x3f}, {0x400, 0x2}, 0xff, [0xa1, 0xfff, 0x1, 0xc5a, 0x9, 0x7, 0x4, 0x9, 0xc, 0xfff, 0x1ff, 0xfffffffffffffffe, 0x8, 0x40, 0xfffffffffffffffe, 0x1]}) 14:43:07 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mknodat$null(r0, &(0x7f0000000080)='./file0\x00', 0xc000, 0x103) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="4e361e952e"]) 14:43:07 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async, rerun: 32) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (rerun: 32) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) (async) fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0) (async) read$FUSE(r0, &(0x7f0000000040)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$damon_init_regions(r2, &(0x7f0000002080)={{' ', r3}, {' ', 0x923c}, {' ', 0x1}}, 0x3f) [ 1658.035121][T16021] fuse: Bad value for 'fd' [ 1658.049559][T16021] fuse: Bad value for 'user_id' [ 1658.055005][T16028] fuse: Bad value for 'fd' 14:43:07 executing program 2: ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000240)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="00000002000000002e2f66696c650700000000000000f78e2744ced7d997ac31893412d0848737459e33a927e4dfab3634103da6f4a4bc8320a5f679d45b045fd504a6fe6624d1e30d1c18980e439da57281b393cfeaf7"]) linkat(r0, &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7ff}}, './file0\x00'}) linkat(r0, &(0x7f0000000180)='./file0\x00', r1, &(0x7f0000000200)='./file0\x00', 0x600) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000002c0)='./file0\x00', 0x0, &(0x7f00000004c0)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [{@measure}, {@fowner_eq={'fowner', 0x3d, r3}}, {@dont_measure}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000240)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32, @ANYBLOB="00000002000000002e2f66696c650700000000000000f78e2744ced7d997ac31893412d0848737459e33a927e4dfab3634103da6f4a4bc8320a5f679d45b045fd504a6fe6624d1e30d1c18980e439da57281b393cfeaf7"]) (async) linkat(r0, &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7ff}}, './file0\x00'}) (async) linkat(r0, &(0x7f0000000180)='./file0\x00', r1, &(0x7f0000000200)='./file0\x00', 0x600) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r2, &(0x7f0000003880)) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r5, &(0x7f0000003880)) (async) openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r6}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000002c0)='./file0\x00', 0x0, &(0x7f00000004c0)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[], [{@measure}, {@fowner_eq={'fowner', 0x3d, r3}}, {@dont_measure}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:07 executing program 0: ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) [ 1658.155571][T16039] overlay: Unknown parameter 'N6•.' [ 1658.193822][T16043] fuse: Bad value for 'user_id' [ 1658.209555][T16043] fuse: Bad value for 'user_id' [ 1658.224184][T16043] fuse: Bad value for 'fd' [ 1658.239778][T16043] fuse: Bad value for 'user_id' 14:43:07 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/nmi_backtrace', 0x4000, 0x4) 14:43:07 executing program 3: newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="0200726f75705f69643d", @ANYRESDEC=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000001c0)=ANY=[@ANYBLOB="0100000001000000180000008e", @ANYRES32=r3, @ANYBLOB="04000000000000002e2f66696c653000"]) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0x1}}, './file0\x00'}) 14:43:07 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x8d}}, './file1\x00'}) 14:43:07 executing program 0: ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:07 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f0000000400)={{r0}, 0x0, 0x2, @inherit={0x90, &(0x7f0000000100)={0x1, 0x9, 0x1, 0x7, {0x28, 0x74, 0x8, 0x80000001, 0x1}, [0x0, 0x5, 0x4e7, 0x0, 0x8, 0xfffffffffffffff7, 0x10000, 0xb648, 0x1400000000000000]}}, @subvolid=0x3}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r3}}, './file0\x00'}) 14:43:07 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$incfs(r0, &(0x7f0000000040)='.pending_reads\x00', 0x4000, 0x102) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000140)) read$FUSE(r1, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000100000018000000bcab", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r3, @ANYBLOB='./file0\x00']) 14:43:08 executing program 0: ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:08 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x8d}}, './file1\x00'}) 14:43:08 executing program 3: newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="0200726f75705f69643d", @ANYRESDEC=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000001c0)=ANY=[@ANYBLOB="0100000001000000180000008e", @ANYRES32=r3, @ANYBLOB="04000000000000002e2f66696c653000"]) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0x1}}, './file0\x00'}) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x6000) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="0200726f75705f69643d", @ANYRESDEC=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000001c0)=ANY=[@ANYBLOB="0100000001000000180000008e", @ANYRES32=r3, @ANYBLOB="04000000000000002e2f66696c653000"]) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0x1}}, './file0\x00'}) (async) 14:43:08 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) (async) fstat(r1, &(0x7f0000003880)) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f0000000400)={{r0}, 0x0, 0x2, @inherit={0x90, &(0x7f0000000100)={0x1, 0x9, 0x1, 0x7, {0x28, 0x74, 0x8, 0x80000001, 0x1}, [0x0, 0x5, 0x4e7, 0x0, 0x8, 0xfffffffffffffff7, 0x10000, 0xb648, 0x1400000000000000]}}, @subvolid=0x3}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r3}}, './file0\x00'}) 14:43:08 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$incfs(r0, &(0x7f0000000040)='.pending_reads\x00', 0x4000, 0x102) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000140)) read$FUSE(r1, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000100000018000000bcab", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r3, @ANYBLOB='./file0\x00']) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) openat$incfs(r0, &(0x7f0000000040)='.pending_reads\x00', 0x4000, 0x102) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r2, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) (async) syz_open_procfs$userns(0x0, &(0x7f0000000140)) (async) read$FUSE(r1, &(0x7f0000000380)={0x2020}, 0x2020) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000100000018000000bcab", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r3, @ANYBLOB='./file0\x00']) (async) [ 1658.919348][T16053] fuse: Bad value for 'fd' [ 1658.921818][T16055] overlay: Unknown parameter '\' [ 1658.926331][T16057] fuse: Bad value for 'fd' [ 1658.940021][T16058] fuse: Bad value for 'user_id' 14:43:08 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, 0x0, 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) [ 1659.050484][T16065] fuse: Bad value for 'user_id' [ 1659.052297][T16064] fuse: Bad value for 'user_id' [ 1659.082139][T16071] fuse: Bad value for 'fd' [ 1659.090608][T16068] overlay: Unknown parameter '\' [ 1659.103646][T16071] fuse: Bad value for 'fd' [ 1659.109831][T16072] fuse: Bad value for 'fd' 14:43:08 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, 0x0, 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:08 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f0000000400)={{r0}, 0x0, 0x2, @inherit={0x90, &(0x7f0000000100)={0x1, 0x9, 0x1, 0x7, {0x28, 0x74, 0x8, 0x80000001, 0x1}, [0x0, 0x5, 0x4e7, 0x0, 0x8, 0xfffffffffffffff7, 0x10000, 0xb648, 0x1400000000000000]}}, @subvolid=0x3}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r3}}, './file0\x00'}) 14:43:08 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x8d}}, './file1\x00'}) 14:43:08 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$incfs(r0, &(0x7f0000000040)='.pending_reads\x00', 0x4000, 0x102) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) (async) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000140)) read$FUSE(r1, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000100000018000000bcab", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r3, @ANYBLOB='./file0\x00']) 14:43:08 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/nmi_backtrace', 0x4000, 0x4) 14:43:08 executing program 3: newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x6000) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="0200726f75705f69643d", @ANYRESDEC=r0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000001c0)=ANY=[@ANYBLOB="0100000001000000180000008e", @ANYRES32=r3, @ANYBLOB="04000000000000002e2f66696c653000"]) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0x1}}, './file0\x00'}) 14:43:08 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) openat(r0, &(0x7f0000000040)='./file0\x00', 0x705040, 0x181) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1659.790666][T16083] fuse: Bad value for 'fd' 14:43:08 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, 0x0, 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:09 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) write$smackfs_logging(0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x14) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000180)={@id={0x2, 0x0, @b}, 0x10, 0x0, '\x00', @d}) [ 1659.846604][T16091] fuse: Bad value for 'fd' [ 1659.862717][T16092] overlay: Unknown parameter '\' [ 1659.886217][T16094] fuse: Bad value for 'user_id' 14:43:09 executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x8c) fchmodat(r1, &(0x7f00000000c0)='./file0\x00', 0xa0) 14:43:09 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000080)=@filename='./file0\x00', r2, &(0x7f0000000180)={0x8, 0x101, 0x34ea, 0x10000, 0x4, 0x1, 0x5, 0x7ff, 0x1fe}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0, {0xa3ba}}, './file0\x00'}) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r4, 0xc0189378, &(0x7f0000000240)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {r5}}, './file0\x00'}) unlinkat(r3, &(0x7f0000000300)='./file0\x00', 0x0) 14:43:09 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) [ 1659.948659][T16105] fuse: Bad value for 'fd' 14:43:09 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) write$smackfs_logging(0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x14) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000180)={@id={0x2, 0x0, @b}, 0x10, 0x0, '\x00', @d}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) (async) write$smackfs_logging(0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x14) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000180)={@id={0x2, 0x0, @b}, 0x10, 0x0, '\x00', @d}) (async) [ 1659.970099][T16106] fuse: Bad value for 'fd' 14:43:09 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) openat(r0, &(0x7f0000000040)='./file0\x00', 0x705040, 0x181) (async, rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (rerun: 64) 14:43:09 executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x8c) fchmodat(r1, &(0x7f00000000c0)='./file0\x00', 0xa0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r0, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x8c) (async) fchmodat(r1, &(0x7f00000000c0)='./file0\x00', 0xa0) (async) 14:43:09 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) [ 1660.043154][T16111] overlay: Unknown parameter '\' [ 1660.066598][T16114] fuse: Bad value for 'fd' [ 1660.100366][T16120] fuse: Bad value for 'fd' 14:43:09 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/nmi_backtrace', 0x4000, 0x4) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) read$ptp(r0, 0x0, 0x0) (async) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/module/nmi_backtrace', 0x4000, 0x4) (async) 14:43:09 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000080)=@filename='./file0\x00', r2, &(0x7f0000000180)={0x8, 0x101, 0x34ea, 0x10000, 0x4, 0x1, 0x5, 0x7ff, 0x1fe}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0, {0xa3ba}}, './file0\x00'}) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r4, 0xc0189378, &(0x7f0000000240)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {r5}}, './file0\x00'}) unlinkat(r3, &(0x7f0000000300)='./file0\x00', 0x0) 14:43:09 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) write$smackfs_logging(0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x14) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000180)={@id={0x2, 0x0, @b}, 0x10, 0x0, '\x00', @d}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) (async) write$smackfs_logging(0xffffffffffffffff, &(0x7f0000000040)=0x3, 0x14) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000180)={@id={0x2, 0x0, @b}, 0x10, 0x0, '\x00', @d}) (async) 14:43:09 executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file0\x00', 0x0, 0x8c) fchmodat(r1, &(0x7f00000000c0)='./file0\x00', 0xa0) 14:43:09 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:09 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) openat(r0, &(0x7f0000000040)='./file0\x00', 0x705040, 0x181) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:09 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(0xffffffffffffffff, 0x5000943a, &(0x7f0000000340)={{r0}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r1 = openat$incfs(0xffffffffffffffff, &(0x7f0000000040)='.log\x00', 0x241, 0x0) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000080)={"a0548927a77e0f4a2dd998604077ffab", 0x0, 0x0, {0xffffffffffffffff, 0x1}, {0x0, 0x3}, 0x9a6, [0x1, 0x10c0, 0x7f, 0x1, 0xc34, 0x2, 0xba2, 0x2a, 0x2b, 0x5, 0xffffffffffffff7f, 0x3f2a323b, 0x7, 0x2, 0x8, 0x2]}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000001340)={{r1}, r3, 0x8, @unused=[0x40, 0x6, 0x3ff, 0xffff], @devid}) 14:43:09 executing program 0: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) [ 1660.737280][T16131] fuse: Bad value for 'fd' [ 1660.743113][T16133] fuse: Bad value for 'fd' [ 1660.751730][T16134] overlay: Unknown parameter '\' 14:43:09 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1660.784026][T16133] fuse: Bad value for 'fd' 14:43:09 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYRESOCT=r0, @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69ea3dfa2e74cdb077ece8c05206d4e42140fc8d14f9e2361faf2e1d80e6ab855d0ad9e32053612f1d3ca639127ab4a670b8039fcdc4fa8f4b2ba15bae282b504b477af5b0bfc051e85bc6f6bfb11f5ecda5763acd02bc7dc0790c3f27794c78f69898ef863f3fee62022e1873a2c0fdc9", @ANYRESDEC=0x0, @ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000001340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x9, {0x9, 0x80, 0xff, 0x8, 0x10000}, [0x0]}}, @subvolid=0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000140)) faccessat(r2, &(0x7f0000000100)='./file0\x00', 0x180) faccessat(r1, &(0x7f0000000040)='./file0\x00', 0x138) 14:43:09 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(0xffffffffffffffff, 0x5000943a, &(0x7f0000000340)={{r0}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r1 = openat$incfs(0xffffffffffffffff, &(0x7f0000000040)='.log\x00', 0x241, 0x0) (async, rerun: 32) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (rerun: 32) fstat(r2, &(0x7f0000003880)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000080)={"a0548927a77e0f4a2dd998604077ffab", 0x0, 0x0, {0xffffffffffffffff, 0x1}, {0x0, 0x3}, 0x9a6, [0x1, 0x10c0, 0x7f, 0x1, 0xc34, 0x2, 0xba2, 0x2a, 0x2b, 0x5, 0xffffffffffffff7f, 0x3f2a323b, 0x7, 0x2, 0x8, 0x2]}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000001340)={{r1}, r3, 0x8, @unused=[0x40, 0x6, 0x3ff, 0xffff], @devid}) 14:43:09 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000080)=@filename='./file0\x00', r2, &(0x7f0000000180)={0x8, 0x101, 0x34ea, 0x10000, 0x4, 0x1, 0x5, 0x7ff, 0x1fe}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0, {0xa3ba}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0, {0xa3ba}}, './file0\x00'}) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r4, 0xc0189378, &(0x7f0000000240)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {r5}}, './file0\x00'}) unlinkat(r3, &(0x7f0000000300)='./file0\x00', 0x0) [ 1660.858118][T16154] fuse: Bad value for 'fd' [ 1660.914611][T16159] overlay: Unknown parameter '\' [ 1660.922345][T16161] fuse: Bad value for 'fd' 14:43:10 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x1}}, 0x10) read$ptp(r0, 0x0, 0x0) 14:43:10 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) (async) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:10 executing program 0: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) 14:43:10 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x1000088, &(0x7f0000000480)=ANY=[@ANYBLOB="7af9d4d7b47d9803e512578e801fde49e099acad17b3e690a7846ef5165df546bf0a700c47ff1f6ec64ad84523bdc314e7fe74be9196844802d8e52e052b10e6b492dd0868960ad18cb8e4e82139c2c877e2d55eddc4ed948ed642c87f751787dc750de001a18c225d6bf61b53db4c0795ec", @ANYRES16=r0, @ANYBLOB="10de24a3c3366cfd47a4c668d118b96ea65dfd69427bd27b8b72dfa60254aface6c2df45f72da9812b7979718ae29fe3ffd48dc12a2de9de375e9dc63ffe0634e5bb099bd191059a730ac0ea1c9ffd665b7b0f25e2d2bee1a6b0771a81bdfd1943a5dc1d7a4a0459102cd53f6c4214073a60f17a8f7f4d495133ba9fb6c508758618e63c1188ed378879820da80244a7776c4ef0a493b36b74c2fd2c038a8e24d1d68234ba91f37e2678401afca6dce1eceafb6c94e83acaf3bfa5", @ANYRESOCT=r1, @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="def12d267907f47cef4824881737393a94dce216cbfef0a35a5097be9d66054b6d85e8b9cbfdb055b5523c15aed8aa54a2fc44d32938ae7ae407e4d25faab3bc2de11526836efb6955402e5c86d0c63c6cabaf165ac1c0cdcb74246e803b5a424cfdc3c4a400fafb64ef7021b590f3080869b76e067de7a647b20e2db83dea6b4c849f433de53e0a2d1406ab6006d3960686d725fd78fa3c88ffdd783ac98f", @ANYRES64=r2]) 14:43:10 executing program 2: openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYRESOCT=r0, @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69ea3dfa2e74cdb077ece8c05206d4e42140fc8d14f9e2361faf2e1d80e6ab855d0ad9e32053612f1d3ca639127ab4a670b8039fcdc4fa8f4b2ba15bae282b504b477af5b0bfc051e85bc6f6bfb11f5ecda5763acd02bc7dc0790c3f27794c78f69898ef863f3fee62022e1873a2c0fdc9", @ANYRESDEC=0x0, @ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0) (async) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYRESOCT=r0, @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69ea3dfa2e74cdb077ece8c05206d4e42140fc8d14f9e2361faf2e1d80e6ab855d0ad9e32053612f1d3ca639127ab4a670b8039fcdc4fa8f4b2ba15bae282b504b477af5b0bfc051e85bc6f6bfb11f5ecda5763acd02bc7dc0790c3f27794c78f69898ef863f3fee62022e1873a2c0fdc9", @ANYRESDEC=0x0, @ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000001340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x9, {0x9, 0x80, 0xff, 0x8, 0x10000}, [0x0]}}, @subvolid=0x1}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000140)) faccessat(r2, &(0x7f0000000100)='./file0\x00', 0x180) faccessat(r1, &(0x7f0000000040)='./file0\x00', 0x138) 14:43:10 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(0xffffffffffffffff, 0x5000943a, &(0x7f0000000340)={{r0}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r1 = openat$incfs(0xffffffffffffffff, &(0x7f0000000040)='.log\x00', 0x241, 0x0) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000080)={"a0548927a77e0f4a2dd998604077ffab", 0x0, 0x0, {0xffffffffffffffff, 0x1}, {0x0, 0x3}, 0x9a6, [0x1, 0x10c0, 0x7f, 0x1, 0xc34, 0x2, 0xba2, 0x2a, 0x2b, 0x5, 0xffffffffffffff7f, 0x3f2a323b, 0x7, 0x2, 0x8, 0x2]}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000001340)={{r1}, r3, 0x8, @unused=[0x40, 0x6, 0x3ff, 0xffff], @devid}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(0xffffffffffffffff, 0x5000943a, &(0x7f0000000340)={{r0}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) openat$incfs(0xffffffffffffffff, &(0x7f0000000040)='.log\x00', 0x241, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r2, &(0x7f0000003880)) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000080)={"a0548927a77e0f4a2dd998604077ffab", 0x0, 0x0, {0xffffffffffffffff, 0x1}, {0x0, 0x3}, 0x9a6, [0x1, 0x10c0, 0x7f, 0x1, 0xc34, 0x2, 0xba2, 0x2a, 0x2b, 0x5, 0xffffffffffffff7f, 0x3f2a323b, 0x7, 0x2, 0x8, 0x2]}) (async) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r2, 0x50009417, &(0x7f0000001340)={{r1}, r3, 0x8, @unused=[0x40, 0x6, 0x3ff, 0xffff], @devid}) (async) 14:43:10 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x62, 0x5}}, './file0\x00'}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r2, {0x6}}, './file0\x00'}) 14:43:10 executing program 0: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000040)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) [ 1661.650496][T16173] fuse: Bad value for 'fd' [ 1661.681849][T16173] fuse: Bad value for 'fd' [ 1661.689663][T16178] fuse: Bad value for 'fd' [ 1661.698219][T16177] overlay: Unknown parameter 'zùÔ×´}˜åWŽ€ÞIà™¬­³æ§„nõ]õF¿ [ 1661.698219][T16177] p GÿnÆJØE#½Ãçþt¾‘–„HØå.+æ´’Ýh– [ 1661.698219][T16177] ÑŒ¸äè!9ÂÈwâÕ^ÝÄ픎ÖBÈu‡Üuà¡Œ"]köSÛL•ìÿÿÞ$£Ã6lýG¤Æhѹn¦]ýiB{Ò{‹rߦT¯¬æÂßE÷-©+yyqŠâŸãÿÔÁ*-éÞ7^Æ?þ4å» ›Ñ‘šs [ 1661.698219][T16177] ÀêŸýf[{%âҾᦰw½ýC¥ÜzJY' 14:43:10 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, 0x0) 14:43:10 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async, rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (rerun: 64) 14:43:10 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) (async) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYRESOCT=r0, @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69ea3dfa2e74cdb077ece8c05206d4e42140fc8d14f9e2361faf2e1d80e6ab855d0ad9e32053612f1d3ca639127ab4a670b8039fcdc4fa8f4b2ba15bae282b504b477af5b0bfc051e85bc6f6bfb11f5ecda5763acd02bc7dc0790c3f27794c78f69898ef863f3fee62022e1873a2c0fdc9", @ANYRESDEC=0x0, @ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000001340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x9, {0x9, 0x80, 0xff, 0x8, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000140)) faccessat(r2, &(0x7f0000000100)='./file0\x00', 0x180) (async) faccessat(r1, &(0x7f0000000040)='./file0\x00', 0x138) 14:43:10 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x62, 0x5}}, './file0\x00'}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r2, {0x6}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r2, {0x6}}, './file0\x00'}) [ 1661.739654][T16176] fuse: Bad value for 'fd' [ 1661.853015][T16193] fuse: Bad value for 'fd' 14:43:11 executing program 2: openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:11 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x1000088, &(0x7f0000000480)=ANY=[@ANYBLOB="7af9d4d7b47d9803e512578e801fde49e099acad17b3e690a7846ef5165df546bf0a700c47ff1f6ec64ad84523bdc314e7fe74be9196844802d8e52e052b10e6b492dd0868960ad18cb8e4e82139c2c877e2d55eddc4ed948ed642c87f751787dc750de001a18c225d6bf61b53db4c0795ec", @ANYRES16=r0, @ANYBLOB="10de24a3c3366cfd47a4c668d118b96ea65dfd69427bd27b8b72dfa60254aface6c2df45f72da9812b7979718ae29fe3ffd48dc12a2de9de375e9dc63ffe0634e5bb099bd191059a730ac0ea1c9ffd665b7b0f25e2d2bee1a6b0771a81bdfd1943a5dc1d7a4a0459102cd53f6c4214073a60f17a8f7f4d495133ba9fb6c508758618e63c1188ed378879820da80244a7776c4ef0a493b36b74c2fd2c038a8e24d1d68234ba91f37e2678401afca6dce1eceafb6c94e83acaf3bfa5", @ANYRESOCT=r1, @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="def12d267907f47cef4824881737393a94dce216cbfef0a35a5097be9d66054b6d85e8b9cbfdb055b5523c15aed8aa54a2fc44d32938ae7ae407e4d25faab3bc2de11526836efb6955402e5c86d0c63c6cabaf165ac1c0cdcb74246e803b5a424cfdc3c4a400fafb64ef7021b590f3080869b76e067de7a647b20e2db83dea6b4c849f433de53e0a2d1406ab6006d3960686d725fd78fa3c88ffdd783ac98f", @ANYRES64=r2]) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r1, &(0x7f0000003880)) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r2, &(0x7f0000003880)) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r3, &(0x7f0000003880)) (async) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x1000088, &(0x7f0000000480)=ANY=[@ANYBLOB="7af9d4d7b47d9803e512578e801fde49e099acad17b3e690a7846ef5165df546bf0a700c47ff1f6ec64ad84523bdc314e7fe74be9196844802d8e52e052b10e6b492dd0868960ad18cb8e4e82139c2c877e2d55eddc4ed948ed642c87f751787dc750de001a18c225d6bf61b53db4c0795ec", @ANYRES16=r0, @ANYBLOB="10de24a3c3366cfd47a4c668d118b96ea65dfd69427bd27b8b72dfa60254aface6c2df45f72da9812b7979718ae29fe3ffd48dc12a2de9de375e9dc63ffe0634e5bb099bd191059a730ac0ea1c9ffd665b7b0f25e2d2bee1a6b0771a81bdfd1943a5dc1d7a4a0459102cd53f6c4214073a60f17a8f7f4d495133ba9fb6c508758618e63c1188ed378879820da80244a7776c4ef0a493b36b74c2fd2c038a8e24d1d68234ba91f37e2678401afca6dce1eceafb6c94e83acaf3bfa5", @ANYRESOCT=r1, @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="def12d267907f47cef4824881737393a94dce216cbfef0a35a5097be9d66054b6d85e8b9cbfdb055b5523c15aed8aa54a2fc44d32938ae7ae407e4d25faab3bc2de11526836efb6955402e5c86d0c63c6cabaf165ac1c0cdcb74246e803b5a424cfdc3c4a400fafb64ef7021b590f3080869b76e067de7a647b20e2db83dea6b4c849f433de53e0a2d1406ab6006d3960686d725fd78fa3c88ffdd783ac98f", @ANYRES64=r2]) (async) 14:43:11 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, 0x0) 14:43:11 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000000002700a73950262460e71d595ed370a09edc61a82270b3a14434451aeff13870cbe82dcad30cd900485f3073405d8edb24f545a4dbb592d705b9fbd7309def4d3dc36251665def531735872fd1e645113151b08b5412d9e88beb", @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) fspick(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:11 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x62, 0x5}}, './file0\x00'}) (async, rerun: 64) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (rerun: 64) fstat(r2, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000080)={{0x1, 0x1, 0x18, r2, {0x6}}, './file0\x00'}) 14:43:11 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x1}}, 0x10) (async) read$ptp(r0, 0x0, 0x0) 14:43:11 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000000002700a73950262460e71d595ed370a09edc61a82270b3a14434451aeff13870cbe82dcad30cd900485f3073405d8edb24f545a4dbb592d705b9fbd7309def4d3dc36251665def531735872fd1e645113151b08b5412d9e88beb", @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000000002700a73950262460e71d595ed370a09edc61a82270b3a14434451aeff13870cbe82dcad30cd900485f3073405d8edb24f545a4dbb592d705b9fbd7309def4d3dc36251665def531735872fd1e645113151b08b5412d9e88beb", @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) fspick(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1662.524129][T16200] fuse: Bad value for 'fd' 14:43:11 executing program 2: openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:11 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, 0x0) 14:43:11 executing program 1: ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000010b00080018000000", @ANYRES32, @ANYBLOB="01fcffff000000002e2f66696c653000"]) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3ff}}, './file0\x00'}) openat$incfs(r0, &(0x7f0000000040)='.log\x00', 0x600101, 0x0) 14:43:11 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000000002700a73950262460e71d595ed370a09edc61a82270b3a14434451aeff13870cbe82dcad30cd900485f3073405d8edb24f545a4dbb592d705b9fbd7309def4d3dc36251665def531735872fd1e645113151b08b5412d9e88beb", @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) fspick(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1662.574727][T16205] overlay: Unknown parameter 'zùÔ×´}˜åWŽ€ÞIà™¬­³æ§„nõ]õF¿ [ 1662.574727][T16205] p GÿnÆJØE#½Ãçþt¾‘–„HØå.+æ´’Ýh– [ 1662.574727][T16205] ÑŒ¸äè!9ÂÈwâÕ^ÝÄ픎ÖBÈu‡Üuà¡Œ"]köSÛL•ìÿÿÞ$£Ã6lýG¤Æhѹn¦]ýiB{Ò{‹rߦT¯¬æÂßE÷-©+yyqŠâŸãÿÔÁ*-éÞ7^Æ?þ4å» ›Ñ‘šs [ 1662.574727][T16205] ÀêŸýf[{%âҾᦰw½ýC¥ÜzJY' 14:43:11 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) (async) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000), 0x1000088, &(0x7f0000000480)=ANY=[@ANYBLOB="7af9d4d7b47d9803e512578e801fde49e099acad17b3e690a7846ef5165df546bf0a700c47ff1f6ec64ad84523bdc314e7fe74be9196844802d8e52e052b10e6b492dd0868960ad18cb8e4e82139c2c877e2d55eddc4ed948ed642c87f751787dc750de001a18c225d6bf61b53db4c0795ec", @ANYRES16=r0, @ANYBLOB="10de24a3c3366cfd47a4c668d118b96ea65dfd69427bd27b8b72dfa60254aface6c2df45f72da9812b7979718ae29fe3ffd48dc12a2de9de375e9dc63ffe0634e5bb099bd191059a730ac0ea1c9ffd665b7b0f25e2d2bee1a6b0771a81bdfd1943a5dc1d7a4a0459102cd53f6c4214073a60f17a8f7f4d495133ba9fb6c508758618e63c1188ed378879820da80244a7776c4ef0a493b36b74c2fd2c038a8e24d1d68234ba91f37e2678401afca6dce1eceafb6c94e83acaf3bfa5", @ANYRESOCT=r1, @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="def12d267907f47cef4824881737393a94dce216cbfef0a35a5097be9d66054b6d85e8b9cbfdb055b5523c15aed8aa54a2fc44d32938ae7ae407e4d25faab3bc2de11526836efb6955402e5c86d0c63c6cabaf165ac1c0cdcb74246e803b5a424cfdc3c4a400fafb64ef7021b590f3080869b76e067de7a647b20e2db83dea6b4c849f433de53e0a2d1406ab6006d3960686d725fd78fa3c88ffdd783ac98f", @ANYRES64=r2]) 14:43:11 executing program 2: openat$smackfs_logging(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1662.677949][T16219] fuse: Bad value for 'fd' 14:43:11 executing program 1: ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000010b00080018000000", @ANYRES32, @ANYBLOB="01fcffff000000002e2f66696c653000"]) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3ff}}, './file0\x00'}) openat$incfs(r0, &(0x7f0000000040)='.log\x00', 0x600101, 0x0) 14:43:11 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4, 0x100110, r2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x3, {0xa, 0x4e24, 0x5, @dev={0xfe, 0x80, '\x00', 0x10}, 0x9}}}, 0x38) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64603d30303030303030303030303030303030303030303030302c757365725f696401", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:11 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000080)=@filename='./file0\x00', r2, &(0x7f0000000180)={0x8, 0x101, 0x34ea, 0x10000, 0x4, 0x1, 0x5, 0x7ff, 0x1fe}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0, {0xa3ba}}, './file0\x00'}) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r4, 0xc0189378, &(0x7f0000000240)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {r5}}, './file0\x00'}) unlinkat(r3, &(0x7f0000000300)='./file0\x00', 0x0) 14:43:11 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0xc080661a, &(0x7f0000000100)={@desc={0x1, 0x0, @desc3}}) [ 1662.790436][T16226] fuse: Bad value for 'fd' [ 1662.798458][T16230] overlay: Unknown parameter 'zùÔ×´}˜åWŽ€ÞIà™¬­³æ§„nõ]õF¿ [ 1662.798458][T16230] p GÿnÆJØE#½Ãçþt¾‘–„HØå.+æ´’Ýh– [ 1662.798458][T16230] ÑŒ¸äè!9ÂÈwâÕ^ÝÄ픎ÖBÈu‡Üuà¡Œ"]köSÛL•ìÿÿÞ$£Ã6lýG¤Æhѹn¦]ýiB{Ò{‹rߦT¯¬æÂßE÷-©+yyqŠâŸãÿÔÁ*-éÞ7^Æ?þ4å» ›Ñ‘šs [ 1662.798458][T16230] ÀêŸýf[{%âҾᦰw½ýC¥ÜzJY' [ 1662.845986][T16233] overlay: Unknown parameter '\' [ 1662.870833][T16236] fuse: Bad value for 'fd' [ 1662.928376][T16237] fuse: Bad value for 'fd' 14:43:12 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x1}}, 0x10) read$ptp(r0, 0x0, 0x0) 14:43:12 executing program 1: ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000010b00080018000000", @ANYRES32, @ANYBLOB="01fcffff000000002e2f66696c653000"]) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3ff}}, './file0\x00'}) openat$incfs(r0, &(0x7f0000000040)='.log\x00', 0x600101, 0x0) 14:43:12 executing program 0: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$incfs(r0, &(0x7f0000000040)='.pending_reads\x00', 0x4000, 0x102) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) r5 = syz_open_procfs$userns(0x0, &(0x7f0000000140)) read$FUSE(r1, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f00000001c0)=ANY=[@ANYBLOB="000000000100000018000000bcab", @ANYRES32=r5, @ANYRES32=r6, @ANYRES32=r3, @ANYBLOB='./file0\x00']) 14:43:12 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r1 = open_tree(r0, &(0x7f0000001400)='./file0\x00', 0x8000) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) renameat2(r1, &(0x7f0000001440)='./file0\x00', r2, &(0x7f0000001480)='./file0\x00', 0x0) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x6, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x1, {0x9, 0x80, 0x0, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1ff}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB="07000000000000008096bfbd", @ANYRES32=r5, @ANYBLOB="04000000000000002e2f66696c653000"]) r8 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r8, &(0x7f0000003880)) faccessat(r0, &(0x7f0000000200)='./file0\x00', 0x9) r9 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r9, &(0x7f0000003880)) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000001380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000280)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f00000013c0)={0xa, 0x4, 0xfa00, {r10}}, 0xc) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r5, 0xc0189378, &(0x7f0000000100)={{0x1, 0x1, 0x18, r8, {r9}}, './file0\x00'}) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x800) 14:43:12 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4, 0x100110, r2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x3, {0xa, 0x4e24, 0x5, @dev={0xfe, 0x80, '\x00', 0x10}, 0x9}}}, 0x38) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64603d30303030303030303030303030303030303030303030302c757365725f696401", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64603d30303030303030303030303030303030303030303030302c757365725f696401", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:12 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0xc080661a, &(0x7f0000000100)={@desc={0x1, 0x0, @desc3}}) [ 1663.406679][T16242] fuse: Bad value for 'fd' [ 1663.418862][T16246] fuse: Bad value for 'fd' [ 1663.436816][T16243] fuse: Bad value for 'fd' [ 1663.443498][T16247] fuse: Bad value for 'fd' 14:43:12 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async, rerun: 32) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0xc080661a, &(0x7f0000000100)={@desc={0x1, 0x0, @desc3}}) (rerun: 32) 14:43:12 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000000c0), 0x2, 0x0) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000100), 0x50001, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x5) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @unused=[0x2, 0x40, 0x1], @subvolid=0x1}) r4 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000080), 0x161000, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r4, 0xc4089434, &(0x7f0000001340)={0x0, 0x7, 0xaaa74cb8c2b72329, [0x8001, 0x8000000000000001, 0x8, 0x400], [0x1, 0xd4, 0x6, 0x2, 0x8000, 0x8, 0x7, 0x80000000, 0x2, 0xffffffffffff6845, 0xd5, 0x3, 0x4130, 0x1, 0x3, 0xa024, 0x1000000000000000, 0x6, 0x6, 0x4d, 0x4, 0x9c, 0x7, 0x0, 0x8, 0x20, 0x10001, 0x4, 0x1, 0x2, 0x8000, 0x7ff, 0x600, 0xffffffffffffffff, 0xfffffffffffffffd, 0x9e00000000000000, 0x0, 0x3, 0xfffffffffffffffc, 0xfffffffffffffffe, 0x2, 0x8, 0x7fffffff, 0x4, 0x5, 0x180000000000000, 0x4, 0x1, 0xffff, 0x3, 0x8, 0x10000, 0x401, 0x4, 0xfffffffffffffff8, 0x9, 0x5f, 0x5, 0x1, 0x10000, 0x8, 0x0, 0x0, 0x2, 0x4, 0x6, 0x7, 0x4, 0x2b, 0x7, 0x8, 0x775, 0xffffffffffffffab, 0x1ad, 0xcf7, 0x1ff, 0x5, 0x1, 0x46, 0x3, 0x5, 0x8a, 0x555, 0x8, 0x4, 0x5, 0x8, 0x8000, 0x2b6e, 0x0, 0x0, 0xda, 0x7f, 0xf6f8, 0x7f, 0xffffffffffffff74, 0x7a60619d, 0xb5, 0xfff, 0x9, 0xfffffffffffffffb, 0x0, 0x8000000000000000, 0x8, 0x0, 0x7, 0xf92, 0x5, 0x4, 0x7, 0x88, 0x81, 0x0, 0x2, 0x3f, 0x96, 0x1410, 0x1, 0x4, 0x6, 0x1000]}) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000040)={0xa, 0x4}, 0xc) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x0, 0x0) 14:43:12 executing program 0: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0xc080661a, &(0x7f0000000100)={@desc={0x1, 0x0, @desc3}}) 14:43:12 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4, 0x100110, r2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x3, {0xa, 0x4e24, 0x5, @dev={0xfe, 0x80, '\x00', 0x10}, 0x9}}}, 0x38) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64603d30303030303030303030303030303030303030303030302c757365725f696401", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x4, 0x100110, r2, 0x0) (async) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x3, {0xa, 0x4e24, 0x5, @dev={0xfe, 0x80, '\x00', 0x10}, 0x9}}}, 0x38) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64603d30303030303030303030303030303030303030303030302c757365725f696401", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) [ 1663.461005][T16244] overlay: Unknown parameter '\' 14:43:12 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) open_tree(r0, &(0x7f0000001400)='./file0\x00', 0x8000) (async) r1 = open_tree(r0, &(0x7f0000001400)='./file0\x00', 0x8000) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) renameat2(r1, &(0x7f0000001440)='./file0\x00', r2, &(0x7f0000001480)='./file0\x00', 0x0) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x6, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x1, {0x9, 0x80, 0x0, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1ff}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB="07000000000000008096bfbd", @ANYRES32=r5, @ANYBLOB="04000000000000002e2f66696c653000"]) r8 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r8, &(0x7f0000003880)) faccessat(r0, &(0x7f0000000200)='./file0\x00', 0x9) (async) faccessat(r0, &(0x7f0000000200)='./file0\x00', 0x9) r9 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r9, &(0x7f0000003880)) (async) fstat(r9, &(0x7f0000003880)) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000001380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000280)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f00000013c0)={0xa, 0x4, 0xfa00, {r10}}, 0xc) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r5, 0xc0189378, &(0x7f0000000100)={{0x1, 0x1, 0x18, r8, {r9}}, './file0\x00'}) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x800) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x800) 14:43:12 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000000c0), 0x2, 0x0) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000100), 0x50001, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x5) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @unused=[0x2, 0x40, 0x1], @subvolid=0x1}) r4 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000080), 0x161000, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r4, 0xc4089434, &(0x7f0000001340)={0x0, 0x7, 0xaaa74cb8c2b72329, [0x8001, 0x8000000000000001, 0x8, 0x400], [0x1, 0xd4, 0x6, 0x2, 0x8000, 0x8, 0x7, 0x80000000, 0x2, 0xffffffffffff6845, 0xd5, 0x3, 0x4130, 0x1, 0x3, 0xa024, 0x1000000000000000, 0x6, 0x6, 0x4d, 0x4, 0x9c, 0x7, 0x0, 0x8, 0x20, 0x10001, 0x4, 0x1, 0x2, 0x8000, 0x7ff, 0x600, 0xffffffffffffffff, 0xfffffffffffffffd, 0x9e00000000000000, 0x0, 0x3, 0xfffffffffffffffc, 0xfffffffffffffffe, 0x2, 0x8, 0x7fffffff, 0x4, 0x5, 0x180000000000000, 0x4, 0x1, 0xffff, 0x3, 0x8, 0x10000, 0x401, 0x4, 0xfffffffffffffff8, 0x9, 0x5f, 0x5, 0x1, 0x10000, 0x8, 0x0, 0x0, 0x2, 0x4, 0x6, 0x7, 0x4, 0x2b, 0x7, 0x8, 0x775, 0xffffffffffffffab, 0x1ad, 0xcf7, 0x1ff, 0x5, 0x1, 0x46, 0x3, 0x5, 0x8a, 0x555, 0x8, 0x4, 0x5, 0x8, 0x8000, 0x2b6e, 0x0, 0x0, 0xda, 0x7f, 0xf6f8, 0x7f, 0xffffffffffffff74, 0x7a60619d, 0xb5, 0xfff, 0x9, 0xfffffffffffffffb, 0x0, 0x8000000000000000, 0x8, 0x0, 0x7, 0xf92, 0x5, 0x4, 0x7, 0x88, 0x81, 0x0, 0x2, 0x3f, 0x96, 0x1410, 0x1, 0x4, 0x6, 0x1000]}) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000040)={0xa, 0x4}, 0xc) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000000c0), 0x2, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000100), 0x50001, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x5) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @unused=[0x2, 0x40, 0x1], @subvolid=0x1}) (async) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000080), 0x161000, 0x0) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(r4, 0xc4089434, &(0x7f0000001340)={0x0, 0x7, 0xaaa74cb8c2b72329, [0x8001, 0x8000000000000001, 0x8, 0x400], [0x1, 0xd4, 0x6, 0x2, 0x8000, 0x8, 0x7, 0x80000000, 0x2, 0xffffffffffff6845, 0xd5, 0x3, 0x4130, 0x1, 0x3, 0xa024, 0x1000000000000000, 0x6, 0x6, 0x4d, 0x4, 0x9c, 0x7, 0x0, 0x8, 0x20, 0x10001, 0x4, 0x1, 0x2, 0x8000, 0x7ff, 0x600, 0xffffffffffffffff, 0xfffffffffffffffd, 0x9e00000000000000, 0x0, 0x3, 0xfffffffffffffffc, 0xfffffffffffffffe, 0x2, 0x8, 0x7fffffff, 0x4, 0x5, 0x180000000000000, 0x4, 0x1, 0xffff, 0x3, 0x8, 0x10000, 0x401, 0x4, 0xfffffffffffffff8, 0x9, 0x5f, 0x5, 0x1, 0x10000, 0x8, 0x0, 0x0, 0x2, 0x4, 0x6, 0x7, 0x4, 0x2b, 0x7, 0x8, 0x775, 0xffffffffffffffab, 0x1ad, 0xcf7, 0x1ff, 0x5, 0x1, 0x46, 0x3, 0x5, 0x8a, 0x555, 0x8, 0x4, 0x5, 0x8, 0x8000, 0x2b6e, 0x0, 0x0, 0xda, 0x7f, 0xf6f8, 0x7f, 0xffffffffffffff74, 0x7a60619d, 0xb5, 0xfff, 0x9, 0xfffffffffffffffb, 0x0, 0x8000000000000000, 0x8, 0x0, 0x7, 0xf92, 0x5, 0x4, 0x7, 0x88, 0x81, 0x0, 0x2, 0x3f, 0x96, 0x1410, 0x1, 0x4, 0x6, 0x1000]}) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000040)={0xa, 0x4}, 0xc) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x0, 0x0) (async) [ 1663.560758][T16258] fuse: Bad value for 'fd' [ 1663.564894][T16257] fuse: Bad value for 'fd' [ 1663.577228][T16261] fuse: Bad value for 'fd' [ 1663.602686][T16265] fuse: Bad value for 'fd' [ 1663.613981][T16268] overlay: Unknown parameter '\' [ 1663.613981][T16267] overlay: Unknown parameter '\' 14:43:13 executing program 0: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r0, 0xc080661a, &(0x7f0000000100)={@desc={0x1, 0x0, @desc3}}) 14:43:13 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000040)='fuse\x00', &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff) 14:43:13 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d3030303030303030303030303030303030302c7573375d5f69643df50b1b7d981fe8b601c94604117468c5d04415971aedad5927483019b670fb8bae79e0d81c975f512815cec14ce4d25bc498e40d083f1bf977e883ee5b567ce744bc28cfae2a4706a29da89def8c2548ee0d5b69f68309bb332ce80dc6625e1b9e488295ccee8c01ff07000000000000bff497a3086b8fe3bf0659eed88d6320aacb0a242128c14758398a26d8213b97172aab9ec4bfa1f9d6617b45944813bd00ea01a455c418dfceb049a69be9c6fe1af6e34932885dd58ec266efdfe9d317b991e1bcc598eb", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:13 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000000c0), 0x2, 0x0) (async) openat$cgroup_netprio_ifpriomap(r1, &(0x7f00000000c0), 0x2, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000100), 0x50001, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x5) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @unused=[0x2, 0x40, 0x1], @subvolid=0x1}) r4 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000080), 0x161000, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r4, 0xc4089434, &(0x7f0000001340)={0x0, 0x7, 0xaaa74cb8c2b72329, [0x8001, 0x8000000000000001, 0x8, 0x400], [0x1, 0xd4, 0x6, 0x2, 0x8000, 0x8, 0x7, 0x80000000, 0x2, 0xffffffffffff6845, 0xd5, 0x3, 0x4130, 0x1, 0x3, 0xa024, 0x1000000000000000, 0x6, 0x6, 0x4d, 0x4, 0x9c, 0x7, 0x0, 0x8, 0x20, 0x10001, 0x4, 0x1, 0x2, 0x8000, 0x7ff, 0x600, 0xffffffffffffffff, 0xfffffffffffffffd, 0x9e00000000000000, 0x0, 0x3, 0xfffffffffffffffc, 0xfffffffffffffffe, 0x2, 0x8, 0x7fffffff, 0x4, 0x5, 0x180000000000000, 0x4, 0x1, 0xffff, 0x3, 0x8, 0x10000, 0x401, 0x4, 0xfffffffffffffff8, 0x9, 0x5f, 0x5, 0x1, 0x10000, 0x8, 0x0, 0x0, 0x2, 0x4, 0x6, 0x7, 0x4, 0x2b, 0x7, 0x8, 0x775, 0xffffffffffffffab, 0x1ad, 0xcf7, 0x1ff, 0x5, 0x1, 0x46, 0x3, 0x5, 0x8a, 0x555, 0x8, 0x4, 0x5, 0x8, 0x8000, 0x2b6e, 0x0, 0x0, 0xda, 0x7f, 0xf6f8, 0x7f, 0xffffffffffffff74, 0x7a60619d, 0xb5, 0xfff, 0x9, 0xfffffffffffffffb, 0x0, 0x8000000000000000, 0x8, 0x0, 0x7, 0xf92, 0x5, 0x4, 0x7, 0x88, 0x81, 0x0, 0x2, 0x3f, 0x96, 0x1410, 0x1, 0x4, 0x6, 0x1000]}) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000040)={0xa, 0x4}, 0xc) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000040)={0xa, 0x4}, 0xc) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x0, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x0, 0x0) 14:43:13 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 32) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (rerun: 32) r1 = open_tree(r0, &(0x7f0000001400)='./file0\x00', 0x8000) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) renameat2(r1, &(0x7f0000001440)='./file0\x00', r2, &(0x7f0000001480)='./file0\x00', 0x0) (async) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async, rerun: 32) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (rerun: 32) fstat(r6, &(0x7f0000003880)) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x6, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x1, {0x9, 0x80, 0x0, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1ff}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB="07000000000000008096bfbd", @ANYRES32=r5, @ANYBLOB="04000000000000002e2f66696c653000"]) r8 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r8, &(0x7f0000003880)) (async) faccessat(r0, &(0x7f0000000200)='./file0\x00', 0x9) (async) r9 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r9, &(0x7f0000003880)) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000001380)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000280)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r4, &(0x7f00000013c0)={0xa, 0x4, 0xfa00, {r10}}, 0xc) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r5, 0xc0189378, &(0x7f0000000100)={{0x1, 0x1, 0x18, r8, {r9}}, './file0\x00'}) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180), 0x800) 14:43:13 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r0) read$ptp(r0, 0x0, 0x0) 14:43:13 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000040), 0x2001, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000080)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) 14:43:13 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async, rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async, rerun: 64) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000040)='fuse\x00', &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff) [ 1664.314588][T16277] fuse: Bad value for 'fd' [ 1664.329847][T16276] fuse: Bad value for 'fd' [ 1664.349963][T16282] fuse: Bad value for 'fd' [ 1664.350363][T16283] overlay: Unknown parameter '\' 14:43:13 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) unlinkat(r3, &(0x7f0000000040)='./file1\x00', 0x200) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000180)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000001340)={"c42759d22208315a645d0e3e80572993", 0x0, r4, {0xffffffffffffffff, 0x3f}, {0x400, 0x2}, 0xff, [0xa1, 0xfff, 0x1, 0xc5a, 0x9, 0x7, 0x4, 0x9, 0xc, 0xfff, 0x1ff, 0xfffffffffffffffe, 0x8, 0x40, 0xfffffffffffffffe, 0x1]}) 14:43:13 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00']) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) unlinkat(r0, &(0x7f0000000100)='./file0\x00', 0x0) 14:43:13 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d3030303030303030303030303030303030302c7573375d5f69643df50b1b7d981fe8b601c94604117468c5d04415971aedad5927483019b670fb8bae79e0d81c975f512815cec14ce4d25bc498e40d083f1bf977e883ee5b567ce744bc28cfae2a4706a29da89def8c2548ee0d5b69f68309bb332ce80dc6625e1b9e488295ccee8c01ff07000000000000bff497a3086b8fe3bf0659eed88d6320aacb0a242128c14758398a26d8213b97172aab9ec4bfa1f9d6617b45944813bd00ea01a455c418dfceb049a69be9c6fe1af6e34932885dd58ec266efdfe9d317b991e1bcc598eb", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:13 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000040), 0x2001, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000080)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) 14:43:13 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) unlinkat(r3, &(0x7f0000000040)='./file1\x00', 0x200) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000180)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000001340)={"c42759d22208315a645d0e3e80572993", 0x0, r4, {0xffffffffffffffff, 0x3f}, {0x400, 0x2}, 0xff, [0xa1, 0xfff, 0x1, 0xc5a, 0x9, 0x7, 0x4, 0x9, 0xc, 0xfff, 0x1ff, 0xfffffffffffffffe, 0x8, 0x40, 0xfffffffffffffffe, 0x1]}) 14:43:13 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d3030303030303030303030303030303030302c7573375d5f69643df50b1b7d981fe8b601c94604117468c5d04415971aedad5927483019b670fb8bae79e0d81c975f512815cec14ce4d25bc498e40d083f1bf977e883ee5b567ce744bc28cfae2a4706a29da89def8c2548ee0d5b69f68309bb332ce80dc6625e1b9e488295ccee8c01ff07000000000000bff497a3086b8fe3bf0659eed88d6320aacb0a242128c14758398a26d8213b97172aab9ec4bfa1f9d6617b45944813bd00ea01a455c418dfceb049a69be9c6fe1af6e34932885dd58ec266efdfe9d317b991e1bcc598eb", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1664.493936][T16295] overlayfs: missing 'lowerdir' [ 1664.500547][T16296] fuse: Bad value for 'fd' [ 1664.503558][T16298] fuse: Bad value for 'fd' 14:43:13 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00']) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) unlinkat(r0, &(0x7f0000000100)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00']) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) unlinkat(r0, &(0x7f0000000100)='./file0\x00', 0x0) (async) 14:43:13 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_SET_PATH(r0, 0x3, &(0x7f0000000040)='fuse\x00', &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff) 14:43:13 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r0 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000040), 0x2001, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000080)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}}) [ 1664.600400][T16308] fuse: Bad value for 'fd' [ 1664.606655][T16309] overlayfs: missing 'lowerdir' [ 1664.633899][T16313] overlayfs: missing 'lowerdir' [ 1664.659562][T16318] fuse: Bad value for 'fd' 14:43:14 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) unlinkat(r3, &(0x7f0000000040)='./file1\x00', 0x200) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000180)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000001340)={"c42759d22208315a645d0e3e80572993", 0x0, r4, {0xffffffffffffffff, 0x3f}, {0x400, 0x2}, 0xff, [0xa1, 0xfff, 0x1, 0xc5a, 0x9, 0x7, 0x4, 0x9, 0xc, 0xfff, 0x1ff, 0xfffffffffffffffe, 0x8, 0x40, 0xfffffffffffffffe, 0x1]}) 14:43:14 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x4400, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {r3}}, './file0\x00'}) 14:43:14 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00']) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 32) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (rerun: 32) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) unlinkat(r0, &(0x7f0000000100)='./file0\x00', 0x0) 14:43:14 executing program 1: ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000140)=ANY=[@ANYBLOB="01000000ff1a000000ffffff", @ANYRES32=0xffffffffffffffff, @ANYBLOB="03000000000000002e2f66696c653000"]) r1 = fsmount(0xffffffffffffffff, 0x0, 0x1) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f00000001c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) openat$cgroup_pressure(r1, &(0x7f0000000400)='memory.pressure\x00', 0x2, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x2a41, 0x0) readlinkat(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/160, 0x6c) 14:43:14 executing program 2: ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)=ANY=[@ANYBLOB="f2c74c5fb0d956417cc980144cd44dd385bfb522c7f45902e781e1213a6b090007051b7b9dd170f0fd7d31adec224710f177651ca351dc32a1e960", @ANYRES32=0xffffffffffffffff, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000140), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$cgroup_pressure(r0, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) fstat(r1, &(0x7f0000003880)) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000faffffffffffffff0000000700000000000000000009000000000029008020000000000008ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) openat$cgroup_freezer_state(r3, &(0x7f0000000100), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYRES32, @ANYBLOB="000000002e2f8755d4950e02ce132c66696c653000"]) 14:43:14 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r0) read$ptp(r0, 0x0, 0x0) 14:43:14 executing program 1: ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000140)=ANY=[@ANYBLOB="01000000ff1a000000ffffff", @ANYRES32, @ANYBLOB="03000000000000002e2f66696c653000"]) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000140)=ANY=[@ANYBLOB="01000000ff1a000000ffffff", @ANYRES32=0xffffffffffffffff, @ANYBLOB="03000000000000002e2f66696c653000"]) r1 = fsmount(0xffffffffffffffff, 0x0, 0x1) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f00000001c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) openat$cgroup_pressure(r1, &(0x7f0000000400)='memory.pressure\x00', 0x2, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x2a41, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x2a41, 0x0) readlinkat(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/160, 0x6c) [ 1665.258750][T16330] fuse: Bad value for 'fd' [ 1665.263544][T16329] overlayfs: missing 'lowerdir' [ 1665.263864][T16326] fuse: Bad value for 'fd' 14:43:14 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) unlinkat(r3, &(0x7f0000000040)='./file1\x00', 0x200) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000180)) 14:43:14 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$damon_attrs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x3) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:14 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x4400, 0x0) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {r3}}, './file0\x00'}) 14:43:14 executing program 2: ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)=ANY=[@ANYBLOB="f2c74c5fb0d956417cc980144cd44dd385bfb522c7f45902e781e1213a6b090007051b7b9dd170f0fd7d31adec224710f177651ca351dc32a1e960", @ANYRES32=0xffffffffffffffff, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000140), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$cgroup_pressure(r0, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) (async) fstat(r1, &(0x7f0000003880)) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000faffffffffffffff0000000700000000000000000009000000000029008020000000000008ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) openat$cgroup_freezer_state(r3, &(0x7f0000000100), 0x2, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYRES32, @ANYBLOB="000000002e2f8755d4950e02ce132c66696c653000"]) 14:43:14 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000040), 0x4400, 0x0) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {r3}}, './file0\x00'}) 14:43:14 executing program 1: ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000140)=ANY=[@ANYBLOB="01000000ff1a000000ffffff", @ANYRES32=0xffffffffffffffff, @ANYBLOB="03000000000000002e2f66696c653000"]) fsmount(0xffffffffffffffff, 0x0, 0x1) (async) r1 = fsmount(0xffffffffffffffff, 0x0, 0x1) ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f00000001c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) openat$cgroup_pressure(r1, &(0x7f0000000400)='memory.pressure\x00', 0x2, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x2a41, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x2a41, 0x0) readlinkat(r0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/160, 0x6c) 14:43:14 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) unlinkat(r3, &(0x7f0000000040)='./file1\x00', 0x200) [ 1665.396749][T16341] fuse: Bad value for 'fd' [ 1665.398792][T16343] fuse: Bad value for 'fd' [ 1665.412478][T16344] overlay: Unknown parameter '\' 14:43:14 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$damon_attrs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x3) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:14 executing program 2: ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)=ANY=[@ANYBLOB="f2c74c5fb0d956417cc980144cd44dd385bfb522c7f45902e781e1213a6b090007051b7b9dd170f0fd7d31adec224710f177651ca351dc32a1e960", @ANYRES32=0xffffffffffffffff, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000140), 0x2, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$cgroup_pressure(r0, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) (async) fstat(r1, &(0x7f0000003880)) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000faffffffffffffff0000000700000000000000000009000000000029008020000000000008ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) openat$cgroup_freezer_state(r3, &(0x7f0000000100), 0x2, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYRES32, @ANYBLOB="000000002e2f8755d4950e02ce132c66696c653000"]) [ 1665.507220][T16351] fuse: Bad value for 'fd' 14:43:14 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f00000000c0)='.log\x00', 0x241, 0x82) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) openat$incfs(r0, &(0x7f0000000000)='.log\x00', 0x40000, 0xc0) [ 1665.557713][T16357] fuse: Bad value for 'fd' [ 1665.581359][T16361] overlay: Unknown parameter '\' 14:43:15 executing program 3: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001380)='./cgroup/syz1\x00', 0x200002, 0x0) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r3 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000280), 0x200, 0x0) mknodat(r3, &(0x7f0000001340)='./file0\x00', 0x1, 0x401) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0/../file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) 14:43:15 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000), 0x30000, 0x0) 14:43:15 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$damon_attrs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x3) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:15 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,uses_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000100)={"806f4dc3472a795fce46ac0fdf22fed0", 0x0, 0x0, {0x7, 0x40}, {0x80000001, 0x8}, 0x55, [0xc18e, 0x3, 0x1, 0x9, 0x8, 0x4, 0x1000000000, 0x7f, 0x8, 0x4, 0x7, 0x6, 0x4, 0x94d, 0xf6f, 0x6]}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000200)={"e413e46e550e376482ef02acc3d16e00", 0x0, r2, {0x9, 0x9}, {0x81, 0x3d8b}, 0x5, [0x9, 0x5, 0x0, 0x40, 0x8, 0x6, 0x800, 0xff, 0x8ab0, 0x3, 0x873, 0x7, 0x5, 0x100000000, 0x1ff, 0x7ff]}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0\x00'}) 14:43:15 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, r0) (async) read$ptp(r0, 0x0, 0x0) 14:43:15 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f00000000c0)='.log\x00', 0x241, 0x82) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) openat$incfs(r0, &(0x7f0000000000)='.log\x00', 0x40000, 0xc0) 14:43:15 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) r2 = openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000077040000000000000700000000000000000000000000000009000000000000008000000000006c734fa5d7c60000ff00000000000000000000000000000000000100000000000000"]}, @subvolid=0x1}) 14:43:15 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,uses_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000100)={"806f4dc3472a795fce46ac0fdf22fed0", 0x0, 0x0, {0x7, 0x40}, {0x80000001, 0x8}, 0x55, [0xc18e, 0x3, 0x1, 0x9, 0x8, 0x4, 0x1000000000, 0x7f, 0x8, 0x4, 0x7, 0x6, 0x4, 0x94d, 0xf6f, 0x6]}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000200)={"e413e46e550e376482ef02acc3d16e00", 0x0, r2, {0x9, 0x9}, {0x81, 0x3d8b}, 0x5, [0x9, 0x5, 0x0, 0x40, 0x8, 0x6, 0x800, 0xff, 0x8ab0, 0x3, 0x873, 0x7, 0x5, 0x100000000, 0x1ff, 0x7ff]}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0\x00'}) 14:43:15 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f00000000c0)='.log\x00', 0x241, 0x82) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) (async) openat$incfs(r0, &(0x7f0000000000)='.log\x00', 0x40000, 0xc0) [ 1666.205022][T16372] overlay: Unknown parameter '\' [ 1666.211564][T16369] fuse: Bad value for 'fd' [ 1666.217606][T16374] fuse: Bad value for 'fd' 14:43:15 executing program 3: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001380)='./cgroup/syz1\x00', 0x200002, 0x0) (async, rerun: 64) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0) (rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async, rerun: 64) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (rerun: 64) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) r3 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000280), 0x200, 0x0) mknodat(r3, &(0x7f0000001340)='./file0\x00', 0x1, 0x401) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0/../file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) 14:43:15 executing program 5: mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1666.314271][T16382] fuse: Bad value for 'fd' 14:43:15 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) openat$incfs(r1, &(0x7f0000000240)='.log\x00', 0x464000, 0x105) [ 1666.349497][T16387] fuse: Bad value for 'fd' [ 1666.364005][T16387] fuse: Bad value for 'fd' [ 1666.377427][T16387] fuse: Bad value for 'fd' [ 1666.387968][T16387] fuse: Bad value for 'fd' [ 1666.407656][T16387] fuse: Bad value for 'fd' [ 1666.413571][T16387] fuse: Bad value for 'fd' [ 1666.454408][T16387] fuse: Bad value for 'fd' 14:43:16 executing program 5: mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:16 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,uses_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000100)={"806f4dc3472a795fce46ac0fdf22fed0", 0x0, 0x0, {0x7, 0x40}, {0x80000001, 0x8}, 0x55, [0xc18e, 0x3, 0x1, 0x9, 0x8, 0x4, 0x1000000000, 0x7f, 0x8, 0x4, 0x7, 0x6, 0x4, 0x94d, 0xf6f, 0x6]}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000200)={"e413e46e550e376482ef02acc3d16e00", 0x0, r2, {0x9, 0x9}, {0x81, 0x3d8b}, 0x5, [0x9, 0x5, 0x0, 0x40, 0x8, 0x6, 0x800, 0xff, 0x8ab0, 0x3, 0x873, 0x7, 0x5, 0x100000000, 0x1ff, 0x7ff]}) (async, rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (rerun: 64) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xee01, 0xffffffffffffffff}}, './file0\x00'}) 14:43:16 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000001380)={0x0, 0xfff, 0x1, [0x10001, 0x5, 0x757b, 0x7, 0x4], [0x0, 0x8, 0xfffffffffffffffd, 0x2, 0x3, 0x9, 0x421, 0x80000001, 0x4, 0x6, 0x8, 0x7c4f, 0x80000000, 0xde9, 0xfffffffffffffffb, 0x10000, 0x0, 0xffffffffffffff1a, 0x8000000000000000, 0x5, 0x401, 0xfffffffffffffffd, 0x1, 0xffffffffffffff79, 0x5, 0x5, 0x7fffffff, 0x80000000, 0x6, 0x7fffffffffffffff, 0xc61f, 0x6, 0x6, 0x54, 0x80000001, 0x3, 0x5, 0xc88, 0x1, 0x6, 0x5, 0x800, 0x2, 0x6, 0xba, 0x3, 0x2, 0x8001, 0xfffffffffffffffa, 0x10000, 0x3, 0xb10e, 0x850, 0x7f, 0x0, 0xfffffffffffffffa, 0x80000000, 0x5, 0x5, 0x9, 0x0, 0xfffffffffffffff8, 0x10000, 0x8001, 0x0, 0x9, 0x80000001, 0x2, 0x5f, 0x800, 0x7, 0x3, 0x1, 0x256d, 0x2, 0x1, 0xa244, 0x52, 0x0, 0x2, 0x120, 0x8000000000000001, 0x5, 0x0, 0x5, 0xa1, 0xb672, 0x9, 0x1f, 0x80, 0x0, 0x7, 0x9, 0x1, 0x100, 0x8, 0x5, 0xecda, 0x100000000, 0x1, 0x80000001, 0x5, 0x800, 0x2, 0xb0, 0x0, 0x5, 0xfffffffffffffffd, 0x2b, 0x5d2, 0xffffffff, 0x1, 0xffff, 0x8001, 0x7, 0x1ff, 0x0, 0xfffffffffffff000, 0x5, 0xb4, 0x4]}) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) open_tree(r2, &(0x7f0000000040)='./file0\x00', 0x1) 14:43:16 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) 14:43:16 executing program 3: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001380)='./cgroup/syz1\x00', 0x200002, 0x0) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) r3 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000280), 0x200, 0x0) mknodat(r3, &(0x7f0000001340)='./file0\x00', 0x1, 0x401) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0/../file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) 14:43:16 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0xc19200, 0x0) read$ptp(r0, 0x0, 0x0) 14:43:16 executing program 5: mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:16 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000001380)={0x0, 0xfff, 0x1, [0x10001, 0x5, 0x757b, 0x7, 0x4], [0x0, 0x8, 0xfffffffffffffffd, 0x2, 0x3, 0x9, 0x421, 0x80000001, 0x4, 0x6, 0x8, 0x7c4f, 0x80000000, 0xde9, 0xfffffffffffffffb, 0x10000, 0x0, 0xffffffffffffff1a, 0x8000000000000000, 0x5, 0x401, 0xfffffffffffffffd, 0x1, 0xffffffffffffff79, 0x5, 0x5, 0x7fffffff, 0x80000000, 0x6, 0x7fffffffffffffff, 0xc61f, 0x6, 0x6, 0x54, 0x80000001, 0x3, 0x5, 0xc88, 0x1, 0x6, 0x5, 0x800, 0x2, 0x6, 0xba, 0x3, 0x2, 0x8001, 0xfffffffffffffffa, 0x10000, 0x3, 0xb10e, 0x850, 0x7f, 0x0, 0xfffffffffffffffa, 0x80000000, 0x5, 0x5, 0x9, 0x0, 0xfffffffffffffff8, 0x10000, 0x8001, 0x0, 0x9, 0x80000001, 0x2, 0x5f, 0x800, 0x7, 0x3, 0x1, 0x256d, 0x2, 0x1, 0xa244, 0x52, 0x0, 0x2, 0x120, 0x8000000000000001, 0x5, 0x0, 0x5, 0xa1, 0xb672, 0x9, 0x1f, 0x80, 0x0, 0x7, 0x9, 0x1, 0x100, 0x8, 0x5, 0xecda, 0x100000000, 0x1, 0x80000001, 0x5, 0x800, 0x2, 0xb0, 0x0, 0x5, 0xfffffffffffffffd, 0x2b, 0x5d2, 0xffffffff, 0x1, 0xffff, 0x8001, 0x7, 0x1ff, 0x0, 0xfffffffffffff000, 0x5, 0xb4, 0x4]}) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000001380)={0x0, 0xfff, 0x1, [0x10001, 0x5, 0x757b, 0x7, 0x4], [0x0, 0x8, 0xfffffffffffffffd, 0x2, 0x3, 0x9, 0x421, 0x80000001, 0x4, 0x6, 0x8, 0x7c4f, 0x80000000, 0xde9, 0xfffffffffffffffb, 0x10000, 0x0, 0xffffffffffffff1a, 0x8000000000000000, 0x5, 0x401, 0xfffffffffffffffd, 0x1, 0xffffffffffffff79, 0x5, 0x5, 0x7fffffff, 0x80000000, 0x6, 0x7fffffffffffffff, 0xc61f, 0x6, 0x6, 0x54, 0x80000001, 0x3, 0x5, 0xc88, 0x1, 0x6, 0x5, 0x800, 0x2, 0x6, 0xba, 0x3, 0x2, 0x8001, 0xfffffffffffffffa, 0x10000, 0x3, 0xb10e, 0x850, 0x7f, 0x0, 0xfffffffffffffffa, 0x80000000, 0x5, 0x5, 0x9, 0x0, 0xfffffffffffffff8, 0x10000, 0x8001, 0x0, 0x9, 0x80000001, 0x2, 0x5f, 0x800, 0x7, 0x3, 0x1, 0x256d, 0x2, 0x1, 0xa244, 0x52, 0x0, 0x2, 0x120, 0x8000000000000001, 0x5, 0x0, 0x5, 0xa1, 0xb672, 0x9, 0x1f, 0x80, 0x0, 0x7, 0x9, 0x1, 0x100, 0x8, 0x5, 0xecda, 0x100000000, 0x1, 0x80000001, 0x5, 0x800, 0x2, 0xb0, 0x0, 0x5, 0xfffffffffffffffd, 0x2b, 0x5d2, 0xffffffff, 0x1, 0xffff, 0x8001, 0x7, 0x1ff, 0x0, 0xfffffffffffff000, 0x5, 0xb4, 0x4]}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) open_tree(r2, &(0x7f0000000040)='./file0\x00', 0x1) [ 1667.124095][T16404] fuse: Bad value for 'fd' 14:43:16 executing program 0: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x8a40c0, &(0x7f0000001440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d3030300e303030303030303030303030303030303030302c757365725f69643d109947a3281f3ebe57d2fa5fbc19874b61eb462ee3b803e35f64f8124c99bf1f03821bbc290b880f9e1ff0dfab34ecdbb57257907404851dc997083da2f86313d1fca16da41c1c100288cde5827cc87ad0c730e2913ebf5c42866311deed1090eabb654e88e1d55f4897376bc2d7cfa1fc491504b658de8d9d9cd07ed2ea3004ceb14457889052bde3d8679dd5630c2d3f209b8a98cbbfc31acdecf5956f39973b76e1b10a3c84beabd7e95f295c1aa0c63a", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) [ 1667.157294][T16402] fuse: Bad value for 'fd' 14:43:16 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fN=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000000,blksize=0x0000000000000000,default_permissions,allow_other,default_permissions,\x00'], 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)={{}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {}, 0x2c, {[{@allow_other}], [{@uid_lt={'uid<', r1}}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:16 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0xc19200, 0x0) read$ptp(r0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0xc19200, 0x0) (async) read$ptp(r0, 0x0, 0x0) (async) 14:43:16 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000001380)={0x0, 0xfff, 0x1, [0x10001, 0x5, 0x757b, 0x7, 0x4], [0x0, 0x8, 0xfffffffffffffffd, 0x2, 0x3, 0x9, 0x421, 0x80000001, 0x4, 0x6, 0x8, 0x7c4f, 0x80000000, 0xde9, 0xfffffffffffffffb, 0x10000, 0x0, 0xffffffffffffff1a, 0x8000000000000000, 0x5, 0x401, 0xfffffffffffffffd, 0x1, 0xffffffffffffff79, 0x5, 0x5, 0x7fffffff, 0x80000000, 0x6, 0x7fffffffffffffff, 0xc61f, 0x6, 0x6, 0x54, 0x80000001, 0x3, 0x5, 0xc88, 0x1, 0x6, 0x5, 0x800, 0x2, 0x6, 0xba, 0x3, 0x2, 0x8001, 0xfffffffffffffffa, 0x10000, 0x3, 0xb10e, 0x850, 0x7f, 0x0, 0xfffffffffffffffa, 0x80000000, 0x5, 0x5, 0x9, 0x0, 0xfffffffffffffff8, 0x10000, 0x8001, 0x0, 0x9, 0x80000001, 0x2, 0x5f, 0x800, 0x7, 0x3, 0x1, 0x256d, 0x2, 0x1, 0xa244, 0x52, 0x0, 0x2, 0x120, 0x8000000000000001, 0x5, 0x0, 0x5, 0xa1, 0xb672, 0x9, 0x1f, 0x80, 0x0, 0x7, 0x9, 0x1, 0x100, 0x8, 0x5, 0xecda, 0x100000000, 0x1, 0x80000001, 0x5, 0x800, 0x2, 0xb0, 0x0, 0x5, 0xfffffffffffffffd, 0x2b, 0x5d2, 0xffffffff, 0x1, 0xffff, 0x8001, 0x7, 0x1ff, 0x0, 0xfffffffffffff000, 0x5, 0xb4, 0x4]}) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) open_tree(r2, &(0x7f0000000040)='./file0\x00', 0x1) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000001380)={0x0, 0xfff, 0x1, [0x10001, 0x5, 0x757b, 0x7, 0x4], [0x0, 0x8, 0xfffffffffffffffd, 0x2, 0x3, 0x9, 0x421, 0x80000001, 0x4, 0x6, 0x8, 0x7c4f, 0x80000000, 0xde9, 0xfffffffffffffffb, 0x10000, 0x0, 0xffffffffffffff1a, 0x8000000000000000, 0x5, 0x401, 0xfffffffffffffffd, 0x1, 0xffffffffffffff79, 0x5, 0x5, 0x7fffffff, 0x80000000, 0x6, 0x7fffffffffffffff, 0xc61f, 0x6, 0x6, 0x54, 0x80000001, 0x3, 0x5, 0xc88, 0x1, 0x6, 0x5, 0x800, 0x2, 0x6, 0xba, 0x3, 0x2, 0x8001, 0xfffffffffffffffa, 0x10000, 0x3, 0xb10e, 0x850, 0x7f, 0x0, 0xfffffffffffffffa, 0x80000000, 0x5, 0x5, 0x9, 0x0, 0xfffffffffffffff8, 0x10000, 0x8001, 0x0, 0x9, 0x80000001, 0x2, 0x5f, 0x800, 0x7, 0x3, 0x1, 0x256d, 0x2, 0x1, 0xa244, 0x52, 0x0, 0x2, 0x120, 0x8000000000000001, 0x5, 0x0, 0x5, 0xa1, 0xb672, 0x9, 0x1f, 0x80, 0x0, 0x7, 0x9, 0x1, 0x100, 0x8, 0x5, 0xecda, 0x100000000, 0x1, 0x80000001, 0x5, 0x800, 0x2, 0xb0, 0x0, 0x5, 0xfffffffffffffffd, 0x2b, 0x5d2, 0xffffffff, 0x1, 0xffff, 0x8001, 0x7, 0x1ff, 0x0, 0xfffffffffffff000, 0x5, 0xb4, 0x4]}) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r2, {0x4}}, './file0\x00'}) (async) open_tree(r2, &(0x7f0000000040)='./file0\x00', 0x1) (async) 14:43:16 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fspick(r1, &(0x7f0000000040)='./file0\x00', 0x1) 14:43:16 executing program 0: openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140), 0x420840, 0x0) fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) 14:43:16 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0xc19200, 0x0) read$ptp(r0, 0x0, 0x0) 14:43:16 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x40000, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) fchmodat(r0, &(0x7f0000000080)='./file0/file0\x00', 0x189) 14:43:16 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.log\x00', 0x241, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) fstat(0xffffffffffffffff, &(0x7f0000003880)) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000080)=0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f00000000c0)={{r0}, r3, 0x12, @unused=[0x400, 0xfffffffffffffffd, 0x8001, 0x7], @name="70c984f8f8208ba380d20ce0abab5a9a2649f2be55a20c41ea8da777347b5e727e860ae91abab32d71cfeb4955137941cef46e767c3ee381cc02e16eae4d681fd4d1bfb8e74ca699d47d34358a6c83a675b15a8de4adb3f93bd305ee2a14338cc38197b2712952853322c648abcf250f8dbf833a887e076c16a538ff3af6d097a02cb1c83629df30130fe856a6a23c1eb4bd0ce13d0f1e7d0db12e2cc93ebd96f4fbca2827bfa3a20aa78d0cb1e3937ea25b1d2a90d5377e7ddff42b35558045692cb8a0a2c83f7ee7ad57c28c0c4156541cb36b0b5efa3faf8198d7154764625495c818154911e0c5bf4507264d3ae08146c4116d7b7e1b915a0a07851f81f6f3ab814677b1453580fbc79e07d26534d6b0cdbc88acef803d9333fbac2b49d28c94ec2bcaa7dbeccff6b2f20b962b02869323e437f474e7e853b39f53390710d08efbda61e2cf14eee23716ab9f877df9c8a4afa87b3ad24f3f890c78cb616afe3081e946650d17631965c802a36cb5ad2a6e247aef8e7490319f4422c8e3cbca116ac88698f9a701ecd46cd8e6f9061344bef3ef9f3f219ef39edaade4dd53423d28fe682967ec8f22e1089068ee2c4227509d97be25aa5169f208d09eb61135c280815bf0cb4edb675902380ec0501c59aa039572abd5862db4a20f92f2a5c78930af80f2ef2ba407696fdce385655bb1f7518b12b81ca1f75d96189c342254e2126844f294a1691efbbd1042a0691f2899b2925beafac797f1e6fbf5082661653453b844212a93150b97fe4001c400ff50280590ebc697eaa11c85cd05e78c42e3b1e34c07a05ff29c30c7e2e2ef97cf3ff04c1b5c0b6fb36d0e2e9dfdf7467ec09cd0331fbaa55b1f35b7d26687b3f1efd78c53a6f8a40b9099436116eb3cb81489de2e1dff437c7af4579b09b2bf3888e7076919c6a9e35b83b94106cdd8d2fda6409638149fd2282847308a52049cca0dab1c23a3bf94110c1cc4f4b1aedad9c2c6e94359cc18b19dd7f5ae44d1b9fc08ff635ce2f4136793f809a6607dce21e12c74a2bee46f845b454bb1a763d46b6ebe9e70fcddd23433ad9a7a796025d91f102eb5c3c32e030e79ac1bd77d720ca33d7b7012815d49301291880a96d8c93b7bd2d9d1a81f597ef23c4b5c4314d040b1b283d0ab2bed21df62a3565ac91765711770b186ddf1c76ac0ad872d5053512d626799fa6afa224f48d8d59a1915b6a19150dc06375175e194d1d4a7143a4948c0b35c4ed856cb6100a5f21ca01cb97f683f75ee57fd9c306f649d7e609c4c7e53150653f61bce2e5facda41ba13eac9d77e07a8e1f9072340be00967d82a5217a68875428dea1f4a99b898386851172b93386bc245d13b0887aa2dc1cfe54b1545ed48b6c5cd365bbc179553c8283a0f90a5dcec87f407af110baa53cc111806c9541b1834a3240229ef3e48bd2d498268aff1fbfdbc49b9bc6bca1b0c271dd36d9072cb536d4ad2fbe5099fef4689309ca4b79da5f823fd3e2a56340db5eae26a760ff5cc16910e5e113e673c35133a1de28d8159aca0564c8fe07521aa278293312a8e4730a649ee2026940b99843c103d1b7f6280a64f0b2f8fe34cca7128b8c1773f71d4c6ae9bb323adc68f38e6aea47725a70540c62c5a6f26cc8224a6a2ed75f9074836a3556f1e06111809886f475f8ef27e2b0104f44a980aa5f0525e2eeba15f027a42137057e571953d940350de2735e96745a314f7a725d126418b1d8924cbea075c673b65af1a6dd82cf54a1500661b46f6f6e80b2de2389ecbabfb4402a4c398181bee88da3e202a7b9813414daab9263ca75a38faf997ef0bbc9499430cbf889904d74977a73895b2190a51fdd530ec95c738f099606f4cbefebbe5fe06e588be6335f73842107d251e48ccf84b707b4c18c44e752e282efa39dbbfa0c4848647fde2823e1712bd12eedf741acf3edb67f75607476e3f614b3d3842f01273a9cecfa48d0c770477aec5d3436cd751089b646fe470b1d19a6113a96725f7c4fb7afb91f700ad23a3aba1bb5b55157de4317bd844233b23ee2001fefe0f211772b88e6ea5dbe374cf15501e9250c8bd1bc76f5df19b9a062138d9d83e6393fbf971a4d4def972cdc7aa38ea02f8fe8ee10da63f216f73d253198d5a8986bd48f141c49af3bc5c8ed616bc2679639316f79408154661048047d1040d55df37ba03bfe54f82a15c10b372342856ef1447b8103322a9196ce24deb9f61b127bb1b9ca8bd5c9cc8b19a7edd64db987de20e9499ca0d99b3495a2736892960f19b6f72a53b471d0ba267aa879a3bc7ad6d1e4e42a3c7fd9e6524f62aa3519ad7880a01d74d00f5e69df7700deff4d5f8f84670e7e915d88ab251e6e224c5c90f83786f56ac92d720a5c50ba843912ab0d2981b47faec0718bac4b636ecdc399285bbc7d261a26c4fbccf600e5d2d7e508fd7667dd81e41e296649d77d6d75e14359f6bb77a930bb81ac2fccfed40fdd568d4b225cc03fbab8ba7647a97bed30a312522466cb43532877d6ab250ecd98c04d85a06360f330e625cd1244597c7d8661d690b14500ac7f632245b21e2348bc89f0fb6c4dcf6b88272524e8fcd4d22d92ba42f5ba8d1b387451f4325a4621732f2029380b87a7f0150661ad8a8ee3d317a26a08852e7c7d373d5bf49da770bbab1ac2a0f744216939163572c337ed46ce5a74319fd3fa4c70ad70f25054f7018649fd9004d9a5655dab67eb9d5f2ecee7104e41dd05e2aab3f86f53ae1ce14800ec4782afb17f548c4bf45840341ff3568d0092a7d1a1e3b67e7950650e6f8c16123cf2878f9da8f2e0a9d46a02d90c439963622551ab8e71e13535b2a4435753e2ac0275f03bd99b53410694466f5aa645fbdb7c30498df2f531625e303f8782566ae1eb0d77066659d7cb14eec0aa37790e864dbeb267331623142d7e8909581d4c86915fb94ce176afe335045c877b210a48ba3d679865a2c9b2882c63ba1ba294a6e7d184585da5eac9daf3b2f603433d73e8474d70dd7671231420c8154291e2ec5deb3ec582b44d9ccafb9aec5be7181798215ae275703a78f8322831c2505da75b3169c8714e66660d63d0a8bb51d5d25ad165bf0d4a81b4a5243d4fb731acee1b7839774d276002e9be3598402a3ffcf4806ca6cf35c59815ba0bf0d83ab83d1281b8f3321829af6a1386f02d33870c02e6f87d1ff2bfa921ca915d745118f5bfaefdd1ace0038292439d7add494d762fe8fa972956d77b193f5498db5ac4a99bedbbf6d85663fe26f7599b44ff7d8508af0844fc673fa9a3faf7be209f568f6a6be819b00a94908a0ec2e2ff1395f6b64ce1667cae7583f2135bead29d7dcb8875f6210fac4b45a0b9d0760d40095fea3bf9fc2e09cbf89773b3007ba3a79d66182e723defbbcaa092a72aebd34328ec096aa1e7c7666cbf12b724dd565466e604a982089a59374cca5fbbeb044518347669dd1a6581c1ad2fd700c9e48ae15a02c17bc56ff70c4389f755f12139311d97f671b4a91cfda95a79e1b203ca374115e9a6bc04a788cf0201da4a4c6b58100ccd28a1a20b7a0461140d3a2ac38be6a84b552886dd5c085098796ec293f5faa258b1c91c33b29e738b9d6625ccfc28ae3c87e31eaf18af3833aa26dced6c7b3dd1727552a7c90c96846fad80f20414a658fb25a63baaac7c073b5884017ce116fa59fae6404634cd6515c5ac150be6f2267db9bdb509ca616d022fce78f9fbd202e916400fa975e04052cd7821f46d6142605605d4e0e7581dea798929f45b197f61896004e8492a9bff47375ad487a5564c1896aa9c701c9a3245e79f0ea44d9c0e24d24de263b0857b5d80aa2ce9b9cfc783042f5cb45f26da4407577228a7729ef236930c2d0b9e3ae7d40d961c5b5c79250245e6f84447d5c9ca1b63589bf85f16f77da0bbf834c32aa8f3c7897ad53e77070919ded40ad05e0ffd1e5c4b67599fa93b8380469f4faa1ab1ae6e3419a6d92a1e1d70d40bccc8a621c07c95540cbca8b6c4d3bb290be4de19ffed3331038b9f0111dc9286b1a2348cf4eb0d2377ede4505d743dda7b8d7079c12adee8a63afe69d28ad147425f122345f3e18a50d39138ce491efa495cf47714e7b7c8da3f793f35a1ce7b85514afd2aa476a63ec795af77dadf163d8ad019945f4332306c1ef18ef60b0d9b13dd2e1121680cd2fa8d199dafcc066dd0c3b228839a6fabba6f17ee9b332793bb66df9567e3b5fed14ffcc6cf6760a27deba4be8b571ab08ead01349ed435890d2afcf9a087fc44418b6e05f9b068242c1d310168021d00f9702fc96a1ab320c86fc0283ef358efa3f8c9b749b5d4d4b4e8f058201dc62cc897b57e0c779c9171e44cce4665a5ce4ff528c778eab6bdd093dd62d5663b1111643186c7d495735850362a0bba5cd2a6961a0573f19fc0dc66c0729c36624cfecb4159ae0db7483d206673638390b1c36eb10745156fae672b0e4bf330696d6e82aae8077cc920254960f251b82a3e2de7434bcc253e2905434f12d0fc71cbe503405bf4e11a6ec18b4cfaab599d2d17ac65255c5b21d24729e8150347e5c68faf96e3ff1dcf353b49bcaefa858386ecc9198dcedc85f40bdd5b4cf7a9430b04a62fe41eec52da2ca7df00d70bb8a31192954a5e3ad47dc167ff839ff6d415daec27df2193e2ae0bcc2bd54f041042d346529279ef9511a0729caae10dbbdcf3d2547d176f8f19db0b5a18ff93bcb9635ca3e28aaab184667f7b6929a3decad194dc200bbfbf7f88ebf736fecec552098e04ec7efc97c01c4b18c0a4e0f9d4dab0b0f8da7ec1fecfda851cbe049002f5394ec1a04d5c6163efcfd5a87c2969dbe18c21dc51e2375489ec8be1483c261624477da33088adff3f494d2682bcb5dd2ff81fde53d7e15d92383a1ff4745eaf3660b499cf5ca7df3b4c76d99300d82c807eeff7a49e80e46b6edbf78d97b958c77ee002f9662c29b25da466c360c3002bffbb5b4a61d73f0907ffc29de80ba1b41d09c3352adcaa453c3f440a3c25c102218c566bd5e75aef7820ecacc8cfa2f489d7ac2700b371bef4af70bfb0cbb2ea35eec6a08351778008048d960c8c2bf09923e577120d0480cae67019434a66659042b7bf34bfaf62791bf126e720563f99d5d174e4ec9cb9ed5f381bcebfc238576e07321c5f30dc7356b4fdd09ccca367f9adaf5376e6bf32a53a8531589aabb85a393ddfce45b0bd153b4d4b785f03a9040b920eb2cb31ecc1f11d5a4d8a48ab0f5139a4e0fe366954088355624cf8356c117e13b4481e05d4718240732af18f0fc250179ac845afaff96944c346dd88c405675206acf3b7620b60fb063c02b0865dcb1a8b768aa5af5d90018eaa4377cce19a73671a8f1bd8fc3468ce0ee10f12ebdda4eb68f640e799e23853d127287ee8773d1d1142047c67d272587f39d889f47b5d3bfc2e6dee35f4459c95cb7704ca4c958e2ed3cdffadd0a210325ad4b80f38513eb5e481a2f129bd55ddfbafee7c8b3df526aee61911c53bc20c7e1fbb68b422efb8c88f3c63495da10615cbd15e9c43bcd2cc8655646fd9c46f20217e693dc82e8241d83139f73e94b43d8e4205ebc1464dc019e6b81a181c0d3b24b4c4cb11979ec267ea90b76f63db8e35290be9fac02c16f60d3501572f12fcf00febd37ce38ecd3bc4d9018436ac79b2305c1e"}) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0xfc}, 0x2) [ 1667.293135][T16421] fuse: Unknown parameter 'fN' [ 1667.309621][T16423] fuse: Bad value for 'fd' [ 1667.333163][T16421] fuse: Bad value for 'fd' 14:43:16 executing program 0: fsopen(&(0x7f0000000100)='vxfs\x00', 0xfce5dc1768c702db) 14:43:16 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fspick(r1, &(0x7f0000000040)='./file0\x00', 0x1) (async) fspick(r1, &(0x7f0000000040)='./file0\x00', 0x1) 14:43:16 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (rerun: 64) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fN=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000000,blksize=0x0000000000000000,default_permissions,allow_other,default_permissions,\x00'], 0x0, 0x0, 0x0) (async, rerun: 64) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)={{}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {}, 0x2c, {[{@allow_other}], [{@uid_lt={'uid<', r1}}]}}, 0x0, 0x0, 0x0) (async, rerun: 64) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:16 executing program 4: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000000)=[{}, {}, {}, {}], 0x4, &(0x7f00000000c0)={r0, r1+60000000}, &(0x7f0000000100)={[0x3]}, 0xffffffffffffffdb) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000010000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB="2c6d61785f726561643d3078303030303030303030303030653730342c64656661756c745f706572b0697359696f6e732c64656661756c745f7065726d697373696f6e732c616c6c6f775f6f746865722c666d776e65723e", @ANYRESDEC, @ANYBLOB=',rootcontext=unconfined_u,sync,permit_directio,\x00'], 0x0, 0x0, &(0x7f00000002c0)) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r2, 0x0, 0x0) 14:43:16 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x40000, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) fchmodat(r0, &(0x7f0000000080)='./file0/file0\x00', 0x189) 14:43:16 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.log\x00', 0x241, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) fstat(0xffffffffffffffff, &(0x7f0000003880)) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000080)=0x0) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f00000000c0)={{r0}, r3, 0x12, @unused=[0x400, 0xfffffffffffffffd, 0x8001, 0x7], @name="70c984f8f8208ba380d20ce0abab5a9a2649f2be55a20c41ea8da777347b5e727e860ae91abab32d71cfeb4955137941cef46e767c3ee381cc02e16eae4d681fd4d1bfb8e74ca699d47d34358a6c83a675b15a8de4adb3f93bd305ee2a14338cc38197b2712952853322c648abcf250f8dbf833a887e076c16a538ff3af6d097a02cb1c83629df30130fe856a6a23c1eb4bd0ce13d0f1e7d0db12e2cc93ebd96f4fbca2827bfa3a20aa78d0cb1e3937ea25b1d2a90d5377e7ddff42b35558045692cb8a0a2c83f7ee7ad57c28c0c4156541cb36b0b5efa3faf8198d7154764625495c818154911e0c5bf4507264d3ae08146c4116d7b7e1b915a0a07851f81f6f3ab814677b1453580fbc79e07d26534d6b0cdbc88acef803d9333fbac2b49d28c94ec2bcaa7dbeccff6b2f20b962b02869323e437f474e7e853b39f53390710d08efbda61e2cf14eee23716ab9f877df9c8a4afa87b3ad24f3f890c78cb616afe3081e946650d17631965c802a36cb5ad2a6e247aef8e7490319f4422c8e3cbca116ac88698f9a701ecd46cd8e6f9061344bef3ef9f3f219ef39edaade4dd53423d28fe682967ec8f22e1089068ee2c4227509d97be25aa5169f208d09eb61135c280815bf0cb4edb675902380ec0501c59aa039572abd5862db4a20f92f2a5c78930af80f2ef2ba407696fdce385655bb1f7518b12b81ca1f75d96189c342254e2126844f294a1691efbbd1042a0691f2899b2925beafac797f1e6fbf5082661653453b844212a93150b97fe4001c400ff50280590ebc697eaa11c85cd05e78c42e3b1e34c07a05ff29c30c7e2e2ef97cf3ff04c1b5c0b6fb36d0e2e9dfdf7467ec09cd0331fbaa55b1f35b7d26687b3f1efd78c53a6f8a40b9099436116eb3cb81489de2e1dff437c7af4579b09b2bf3888e7076919c6a9e35b83b94106cdd8d2fda6409638149fd2282847308a52049cca0dab1c23a3bf94110c1cc4f4b1aedad9c2c6e94359cc18b19dd7f5ae44d1b9fc08ff635ce2f4136793f809a6607dce21e12c74a2bee46f845b454bb1a763d46b6ebe9e70fcddd23433ad9a7a796025d91f102eb5c3c32e030e79ac1bd77d720ca33d7b7012815d49301291880a96d8c93b7bd2d9d1a81f597ef23c4b5c4314d040b1b283d0ab2bed21df62a3565ac91765711770b186ddf1c76ac0ad872d5053512d626799fa6afa224f48d8d59a1915b6a19150dc06375175e194d1d4a7143a4948c0b35c4ed856cb6100a5f21ca01cb97f683f75ee57fd9c306f649d7e609c4c7e53150653f61bce2e5facda41ba13eac9d77e07a8e1f9072340be00967d82a5217a68875428dea1f4a99b898386851172b93386bc245d13b0887aa2dc1cfe54b1545ed48b6c5cd365bbc179553c8283a0f90a5dcec87f407af110baa53cc111806c9541b1834a3240229ef3e48bd2d498268aff1fbfdbc49b9bc6bca1b0c271dd36d9072cb536d4ad2fbe5099fef4689309ca4b79da5f823fd3e2a56340db5eae26a760ff5cc16910e5e113e673c35133a1de28d8159aca0564c8fe07521aa278293312a8e4730a649ee2026940b99843c103d1b7f6280a64f0b2f8fe34cca7128b8c1773f71d4c6ae9bb323adc68f38e6aea47725a70540c62c5a6f26cc8224a6a2ed75f9074836a3556f1e06111809886f475f8ef27e2b0104f44a980aa5f0525e2eeba15f027a42137057e571953d940350de2735e96745a314f7a725d126418b1d8924cbea075c673b65af1a6dd82cf54a1500661b46f6f6e80b2de2389ecbabfb4402a4c398181bee88da3e202a7b9813414daab9263ca75a38faf997ef0bbc9499430cbf889904d74977a73895b2190a51fdd530ec95c738f099606f4cbefebbe5fe06e588be6335f73842107d251e48ccf84b707b4c18c44e752e282efa39dbbfa0c4848647fde2823e1712bd12eedf741acf3edb67f75607476e3f614b3d3842f01273a9cecfa48d0c770477aec5d3436cd751089b646fe470b1d19a6113a96725f7c4fb7afb91f700ad23a3aba1bb5b55157de4317bd844233b23ee2001fefe0f211772b88e6ea5dbe374cf15501e9250c8bd1bc76f5df19b9a062138d9d83e6393fbf971a4d4def972cdc7aa38ea02f8fe8ee10da63f216f73d253198d5a8986bd48f141c49af3bc5c8ed616bc2679639316f79408154661048047d1040d55df37ba03bfe54f82a15c10b372342856ef1447b8103322a9196ce24deb9f61b127bb1b9ca8bd5c9cc8b19a7edd64db987de20e9499ca0d99b3495a2736892960f19b6f72a53b471d0ba267aa879a3bc7ad6d1e4e42a3c7fd9e6524f62aa3519ad7880a01d74d00f5e69df7700deff4d5f8f84670e7e915d88ab251e6e224c5c90f83786f56ac92d720a5c50ba843912ab0d2981b47faec0718bac4b636ecdc399285bbc7d261a26c4fbccf600e5d2d7e508fd7667dd81e41e296649d77d6d75e14359f6bb77a930bb81ac2fccfed40fdd568d4b225cc03fbab8ba7647a97bed30a312522466cb43532877d6ab250ecd98c04d85a06360f330e625cd1244597c7d8661d690b14500ac7f632245b21e2348bc89f0fb6c4dcf6b88272524e8fcd4d22d92ba42f5ba8d1b387451f4325a4621732f2029380b87a7f0150661ad8a8ee3d317a26a08852e7c7d373d5bf49da770bbab1ac2a0f744216939163572c337ed46ce5a74319fd3fa4c70ad70f25054f7018649fd9004d9a5655dab67eb9d5f2ecee7104e41dd05e2aab3f86f53ae1ce14800ec4782afb17f548c4bf45840341ff3568d0092a7d1a1e3b67e7950650e6f8c16123cf2878f9da8f2e0a9d46a02d90c439963622551ab8e71e13535b2a4435753e2ac0275f03bd99b53410694466f5aa645fbdb7c30498df2f531625e303f8782566ae1eb0d77066659d7cb14eec0aa37790e864dbeb267331623142d7e8909581d4c86915fb94ce176afe335045c877b210a48ba3d679865a2c9b2882c63ba1ba294a6e7d184585da5eac9daf3b2f603433d73e8474d70dd7671231420c8154291e2ec5deb3ec582b44d9ccafb9aec5be7181798215ae275703a78f8322831c2505da75b3169c8714e66660d63d0a8bb51d5d25ad165bf0d4a81b4a5243d4fb731acee1b7839774d276002e9be3598402a3ffcf4806ca6cf35c59815ba0bf0d83ab83d1281b8f3321829af6a1386f02d33870c02e6f87d1ff2bfa921ca915d745118f5bfaefdd1ace0038292439d7add494d762fe8fa972956d77b193f5498db5ac4a99bedbbf6d85663fe26f7599b44ff7d8508af0844fc673fa9a3faf7be209f568f6a6be819b00a94908a0ec2e2ff1395f6b64ce1667cae7583f2135bead29d7dcb8875f6210fac4b45a0b9d0760d40095fea3bf9fc2e09cbf89773b3007ba3a79d66182e723defbbcaa092a72aebd34328ec096aa1e7c7666cbf12b724dd565466e604a982089a59374cca5fbbeb044518347669dd1a6581c1ad2fd700c9e48ae15a02c17bc56ff70c4389f755f12139311d97f671b4a91cfda95a79e1b203ca374115e9a6bc04a788cf0201da4a4c6b58100ccd28a1a20b7a0461140d3a2ac38be6a84b552886dd5c085098796ec293f5faa258b1c91c33b29e738b9d6625ccfc28ae3c87e31eaf18af3833aa26dced6c7b3dd1727552a7c90c96846fad80f20414a658fb25a63baaac7c073b5884017ce116fa59fae6404634cd6515c5ac150be6f2267db9bdb509ca616d022fce78f9fbd202e916400fa975e04052cd7821f46d6142605605d4e0e7581dea798929f45b197f61896004e8492a9bff47375ad487a5564c1896aa9c701c9a3245e79f0ea44d9c0e24d24de263b0857b5d80aa2ce9b9cfc783042f5cb45f26da4407577228a7729ef236930c2d0b9e3ae7d40d961c5b5c79250245e6f84447d5c9ca1b63589bf85f16f77da0bbf834c32aa8f3c7897ad53e77070919ded40ad05e0ffd1e5c4b67599fa93b8380469f4faa1ab1ae6e3419a6d92a1e1d70d40bccc8a621c07c95540cbca8b6c4d3bb290be4de19ffed3331038b9f0111dc9286b1a2348cf4eb0d2377ede4505d743dda7b8d7079c12adee8a63afe69d28ad147425f122345f3e18a50d39138ce491efa495cf47714e7b7c8da3f793f35a1ce7b85514afd2aa476a63ec795af77dadf163d8ad019945f4332306c1ef18ef60b0d9b13dd2e1121680cd2fa8d199dafcc066dd0c3b228839a6fabba6f17ee9b332793bb66df9567e3b5fed14ffcc6cf6760a27deba4be8b571ab08ead01349ed435890d2afcf9a087fc44418b6e05f9b068242c1d310168021d00f9702fc96a1ab320c86fc0283ef358efa3f8c9b749b5d4d4b4e8f058201dc62cc897b57e0c779c9171e44cce4665a5ce4ff528c778eab6bdd093dd62d5663b1111643186c7d495735850362a0bba5cd2a6961a0573f19fc0dc66c0729c36624cfecb4159ae0db7483d206673638390b1c36eb10745156fae672b0e4bf330696d6e82aae8077cc920254960f251b82a3e2de7434bcc253e2905434f12d0fc71cbe503405bf4e11a6ec18b4cfaab599d2d17ac65255c5b21d24729e8150347e5c68faf96e3ff1dcf353b49bcaefa858386ecc9198dcedc85f40bdd5b4cf7a9430b04a62fe41eec52da2ca7df00d70bb8a31192954a5e3ad47dc167ff839ff6d415daec27df2193e2ae0bcc2bd54f041042d346529279ef9511a0729caae10dbbdcf3d2547d176f8f19db0b5a18ff93bcb9635ca3e28aaab184667f7b6929a3decad194dc200bbfbf7f88ebf736fecec552098e04ec7efc97c01c4b18c0a4e0f9d4dab0b0f8da7ec1fecfda851cbe049002f5394ec1a04d5c6163efcfd5a87c2969dbe18c21dc51e2375489ec8be1483c261624477da33088adff3f494d2682bcb5dd2ff81fde53d7e15d92383a1ff4745eaf3660b499cf5ca7df3b4c76d99300d82c807eeff7a49e80e46b6edbf78d97b958c77ee002f9662c29b25da466c360c3002bffbb5b4a61d73f0907ffc29de80ba1b41d09c3352adcaa453c3f440a3c25c102218c566bd5e75aef7820ecacc8cfa2f489d7ac2700b371bef4af70bfb0cbb2ea35eec6a08351778008048d960c8c2bf09923e577120d0480cae67019434a66659042b7bf34bfaf62791bf126e720563f99d5d174e4ec9cb9ed5f381bcebfc238576e07321c5f30dc7356b4fdd09ccca367f9adaf5376e6bf32a53a8531589aabb85a393ddfce45b0bd153b4d4b785f03a9040b920eb2cb31ecc1f11d5a4d8a48ab0f5139a4e0fe366954088355624cf8356c117e13b4481e05d4718240732af18f0fc250179ac845afaff96944c346dd88c405675206acf3b7620b60fb063c02b0865dcb1a8b768aa5af5d90018eaa4377cce19a73671a8f1bd8fc3468ce0ee10f12ebdda4eb68f640e799e23853d127287ee8773d1d1142047c67d272587f39d889f47b5d3bfc2e6dee35f4459c95cb7704ca4c958e2ed3cdffadd0a210325ad4b80f38513eb5e481a2f129bd55ddfbafee7c8b3df526aee61911c53bc20c7e1fbb68b422efb8c88f3c63495da10615cbd15e9c43bcd2cc8655646fd9c46f20217e693dc82e8241d83139f73e94b43d8e4205ebc1464dc019e6b81a181c0d3b24b4c4cb11979ec267ea90b76f63db8e35290be9fac02c16f60d3501572f12fcf00febd37ce38ecd3bc4d9018436ac79b2305c1e"}) (async, rerun: 32) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0xfc}, 0x2) (rerun: 32) 14:43:16 executing program 0: fsopen(0x0, 0xfce5dc1768c702db) [ 1667.452681][T16434] fuse: Bad value for 'fd' 14:43:16 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fspick(r1, &(0x7f0000000040)='./file0\x00', 0x1) [ 1667.511615][T16441] fuse: Bad value for 'fd' [ 1667.522817][T16440] fuse: Unknown parameter 'fN' [ 1667.540927][T16441] fuse: Bad value for 'fd' [ 1667.557172][T16440] fuse: Unknown parameter 'fN' 14:43:16 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x40000, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) fchmodat(r0, &(0x7f0000000080)='./file0/file0\x00', 0x189) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x40000, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) fchmodat(r0, &(0x7f0000000080)='./file0/file0\x00', 0x189) (async) 14:43:16 executing program 0: fsopen(0x0, 0x0) [ 1667.568135][T16441] fuse: Bad value for 'fd' [ 1667.579685][T16440] fuse: Unknown parameter 'fN' [ 1667.588982][T16455] fuse: Bad value for 'fd' [ 1667.594247][T16441] fuse: Bad value for 'fd' [ 1667.605939][T16456] fuse: Bad value for 'fd' 14:43:16 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.log\x00', 0x241, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) fstat(0xffffffffffffffff, &(0x7f0000003880)) (async, rerun: 64) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000080)=0x0) (rerun: 64) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r1, 0x50009417, &(0x7f00000000c0)={{r0}, r3, 0x12, @unused=[0x400, 0xfffffffffffffffd, 0x8001, 0x7], @name="70c984f8f8208ba380d20ce0abab5a9a2649f2be55a20c41ea8da777347b5e727e860ae91abab32d71cfeb4955137941cef46e767c3ee381cc02e16eae4d681fd4d1bfb8e74ca699d47d34358a6c83a675b15a8de4adb3f93bd305ee2a14338cc38197b2712952853322c648abcf250f8dbf833a887e076c16a538ff3af6d097a02cb1c83629df30130fe856a6a23c1eb4bd0ce13d0f1e7d0db12e2cc93ebd96f4fbca2827bfa3a20aa78d0cb1e3937ea25b1d2a90d5377e7ddff42b35558045692cb8a0a2c83f7ee7ad57c28c0c4156541cb36b0b5efa3faf8198d7154764625495c818154911e0c5bf4507264d3ae08146c4116d7b7e1b915a0a07851f81f6f3ab814677b1453580fbc79e07d26534d6b0cdbc88acef803d9333fbac2b49d28c94ec2bcaa7dbeccff6b2f20b962b02869323e437f474e7e853b39f53390710d08efbda61e2cf14eee23716ab9f877df9c8a4afa87b3ad24f3f890c78cb616afe3081e946650d17631965c802a36cb5ad2a6e247aef8e7490319f4422c8e3cbca116ac88698f9a701ecd46cd8e6f9061344bef3ef9f3f219ef39edaade4dd53423d28fe682967ec8f22e1089068ee2c4227509d97be25aa5169f208d09eb61135c280815bf0cb4edb675902380ec0501c59aa039572abd5862db4a20f92f2a5c78930af80f2ef2ba407696fdce385655bb1f7518b12b81ca1f75d96189c342254e2126844f294a1691efbbd1042a0691f2899b2925beafac797f1e6fbf5082661653453b844212a93150b97fe4001c400ff50280590ebc697eaa11c85cd05e78c42e3b1e34c07a05ff29c30c7e2e2ef97cf3ff04c1b5c0b6fb36d0e2e9dfdf7467ec09cd0331fbaa55b1f35b7d26687b3f1efd78c53a6f8a40b9099436116eb3cb81489de2e1dff437c7af4579b09b2bf3888e7076919c6a9e35b83b94106cdd8d2fda6409638149fd2282847308a52049cca0dab1c23a3bf94110c1cc4f4b1aedad9c2c6e94359cc18b19dd7f5ae44d1b9fc08ff635ce2f4136793f809a6607dce21e12c74a2bee46f845b454bb1a763d46b6ebe9e70fcddd23433ad9a7a796025d91f102eb5c3c32e030e79ac1bd77d720ca33d7b7012815d49301291880a96d8c93b7bd2d9d1a81f597ef23c4b5c4314d040b1b283d0ab2bed21df62a3565ac91765711770b186ddf1c76ac0ad872d5053512d626799fa6afa224f48d8d59a1915b6a19150dc06375175e194d1d4a7143a4948c0b35c4ed856cb6100a5f21ca01cb97f683f75ee57fd9c306f649d7e609c4c7e53150653f61bce2e5facda41ba13eac9d77e07a8e1f9072340be00967d82a5217a68875428dea1f4a99b898386851172b93386bc245d13b0887aa2dc1cfe54b1545ed48b6c5cd365bbc179553c8283a0f90a5dcec87f407af110baa53cc111806c9541b1834a3240229ef3e48bd2d498268aff1fbfdbc49b9bc6bca1b0c271dd36d9072cb536d4ad2fbe5099fef4689309ca4b79da5f823fd3e2a56340db5eae26a760ff5cc16910e5e113e673c35133a1de28d8159aca0564c8fe07521aa278293312a8e4730a649ee2026940b99843c103d1b7f6280a64f0b2f8fe34cca7128b8c1773f71d4c6ae9bb323adc68f38e6aea47725a70540c62c5a6f26cc8224a6a2ed75f9074836a3556f1e06111809886f475f8ef27e2b0104f44a980aa5f0525e2eeba15f027a42137057e571953d940350de2735e96745a314f7a725d126418b1d8924cbea075c673b65af1a6dd82cf54a1500661b46f6f6e80b2de2389ecbabfb4402a4c398181bee88da3e202a7b9813414daab9263ca75a38faf997ef0bbc9499430cbf889904d74977a73895b2190a51fdd530ec95c738f099606f4cbefebbe5fe06e588be6335f73842107d251e48ccf84b707b4c18c44e752e282efa39dbbfa0c4848647fde2823e1712bd12eedf741acf3edb67f75607476e3f614b3d3842f01273a9cecfa48d0c770477aec5d3436cd751089b646fe470b1d19a6113a96725f7c4fb7afb91f700ad23a3aba1bb5b55157de4317bd844233b23ee2001fefe0f211772b88e6ea5dbe374cf15501e9250c8bd1bc76f5df19b9a062138d9d83e6393fbf971a4d4def972cdc7aa38ea02f8fe8ee10da63f216f73d253198d5a8986bd48f141c49af3bc5c8ed616bc2679639316f79408154661048047d1040d55df37ba03bfe54f82a15c10b372342856ef1447b8103322a9196ce24deb9f61b127bb1b9ca8bd5c9cc8b19a7edd64db987de20e9499ca0d99b3495a2736892960f19b6f72a53b471d0ba267aa879a3bc7ad6d1e4e42a3c7fd9e6524f62aa3519ad7880a01d74d00f5e69df7700deff4d5f8f84670e7e915d88ab251e6e224c5c90f83786f56ac92d720a5c50ba843912ab0d2981b47faec0718bac4b636ecdc399285bbc7d261a26c4fbccf600e5d2d7e508fd7667dd81e41e296649d77d6d75e14359f6bb77a930bb81ac2fccfed40fdd568d4b225cc03fbab8ba7647a97bed30a312522466cb43532877d6ab250ecd98c04d85a06360f330e625cd1244597c7d8661d690b14500ac7f632245b21e2348bc89f0fb6c4dcf6b88272524e8fcd4d22d92ba42f5ba8d1b387451f4325a4621732f2029380b87a7f0150661ad8a8ee3d317a26a08852e7c7d373d5bf49da770bbab1ac2a0f744216939163572c337ed46ce5a74319fd3fa4c70ad70f25054f7018649fd9004d9a5655dab67eb9d5f2ecee7104e41dd05e2aab3f86f53ae1ce14800ec4782afb17f548c4bf45840341ff3568d0092a7d1a1e3b67e7950650e6f8c16123cf2878f9da8f2e0a9d46a02d90c439963622551ab8e71e13535b2a4435753e2ac0275f03bd99b53410694466f5aa645fbdb7c30498df2f531625e303f8782566ae1eb0d77066659d7cb14eec0aa37790e864dbeb267331623142d7e8909581d4c86915fb94ce176afe335045c877b210a48ba3d679865a2c9b2882c63ba1ba294a6e7d184585da5eac9daf3b2f603433d73e8474d70dd7671231420c8154291e2ec5deb3ec582b44d9ccafb9aec5be7181798215ae275703a78f8322831c2505da75b3169c8714e66660d63d0a8bb51d5d25ad165bf0d4a81b4a5243d4fb731acee1b7839774d276002e9be3598402a3ffcf4806ca6cf35c59815ba0bf0d83ab83d1281b8f3321829af6a1386f02d33870c02e6f87d1ff2bfa921ca915d745118f5bfaefdd1ace0038292439d7add494d762fe8fa972956d77b193f5498db5ac4a99bedbbf6d85663fe26f7599b44ff7d8508af0844fc673fa9a3faf7be209f568f6a6be819b00a94908a0ec2e2ff1395f6b64ce1667cae7583f2135bead29d7dcb8875f6210fac4b45a0b9d0760d40095fea3bf9fc2e09cbf89773b3007ba3a79d66182e723defbbcaa092a72aebd34328ec096aa1e7c7666cbf12b724dd565466e604a982089a59374cca5fbbeb044518347669dd1a6581c1ad2fd700c9e48ae15a02c17bc56ff70c4389f755f12139311d97f671b4a91cfda95a79e1b203ca374115e9a6bc04a788cf0201da4a4c6b58100ccd28a1a20b7a0461140d3a2ac38be6a84b552886dd5c085098796ec293f5faa258b1c91c33b29e738b9d6625ccfc28ae3c87e31eaf18af3833aa26dced6c7b3dd1727552a7c90c96846fad80f20414a658fb25a63baaac7c073b5884017ce116fa59fae6404634cd6515c5ac150be6f2267db9bdb509ca616d022fce78f9fbd202e916400fa975e04052cd7821f46d6142605605d4e0e7581dea798929f45b197f61896004e8492a9bff47375ad487a5564c1896aa9c701c9a3245e79f0ea44d9c0e24d24de263b0857b5d80aa2ce9b9cfc783042f5cb45f26da4407577228a7729ef236930c2d0b9e3ae7d40d961c5b5c79250245e6f84447d5c9ca1b63589bf85f16f77da0bbf834c32aa8f3c7897ad53e77070919ded40ad05e0ffd1e5c4b67599fa93b8380469f4faa1ab1ae6e3419a6d92a1e1d70d40bccc8a621c07c95540cbca8b6c4d3bb290be4de19ffed3331038b9f0111dc9286b1a2348cf4eb0d2377ede4505d743dda7b8d7079c12adee8a63afe69d28ad147425f122345f3e18a50d39138ce491efa495cf47714e7b7c8da3f793f35a1ce7b85514afd2aa476a63ec795af77dadf163d8ad019945f4332306c1ef18ef60b0d9b13dd2e1121680cd2fa8d199dafcc066dd0c3b228839a6fabba6f17ee9b332793bb66df9567e3b5fed14ffcc6cf6760a27deba4be8b571ab08ead01349ed435890d2afcf9a087fc44418b6e05f9b068242c1d310168021d00f9702fc96a1ab320c86fc0283ef358efa3f8c9b749b5d4d4b4e8f058201dc62cc897b57e0c779c9171e44cce4665a5ce4ff528c778eab6bdd093dd62d5663b1111643186c7d495735850362a0bba5cd2a6961a0573f19fc0dc66c0729c36624cfecb4159ae0db7483d206673638390b1c36eb10745156fae672b0e4bf330696d6e82aae8077cc920254960f251b82a3e2de7434bcc253e2905434f12d0fc71cbe503405bf4e11a6ec18b4cfaab599d2d17ac65255c5b21d24729e8150347e5c68faf96e3ff1dcf353b49bcaefa858386ecc9198dcedc85f40bdd5b4cf7a9430b04a62fe41eec52da2ca7df00d70bb8a31192954a5e3ad47dc167ff839ff6d415daec27df2193e2ae0bcc2bd54f041042d346529279ef9511a0729caae10dbbdcf3d2547d176f8f19db0b5a18ff93bcb9635ca3e28aaab184667f7b6929a3decad194dc200bbfbf7f88ebf736fecec552098e04ec7efc97c01c4b18c0a4e0f9d4dab0b0f8da7ec1fecfda851cbe049002f5394ec1a04d5c6163efcfd5a87c2969dbe18c21dc51e2375489ec8be1483c261624477da33088adff3f494d2682bcb5dd2ff81fde53d7e15d92383a1ff4745eaf3660b499cf5ca7df3b4c76d99300d82c807eeff7a49e80e46b6edbf78d97b958c77ee002f9662c29b25da466c360c3002bffbb5b4a61d73f0907ffc29de80ba1b41d09c3352adcaa453c3f440a3c25c102218c566bd5e75aef7820ecacc8cfa2f489d7ac2700b371bef4af70bfb0cbb2ea35eec6a08351778008048d960c8c2bf09923e577120d0480cae67019434a66659042b7bf34bfaf62791bf126e720563f99d5d174e4ec9cb9ed5f381bcebfc238576e07321c5f30dc7356b4fdd09ccca367f9adaf5376e6bf32a53a8531589aabb85a393ddfce45b0bd153b4d4b785f03a9040b920eb2cb31ecc1f11d5a4d8a48ab0f5139a4e0fe366954088355624cf8356c117e13b4481e05d4718240732af18f0fc250179ac845afaff96944c346dd88c405675206acf3b7620b60fb063c02b0865dcb1a8b768aa5af5d90018eaa4377cce19a73671a8f1bd8fc3468ce0ee10f12ebdda4eb68f640e799e23853d127287ee8773d1d1142047c67d272587f39d889f47b5d3bfc2e6dee35f4459c95cb7704ca4c958e2ed3cdffadd0a210325ad4b80f38513eb5e481a2f129bd55ddfbafee7c8b3df526aee61911c53bc20c7e1fbb68b422efb8c88f3c63495da10615cbd15e9c43bcd2cc8655646fd9c46f20217e693dc82e8241d83139f73e94b43d8e4205ebc1464dc019e6b81a181c0d3b24b4c4cb11979ec267ea90b76f63db8e35290be9fac02c16f60d3501572f12fcf00febd37ce38ecd3bc4d9018436ac79b2305c1e"}) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0xfc}, 0x2) 14:43:16 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="ac08"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:16 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x800, &(0x7f0000000180)={[{@nfs_export_off}, {@xino_off}, {@workdir={'workdir', 0x3d, './file0'}}], [{@subj_type={'subj_type', 0x3d, '{%]@}'}}, {@fsuuid={'fsuuid', 0x3d, {[0x34, 0x36, 0x34, 0x64, 0x37, 0x35, 0x34, 0x63], 0x2d, [0x64, 0x32, 0x32, 0x30], 0x2d, [0x31, 0x64, 0x62, 0x61], 0x2d, [0x62, 0x61, 0x62, 0x39], 0x2d, [0x66, 0x33, 0x62, 0x62, 0x30, 0x34, 0x35, 0x33]}}}, {@fsuuid={'fsuuid', 0x3d, {[0x37, 0x63, 0x37, 0x36, 0x58, 0x35, 0x66, 0x32], 0x2d, [0x32, 0x61, 0x37, 0x61], 0x2d, [0x63, 0x31, 0x33, 0x63], 0x2d, [0x36, 0x38, 0x63, 0x30], 0x2d, [0x36, 0x34, 0x66, 0x66, 0x65, 0x64, 0x65, 0x38]}}}, {@uid_lt={'uid<', r1}}, {@appraise_type}, {@smackfsdef={'smackfsdef', 0x3d, '-@:'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1667.616439][T16440] fuse: Unknown parameter 'fN' [ 1667.631698][T16441] fuse: Bad value for 'fd' [ 1667.642423][T16440] fuse: Unknown parameter 'fN' [ 1667.649134][T16441] fuse: Bad value for 'fd' [ 1667.659947][T16440] fuse: Unknown parameter 'fN' [ 1667.678548][T16441] fuse: Bad value for 'fd' [ 1667.693826][T16440] fuse: Unknown parameter 'fN' [ 1667.714059][T16441] fuse: Bad value for 'fd' [ 1667.721830][T16466] fuse: Bad value for 'fd' 14:43:16 executing program 0: fsopen(0x0, 0x0) [ 1667.726347][T16440] fuse: Unknown parameter 'fN' [ 1667.728492][T16440] fuse: Unknown parameter 'fN' [ 1667.744314][T16468] fuse: Bad value for 'user_id' [ 1667.752238][T16441] fuse: Bad value for 'fd' [ 1667.759457][T16441] fuse: Bad value for 'fd' [ 1667.764549][T16468] overlay: Unknown parameter '\' [ 1667.770851][T16440] fuse: Unknown parameter 'fN' [ 1667.777374][T16441] fuse: Bad value for 'fd' [ 1667.790326][T16440] fuse: Unknown parameter 'fN' [ 1667.797339][T16441] fuse: Bad value for 'fd' [ 1667.808634][T16440] fuse: Unknown parameter 'fN' [ 1667.811719][T16441] fuse: Bad value for 'fd' [ 1667.822699][T16440] fuse: Unknown parameter 'fN' [ 1667.822704][T16441] fuse: Bad value for 'fd' [ 1667.823000][T16441] fuse: Bad value for 'fd' [ 1667.835954][T16440] fuse: Unknown parameter 'fN' [ 1667.848954][T16440] fuse: Unknown parameter 'fN' [ 1667.851619][T16441] fuse: Bad value for 'fd' [ 1667.858045][T16440] fuse: Unknown parameter 'fN' [ 1667.864488][T16440] fuse: Unknown parameter 'fN' [ 1667.871122][T16440] fuse: Unknown parameter 'fN' [ 1667.876855][T16440] fuse: Unknown parameter 'fN' [ 1667.881614][T16441] fuse: Bad value for 'fd' [ 1667.881890][T16441] fuse: Bad value for 'fd' [ 1667.887726][T16440] fuse: Unknown parameter 'fN' [ 1667.894154][T16441] fuse: Bad value for 'fd' [ 1667.896313][T16440] fuse: Unknown parameter 'fN' [ 1667.906005][T16441] fuse: Bad value for 'fd' [ 1667.908186][T16440] fuse: Unknown parameter 'fN' [ 1667.911900][T16441] fuse: Bad value for 'fd' [ 1667.918380][T16440] fuse: Unknown parameter 'fN' [ 1667.923589][T16441] fuse: Bad value for 'fd' [ 1667.932373][T16441] fuse: Bad value for 'fd' [ 1667.935620][T16440] fuse: Unknown parameter 'fN' [ 1667.937718][T16441] fuse: Bad value for 'fd' [ 1667.942083][T16440] fuse: Unknown parameter 'fN' [ 1667.946791][T16441] fuse: Bad value for 'fd' [ 1667.952353][T16440] fuse: Unknown parameter 'fN' [ 1667.956300][T16441] fuse: Bad value for 'fd' [ 1667.965687][T16441] fuse: Bad value for 'fd' [ 1667.967919][T16440] fuse: Unknown parameter 'fN' [ 1667.970672][T16441] fuse: Bad value for 'fd' [ 1667.975143][T16440] fuse: Unknown parameter 'fN' [ 1667.980258][T16441] fuse: Bad value for 'fd' [ 1667.984756][T16440] fuse: Unknown parameter 'fN' [ 1667.989527][T16441] fuse: Bad value for 'fd' [ 1668.000105][T16441] fuse: Bad value for 'fd' [ 1668.000104][T16440] fuse: Unknown parameter 'fN' [ 1668.000406][T16441] fuse: Bad value for 'fd' [ 1668.004978][T16440] fuse: Unknown parameter 'fN' [ 1668.012220][T16441] fuse: Bad value for 'fd' [ 1668.027799][T16441] fuse: Bad value for 'fd' [ 1668.032890][T16441] fuse: Bad value for 'fd' [ 1668.033446][T16440] fuse: Unknown parameter 'fN' [ 1668.038094][T16441] fuse: Bad value for 'fd' [ 1668.042622][T16440] fuse: Unknown parameter 'fN' [ 1668.047357][T16441] fuse: Bad value for 'fd' [ 1668.056996][T16441] fuse: Bad value for 'fd' [ 1668.058491][T16440] fuse: Unknown parameter 'fN' [ 1668.061996][T16441] fuse: Bad value for 'fd' [ 1668.071495][T16441] fuse: Bad value for 'fd' [ 1668.071648][T16440] fuse: Unknown parameter 'fN' [ 1668.076729][T16441] fuse: Bad value for 'fd' [ 1668.081283][T16440] fuse: Unknown parameter 'fN' [ 1668.086001][T16441] fuse: Bad value for 'fd' [ 1668.096073][T16441] fuse: Bad value for 'fd' [ 1668.102158][T16441] fuse: Bad value for 'fd' [ 1668.103255][T16440] fuse: Unknown parameter 'fN' [ 1668.108321][T16441] fuse: Bad value for 'fd' [ 1668.112046][T16440] fuse: Unknown parameter 'fN' [ 1668.117615][T16441] fuse: Bad value for 'fd' [ 1668.127275][T16440] fuse: Unknown parameter 'fN' [ 1668.127342][T16441] fuse: Bad value for 'fd' [ 1668.132334][T16440] fuse: Unknown parameter 'fN' [ 1668.142645][T16441] fuse: Bad value for 'fd' [ 1668.147972][T16441] fuse: Bad value for 'fd' [ 1668.148676][T16440] fuse: Unknown parameter 'fN' [ 1668.152906][T16441] fuse: Bad value for 'fd' [ 1668.162101][T16440] fuse: Unknown parameter 'fN' [ 1668.162451][T16441] fuse: Bad value for 'fd' [ 1668.170119][T16440] fuse: Unknown parameter 'fN' [ 1668.173170][T16441] fuse: Bad value for 'fd' [ 1668.181665][T16441] fuse: Bad value for 'fd' [ 1668.184022][T16440] fuse: Unknown parameter 'fN' [ 1668.186808][T16441] fuse: Bad value for 'fd' [ 1668.191393][T16440] fuse: Unknown parameter 'fN' [ 1668.196088][T16441] fuse: Bad value for 'fd' [ 1668.205824][T16441] fuse: Bad value for 'fd' [ 1668.207841][T16440] fuse: Unknown parameter 'fN' [ 1668.210753][T16441] fuse: Bad value for 'fd' [ 1668.215337][T16440] fuse: Unknown parameter 'fN' [ 1668.222014][T16441] fuse: Bad value for 'fd' [ 1668.230496][T16441] fuse: Bad value for 'fd' [ 1668.233813][T16440] fuse: Unknown parameter 'fN' [ 1668.235685][T16441] fuse: Bad value for 'fd' [ 1668.240254][T16440] fuse: Unknown parameter 'fN' [ 1668.245138][T16441] fuse: Bad value for 'fd' [ 1668.254923][T16440] fuse: Unknown parameter 'fN' [ 1668.260191][T16440] fuse: Unknown parameter 'fN' [ 1668.261730][T16441] fuse: Bad value for 'fd' [ 1668.265532][T16440] fuse: Unknown parameter 'fN' [ 1668.270197][T16441] fuse: Bad value for 'fd' 14:43:17 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r4 = openat$cgroup_freezer_state(r0, &(0x7f0000000200), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0x68, 0x2}}, './file0\x00'}) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) write$vhost_msg_v2(r5, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000040)=""/91, 0x5b, &(0x7f00000000c0)=""/149, 0x2, 0x3}}, 0x48) 14:43:17 executing program 4: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000000)=[{}, {}, {}, {}], 0x4, &(0x7f00000000c0)={r0, r1+60000000}, &(0x7f0000000100)={[0x3]}, 0xffffffffffffffdb) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000010000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB="2c6d61785f726561643d3078303030303030303030303030653730342c64656661756c745f706572b0697359696f6e732c64656661756c745f7065726d697373696f6e732c616c6c6f775f6f746865722c666d776e65723e", @ANYRESDEC, @ANYBLOB=',rootcontext=unconfined_u,sync,permit_directio,\x00'], 0x0, 0x0, &(0x7f00000002c0)) (async) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000010000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB="2c6d61785f726561643d3078303030303030303030303030653730342c64656661756c745f706572b0697359696f6e732c64656661756c745f7065726d697373696f6e732c616c6c6f775f6f746865722c666d776e65723e", @ANYRESDEC, @ANYBLOB=',rootcontext=unconfined_u,sync,permit_directio,\x00'], 0x0, 0x0, &(0x7f00000002c0)) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r2, 0x0, 0x0) 14:43:17 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="ac08"], 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="ac08"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:17 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x800, &(0x7f0000000180)={[{@nfs_export_off}, {@xino_off}, {@workdir={'workdir', 0x3d, './file0'}}], [{@subj_type={'subj_type', 0x3d, '{%]@}'}}, {@fsuuid={'fsuuid', 0x3d, {[0x34, 0x36, 0x34, 0x64, 0x37, 0x35, 0x34, 0x63], 0x2d, [0x64, 0x32, 0x32, 0x30], 0x2d, [0x31, 0x64, 0x62, 0x61], 0x2d, [0x62, 0x61, 0x62, 0x39], 0x2d, [0x66, 0x33, 0x62, 0x62, 0x30, 0x34, 0x35, 0x33]}}}, {@fsuuid={'fsuuid', 0x3d, {[0x37, 0x63, 0x37, 0x36, 0x58, 0x35, 0x66, 0x32], 0x2d, [0x32, 0x61, 0x37, 0x61], 0x2d, [0x63, 0x31, 0x33, 0x63], 0x2d, [0x36, 0x38, 0x63, 0x30], 0x2d, [0x36, 0x34, 0x66, 0x66, 0x65, 0x64, 0x65, 0x38]}}}, {@uid_lt={'uid<', r1}}, {@appraise_type}, {@smackfsdef={'smackfsdef', 0x3d, '-@:'}}]}) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:17 executing program 0: fsopen(0x0, 0x0) 14:43:17 executing program 2: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fN=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',max_read=0x0000000000000000,blksize=0x0000000000000000,default_permissions,allow_other,default_permissions,\x00'], 0x0, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)={{}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {}, 0x2c, {[{@allow_other}], [{@uid_lt={'uid<', r1}}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)={{}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {}, 0x2c, {[{@allow_other}], [{@uid_lt={'uid<', r1}}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1668.274652][T16440] fuse: Unknown parameter 'fN' [ 1668.284218][T16440] fuse: Unknown parameter 'fN' [ 1668.285996][T16441] fuse: Bad value for 'fd' [ 1668.290416][T16440] fuse: Unknown parameter 'fN' 14:43:17 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r4 = openat$cgroup_freezer_state(r0, &(0x7f0000000200), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0x68, 0x2}}, './file0\x00'}) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) write$vhost_msg_v2(r5, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000040)=""/91, 0x5b, &(0x7f00000000c0)=""/149, 0x2, 0x3}}, 0x48) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) openat$cgroup_freezer_state(r0, &(0x7f0000000200), 0x2, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0x68, 0x2}}, './file0\x00'}) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) (async) write$vhost_msg_v2(r5, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000040)=""/91, 0x5b, &(0x7f00000000c0)=""/149, 0x2, 0x3}}, 0x48) (async) 14:43:17 executing program 0: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001380)='./cgroup/syz1\x00', 0x200002, 0x0) r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r3 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000280), 0x200, 0x0) mknodat(r3, &(0x7f0000001340)='./file0\x00', 0x1, 0x401) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0/../file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) [ 1668.376713][T16478] fuse: Unknown parameter 'fN' [ 1668.398319][T16483] overlay: Unknown parameter '\' [ 1668.399380][T16481] fuse: Bad value for 'fd' [ 1668.410485][T16478] fuse: Bad value for 'fd' [ 1668.432537][T16485] fuse: Bad value for 'fd' [ 1668.439084][T16482] fuse: Bad value for 'fd' 14:43:17 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="ac08"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1668.468558][T16488] fuse: Bad value for 'fd' 14:43:17 executing program 0: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f00000000c0)='.log\x00', 0x241, 0x82) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r0, 0xc018937a, &(0x7f0000000080)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) openat$incfs(r0, &(0x7f0000000000)='.log\x00', 0x40000, 0xc0) 14:43:17 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001b80)=ANY=[@ANYBLOB="000f00000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000000100000000000000000000fff5006ee25bd64a0db42886912b820ac9b32d67f338c3acd88954ceb05eb6929e95ba6525e19611f3076ade676ca4bd8287ea40f06643ea30104a67523c2ded30c14faafaa52276c5373cd4011f42d5272f7ca61a50e0f49a05ef1ffb02b47a1fb96b6594d714a9131463895a2fbdc4205857c0833bba248ada57c61ce4018526cd04c2582e5117fcb3d1652d0592816fca2d693cb84eb98e1404411a5a70b9d604e7206caf88d6ef3f3b5f4136d7fb8bfd88401efbe54473584ea27f3931caec63b0339a7f44d6fcc0fe6366bb2fccf2676376e1eda8894da1fcdfcd3f6d22e3444db4a00e6b853734e736f4261f133cec6648181a4d2a95310fad68b66242290f8c1f4439c90e849ea0e272dc4dcc65533713ee398ad38f88346bc6"]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x400}}], [{@obj_user={'obj_user', 0x3d, '`K\x84(M'}}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000001380)={0x0, 0x7}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000001780)={r2, 0x1}) 14:43:17 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x800, &(0x7f0000000180)={[{@nfs_export_off}, {@xino_off}, {@workdir={'workdir', 0x3d, './file0'}}], [{@subj_type={'subj_type', 0x3d, '{%]@}'}}, {@fsuuid={'fsuuid', 0x3d, {[0x34, 0x36, 0x34, 0x64, 0x37, 0x35, 0x34, 0x63], 0x2d, [0x64, 0x32, 0x32, 0x30], 0x2d, [0x31, 0x64, 0x62, 0x61], 0x2d, [0x62, 0x61, 0x62, 0x39], 0x2d, [0x66, 0x33, 0x62, 0x62, 0x30, 0x34, 0x35, 0x33]}}}, {@fsuuid={'fsuuid', 0x3d, {[0x37, 0x63, 0x37, 0x36, 0x58, 0x35, 0x66, 0x32], 0x2d, [0x32, 0x61, 0x37, 0x61], 0x2d, [0x63, 0x31, 0x33, 0x63], 0x2d, [0x36, 0x38, 0x63, 0x30], 0x2d, [0x36, 0x34, 0x66, 0x66, 0x65, 0x64, 0x65, 0x38]}}}, {@uid_lt={'uid<', r1}}, {@appraise_type}, {@smackfsdef={'smackfsdef', 0x3d, '-@:'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:17 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r4 = openat$cgroup_freezer_state(r0, &(0x7f0000000200), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0x68, 0x2}}, './file0\x00'}) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) write$vhost_msg_v2(r5, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000040)=""/91, 0x5b, &(0x7f00000000c0)=""/149, 0x2, 0x3}}, 0x48) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) openat$cgroup_freezer_state(r0, &(0x7f0000000200), 0x2, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0x68, 0x2}}, './file0\x00'}) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) (async) write$vhost_msg_v2(r5, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000040)=""/91, 0x5b, &(0x7f00000000c0)=""/149, 0x2, 0x3}}, 0x48) (async) [ 1668.560204][T16497] fuse: Bad value for 'fd' [ 1668.634016][T16504] fuse: Bad value for 'user_id' [ 1668.648909][T16506] fuse: Bad value for 'user_id' [ 1668.661135][T16504] overlay: Unknown parameter '\' [ 1668.665069][T16506] overlay: Unknown parameter '\' [ 1668.683550][T16501] fuse: Bad value for 'fd' [ 1669.208845][ T1237] ieee802154 phy0 wpan0: encryption failed: -22 [ 1669.215320][ T1237] ieee802154 phy1 wpan1: encryption failed: -22 14:43:18 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x8001, 0x0) 14:43:18 executing program 4: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) epoll_pwait2(0xffffffffffffffff, &(0x7f0000000000)=[{}, {}, {}, {}], 0x4, &(0x7f00000000c0)={r0, r1+60000000}, &(0x7f0000000100)={[0x3]}, 0xffffffffffffffdb) syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000010000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB="2c6d61785f726561643d3078303030303030303030303030653730342c64656661756c745f706572b0697359696f6e732c64656661756c745f7065726d697373696f6e732c616c6c6f775f6f746865722c666d776e65723e", @ANYRESDEC, @ANYBLOB=',rootcontext=unconfined_u,sync,permit_directio,\x00'], 0x0, 0x0, &(0x7f00000002c0)) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r2, 0x0, 0x0) (async) read$ptp(r2, 0x0, 0x0) 14:43:18 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) openat$userio(0xffffffffffffff9c, &(0x7f0000001400), 0x6402, 0x0) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x400000007, 0x0, {0x19, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4}, 0xc) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x100000, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0xfc, 0x0, 0x0) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0xa, @unused=[0x9, 0x401, 0x0, 0x81], @subvolid=0x1}) fchownat(r4, &(0x7f0000000280)='./file0\x00', r2, r3, 0x800) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001380)='./binderfs2/custom0\x00', 0x800, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f00000013c0)={{0x1, 0x1, 0x18, r6, {0x7, 0x4}}, './file0\x00'}) 14:43:18 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$damon_attrs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x3) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:18 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) mount$nfs(&(0x7f0000000080)=')\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x80000, &(0x7f00000001c0)={[{'overlay\x00'}, {'overlay\x00'}], [{@audit}, {@fowner_gt={'fowner>', r1}}, {@hash}]}) 14:43:18 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001b80)=ANY=[@ANYBLOB="000f00000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000000100000000000000000000fff5006ee25bd64a0db42886912b820ac9b32d67f338c3acd88954ceb05eb6929e95ba6525e19611f3076ade676ca4bd8287ea40f06643ea30104a67523c2ded30c14faafaa52276c5373cd4011f42d5272f7ca61a50e0f49a05ef1ffb02b47a1fb96b6594d714a9131463895a2fbdc4205857c0833bba248ada57c61ce4018526cd04c2582e5117fcb3d1652d0592816fca2d693cb84eb98e1404411a5a70b9d604e7206caf88d6ef3f3b5f4136d7fb8bfd88401efbe54473584ea27f3931caec63b0339a7f44d6fcc0fe6366bb2fccf2676376e1eda8894da1fcdfcd3f6d22e3444db4a00e6b853734e736f4261f133cec6648181a4d2a95310fad68b66242290f8c1f4439c90e849ea0e272dc4dcc65533713ee398ad38f88346bc6"]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x400}}], [{@obj_user={'obj_user', 0x3d, '`K\x84(M'}}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000001380)={0x0, 0x7}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000001780)={r2, 0x1}) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001b80)=ANY=[@ANYBLOB="000f00000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000000100000000000000000000fff5006ee25bd64a0db42886912b820ac9b32d67f338c3acd88954ceb05eb6929e95ba6525e19611f3076ade676ca4bd8287ea40f06643ea30104a67523c2ded30c14faafaa52276c5373cd4011f42d5272f7ca61a50e0f49a05ef1ffb02b47a1fb96b6594d714a9131463895a2fbdc4205857c0833bba248ada57c61ce4018526cd04c2582e5117fcb3d1652d0592816fca2d693cb84eb98e1404411a5a70b9d604e7206caf88d6ef3f3b5f4136d7fb8bfd88401efbe54473584ea27f3931caec63b0339a7f44d6fcc0fe6366bb2fccf2676376e1eda8894da1fcdfcd3f6d22e3444db4a00e6b853734e736f4261f133cec6648181a4d2a95310fad68b66242290f8c1f4439c90e849ea0e272dc4dcc65533713ee398ad38f88346bc6"]}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x400}}], [{@obj_user={'obj_user', 0x3d, '`K\x84(M'}}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000001380)={0x0, 0x7}) (async) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000001780)={r2, 0x1}) (async) 14:43:18 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x8001, 0x0) [ 1669.348595][T16516] overlay: Unknown parameter '\' 14:43:18 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) openat$userio(0xffffffffffffff9c, &(0x7f0000001400), 0x6402, 0x0) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x400000007, 0x0, {0x19, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4}, 0xc) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x100000, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0xfc, 0x0, 0x0) (async) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0xa, @unused=[0x9, 0x401, 0x0, 0x81], @subvolid=0x1}) (async) fchownat(r4, &(0x7f0000000280)='./file0\x00', r2, r3, 0x800) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001380)='./binderfs2/custom0\x00', 0x800, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f00000013c0)={{0x1, 0x1, 0x18, r6, {0x7, 0x4}}, './file0\x00'}) 14:43:18 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x8001, 0x0) [ 1669.373066][T16519] fuse: Bad value for 'fd' [ 1669.378098][T16518] overlay: Unknown parameter '\' [ 1669.385421][T16516] fuse: Bad value for 'user_id' 14:43:18 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async, rerun: 32) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (rerun: 32) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) mount$nfs(&(0x7f0000000080)=')\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x80000, &(0x7f00000001c0)={[{'overlay\x00'}, {'overlay\x00'}], [{@audit}, {@fowner_gt={'fowner>', r1}}, {@hash}]}) 14:43:18 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$damon_attrs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x3) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:18 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) msync(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001b80)=ANY=[@ANYBLOB="000f00000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000000100000000000000000000fff5006ee25bd64a0db42886912b820ac9b32d67f338c3acd88954ceb05eb6929e95ba6525e19611f3076ade676ca4bd8287ea40f06643ea30104a67523c2ded30c14faafaa52276c5373cd4011f42d5272f7ca61a50e0f49a05ef1ffb02b47a1fb96b6594d714a9131463895a2fbdc4205857c0833bba248ada57c61ce4018526cd04c2582e5117fcb3d1652d0592816fca2d693cb84eb98e1404411a5a70b9d604e7206caf88d6ef3f3b5f4136d7fb8bfd88401efbe54473584ea27f3931caec63b0339a7f44d6fcc0fe6366bb2fccf2676376e1eda8894da1fcdfcd3f6d22e3444db4a00e6b853734e736f4261f133cec6648181a4d2a95310fad68b66242290f8c1f4439c90e849ea0e272dc4dcc65533713ee398ad38f88346bc6"]}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r1}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x400}}], [{@obj_user={'obj_user', 0x3d, '`K\x84(M'}}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000001380)={0x0, 0x7}) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000001780)={r2, 0x1}) [ 1669.428845][T16519] fuse: Bad value for 'fd' [ 1669.511169][T16533] overlay: Unknown parameter '\' [ 1669.537513][T16538] overlay: Unknown parameter '\' [ 1669.538620][T16537] fuse: Bad value for 'fd' [ 1669.551086][T16533] overlay: Unknown parameter '\' 14:43:19 executing program 4: read$ptp(0xffffffffffffffff, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @unused=[0x7, 0x8001, 0x20, 0x7], @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {r1}}, './file0\x00'}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r3, 0x50009417, &(0x7f0000001380)={{r4}, 0x0, 0x4, @unused=[0xfffffffffffffffa, 0x200, 0x2, 0x9], @subvolid=0x3}) r5 = fspick(r2, &(0x7f0000000000)='./file0\x00', 0x1) fsconfig$FSCONFIG_SET_FD(r5, 0x5, &(0x7f0000000100)='})\x00', 0x0, r0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000062ba09a27fb481256d9477a877081a0100170018000000880a269645c680198eef487bbf644d90fc77be9afb72e73e26395939eb2b71d4f2aa7c681668f4696591a90708895896e11de6b50b3903fd7f35c96241e2621a45be00356ceda3d1a6e919f6afee264cd1203eefdc8a3fd117867595c94f3f7be788b1e3a70fda4500"/142, @ANYRES32, @ANYBLOB="ffffffff000000002e2f66696c653000"]) 14:43:19 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000001040)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) fstat(r2, &(0x7f00000010c0)) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000040)={{r1}, 0x0, 0x2, @unused=[0xffffffffffffffff, 0x0, 0x9, 0x1], @name="919d2aaf13d7f6682a2f93ecbcf4461778d00cf4ec0d6393318ab06c0cb0e09dbfb8563e84e2cc28461e4c070eb89be9d801c5ee42e67c4b81ae30d48b40ffc8325389c03ac073756116037720f7f1632161e32b7a602aa2f10bc1e20f7ef77280982b5a4e1c7e09fc6e6a47f942b37ba1c7a95662a11aced152c8aa28e3fb306e73fcafef7ba1a540a30b9486cf8a3fba10bd799348dbbc0f998063c8bb57aff3c210ebcf5ab9163000a5abc63cb5d178da25ea62ab23b3569631fa97b9391f308d1445319cb5983403f054eb1f01027236173b5e7807c9d03572757df81af330454cb672debbda87817b72b9c5314187d1c0fa4d145981f541cc2e054e7871b05f66870ed4dbc9cfefdfb5d9f2b04d2082e8bcef7ec4082e5dad9acd1ffbc9ecd0b5bd9dd5c01345c498dfed6dd02c6465789653ff3c18bb4bd4cc1625fbff3d6ae05d39f8a0534b6a0f12a3f36b264e17468a4e11989aed51f3f8f781dac5fb92f2c77f13251110c7f1422081c01c64add03f27c23fc524405ae8c09a481d52fd7cab27e0cac1a4a42f326fc80e2239fb0139f406b4ecc3445596bcf3a06a47ca30e9e05f8ea44ca17df871ebd287eddcafe24eade69962fb008d00b3cc8ef0302c40bf2544b1803352c17923d69a43b1369131815ca2fc67fbda155c5a4fbd7209277ab148c7eb38f0134276b1f3a517a1511f45c274eefc9c856ea42f788901fde5c7de090e8d500d22cc7f7ca73ebbd8f862518766e3686bb58fddc5632b60cd0b51c2895e6837f7f0c77fb409c96767477a9232e49c5de750d27cd2701bb64e0e56b5df88c93ff5d7078fe2f5395ef72fe885336f78c7b7e6214d3cfdc479c65a61457ac3c9813db0ed3e9952950887dfd4e3a6579cc034fef2011f7fd4baec5521f3eb85e3704868a05c83211f18ebbe91a32c4c70d579bb726e904175c3bc3bfa687c1602c6bb768eae57c2cb2bf6ab4a0a017fb00e848c76695d531f1936fdffccb6e308cd43facfb32e6d569a868ee2d9f3150448dd7aa47553450d4060260dd2269c4608fc81a99f9c15607beb9c70566d58616c9cb9ce9a25a4b6b60270acd85cf37493a763c12376a753aeec5f90ea9260a5be4aa5dc059eac3453010a9417e9bb6ad3bc56d591df379a429c2c84588b5994daac74e8e272e54f151eda25366cb96518cfa01504be5942dcb19b23af37d5c9956dfb257f019254a0e60504c44e035f587d91d8d29b5c7fac35b6d8264da820761b0acfe90785234ac524b495f6ec1b34a0226bc32d83e54c5140545d0ca6d0b73d5f8e9c5bc18b007524b632f777b680e71dafdd94df58bc4d0b4c92036a67f6bfb3f768735354bef275be6f1c1147a151a40e3785c100f0595dc03e92db2362b6049417d1806ad245ad6fac9b98ba347b4d43b3978d410f79552dc1bfeae19c9fb9754909e4df9165ccfbfefbbaf9de650ea4a02213816599501e9372bfef7520a7168db167d77fefab85d49c1294f780c4c8b2a0e15e6ae4338bf1bae62266add1b330e09da9a36a17ddcc20779284edefea9ad518fcf0673d20e8ab5bb5019d3e45447c485b3fc2797a2dbec425d7b83a7aa126404e2c9848568b2b316cca0e0c6e9e36c6bd4db887786185b5df1767e38983f3d0ed8b9240b7e779934a0284729e3d33483a335ba7f634e6d5e5c68e45ee7091952082305ea9eaa2703f6e66096aecdb58581f16ae50c756cceba4a6acf290bb085bdb9dc75865c6b8d17ba044a52db7597bed467a51abc4764c6ccb56601839f0995590d7519bf80b6d33f0edbbd4f40d50fd4a74bda9d7c2b19d122d67cd0cd50fd53cafd6fc7dacc97d6bdc7701f4412cb762981dd5767a8c326ff05a44fb08015e0dd18478eaa15b727225391cf8ad21be90f106b28d00ef1fe857714f454118953fda6e4b2481e42f3dbb89103f8bcfff6113167cdb20ee5c655f61bbebcff7479f52630d8d6383707c943f194e5b9350362d60404795052821e39d4dd5d00959793cdf04bb19908c8c50c5fc6842e60b65b87724a0dfab1aa39a765d977625ebcf7f572d0aaf6a53c1b4c4ef03e63606883422f8ee01c8bcff3fdc06495a058dd5efd49d6f764307af7696f916df532100525c4f51e2ed729d0b07d3b09ca6cd2d9ad85d51952e8acb59f3bcdac4f10e79470a4813ae8b54509fcb50b34cca9e089707c0143fb870510a96da206094024afb1ef30ec54e1a227a13fcc2f432851523d7b0b09add423604082bc565da460b7c7e2011a4d5d6bfb5d8d1aa39bc9b14bdb3c59c6f9d8ed85da17a3324d27d613bd869061e60493de15cab24c0f1685080a7883bca950f037bed1323c34ee6f22427001f215b04344547dffaacc57783c21f1b266afcb2fad4137eeb7f7373715708007b4e9d7d7b77ea9b1565334d4985a0227f55e14958e9def3a5f2b6e7654aac15f22f87238d3b56eb2f5212cf4fdfc04d295acbd6c96ddd12cc06a8bd154e5159534f8eabea39fa89ca036ae561b739d6e29ce572e53c493b1cead0017523cebf33375bbdcfb9c98551fa47216c2332acb8531cf25ebb8ca6a90b6ce04d595e5d8dffe45f1d439b51e37c3c32caa360e5abe041ee5ec8a7ca563ee2780067ce9b26fd06a899961c411c5ebb6b1d5c18762b7ed8c5c47b89cddefb36070fd2678b884d0cafbb3f2aad5043fa0f2d38385615cf9bcc25b4e250ed507854016e551e03c7fd05ff5dc0e91b24215cb8779d11a17b93ce296d623f8d1c6b56698974ad1c1589e40a6b2358c00414b34ddfa32d81607ddb3905882a27e46595615f027b426eb246a8b9a5cac29c39553ac8573979759f03b7cd54a546c2a249fcaf1f07e32e82ecba67bbb3e2d56022faf5530d73e3db1bfbaf3662ccb10fd09dd8dbdab58db6880c5b9ae1b141d6a080cc50d86f9e8b1d7193a9cd6b8800cf568f1b20ad800f1c313ac1d501af9942d021f7ced4d10793d5b33cb131369d3d8526f2b2c79952dff9669b5867fc0b0f13d9c520315487d2018c52f6050d6d35b328a52c25b7d3296590cc3c1aa8993f9f17937cca41bd5dba51194b0ee446440b4b2b461c64eabe4638b1a44520d68d77d81e06b8e00a330a0789854ff66b2dd93697aeb677515383023e0c784ab880141d4f101cb9a46142abe6577d938176ee2648a94be2a9babc96b1acea184cb61509e73d46d87db5c196cdc88e11832c7a61c9775bd57ad449ffad4f510c3a250b1bcb4671dfe17dc1cde6a6325648d17a03f5cf5b11615792e54b4bc8fffe58563efb5b2f96d70e72eb4f3fd468293bea2de24308f6c11959c77fd91f7e5750af17dc457a7957d98a0f4c8edcaa6dae90227b4a1d627cf1cdcf3c07b59b1bfff5befdd54ead0b371b43a2b74338fe8133e299f8578c12568bcb12a4f04d2fda58e5d45d7f42a931e5f23775488689e698fe74217cafa0dba155a3fcc74a1610e86b31d7275d524986ee0308e32899d7f545744503bf88a3ca2648a5e40a628989f1adc32d8f3d16ce0dcf1d07af52c8527ca8d75e29695fa06d58379a77a2afae277c5e79e7aecf6f9fe79ffd626c4d246b27ea0543dd7d13817fe9edaf6d3ba317736af2efa3a442ab3e3a6cbd62a4af7fc8e75cfac4ebe8e426a6aa460a96b01d30772fd8ec9b5d1b0f722f2e9560b758b93dc9e2dd80c817b611dc0ebd630442675cb8a8fa79e6ae6cc59cc2c753ffcf1ebf74fd66114045c22f643ccc67a3e32fef2ef97e78a1033208b8c46bb9d8d199b36305351893b62453f91ad87f4d84bb0896e3aa83ea35987e2cf11d8669740682de8f5edb6ba7c73925e1c8590890cc48f28343768ede07d43365889c37db1ef9707a3c4caf22476a04ee37adb1ba65a59a8a9189301d1c4eb3514015b12f1ed27a00b9a2a69a4aeac6a1eff1dfe6f873191b8623b1bab9661be0bcadfad96e98c263a6f40721442dc0d3f0e3264371e0cb0f77e7859c07cedf58dc46723bc62ae1444327a680b8b785243d77c2fe90e5a0005b0696cf3ca43a2cbcf8bcf9c77c59d993a9320ec7fa8a7ce4aa699f96001546979f1696df44235f3a38c5cdb9c231327c437893fdbed1d6e8d36fcb16909f567a28df27ecf486ac0e476a98b28a009051115eec4efb08b71cc2f7d32cc94a3a14a703e2f5f9bc2256c3ac30c7c3fe58fc034b690eb8fc8441cc9d46ba80fc3668e9eab835a3e3928f597c84dbeaab6f741045cbe5bc704e647d5a34b06da67bb1588f51d98aa2036f6b8f4ab2bd32ace11d5543c20d9ce22c98fb858d9e1523319f95de1092704f8788ef53077422b9f7287955b780b132f1a4192cb095f615ac2ce30b29275559abe5299a88749f53b3420ece41ebd942e1663820fef3ba1e5a1134769ebf67d7ed90f36bd6ee0e0a60fc73ef06d61bdcdb6a203958406407a8034919adc45df6ca0815908a9b43f3c4aa20967fccf4909bde503938acb2d5d7bfeeb7ce6a7c347b975238b2728a6342630c06cd973b9043bf649b0fe263ed2bae2c6d5e7e299d18d41ab110f5ab27badcbfb9f4d2077a865b05138c806cf8d1e3b1b82faa7ac4d8419cbc062e7e6347a92fade899dfb0f9333cab7309e429e8151478d49e81dc083c4ef3e81372dc93450eb4a5d3a57b83bdef4a5349a0dc30cc53edc1efffb969950d01076b2d74ff9d465c17357338a98f18bc9bfaf7662f8506802aeae639ce287f3725200f32615b4f2a752e168d065d9f8e3f22fe31dce35f2b1cf53d1957929657f378f474c101ac7f60646056c9cc76ecdeef0a952d12b62d5522b7d88ad6448ed11ba30afcb0248d476d984ddaf04b877055abbbdb494728645f25d1d70e1916641af0f6fc7d40a76e538eb9ac3d96e31e5373e66ad93348aa08c4f88900b82c1869bbf7965ebdf368e8fa0d488174b1b1253c42c6d1739efe173242b24c29bfd6beb3e93c4976ae7701816297470cb24ca585f98b26d11ba26e46eef764cbef36749a353a46026373dc559e9e000f7abc324d8684972804ad61f6fc3e2feeb60e51a29ddf7b3661a5bd73418606dcc78204a1965dea557cfffac703922513f3a6466a6c767551eb3d9a394ab6295d30a5cb9cc18af1ad28b5183186f896a8524c72cfe04e32262239b9d769b2531823f5089c251356dfbd11d1b3e8deb9207d6001a901bda6676dad0755a97da402f424c7305037e0bb4db59cc74333038ad4fb10a85efde91789143ea10638102e170a1e384a0831f4de66d62b7c49a0a86dd12c5dd4e3dec8391fc6e4a063a939106c7d7063fadf776bb7c5dfc4165e12fe4df51800ede767f26bf2a8cd200285616b89938aa82b014519f336fdf9e980bf25d709c75d972d9fb3defe8aad5cffdbd19a61c5e466b460e19d7a6d73b9b11f706759086343511cd6b5db7c5744437a377a4a73809034650c1f814b8322c2e2f60067e9408c973d15dfabc136cfd187fd8b7052818bed2589bf764187051d454317a7300799a552fc5a93b443e8e0fb9ced4effaca21fe711387241ffbf551f8f237c9bc359b2f6f3850a5d77f775bb775867d887c3279158944023d1fcdc281534fa91ac860a317bcb2acea1d392caf7fa4185425d14347e5157f998ce67218ffe92fa4bb4b05542c72cf448c08c875cdcc28be69a0b1e5cd79e6f76a7370b2c10876d131f6dbed84f13b9b462e58353f8b0f349340fcc5190c47fdc3919e97b5c7f90"}) 14:43:19 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) openat$userio(0xffffffffffffff9c, &(0x7f0000001400), 0x6402, 0x0) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x400000007, 0x0, {0x19, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000200)={0xa, 0x4}, 0xc) (async) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x100000, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{@allow_other}]}}, 0xfc, 0x0, 0x0) (async) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0xa, @unused=[0x9, 0x401, 0x0, 0x81], @subvolid=0x1}) (async) fchownat(r4, &(0x7f0000000280)='./file0\x00', r2, r3, 0x800) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000001380)='./binderfs2/custom0\x00', 0x800, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f00000013c0)={{0x1, 0x1, 0x18, r6, {0x7, 0x4}}, './file0\x00'}) 14:43:19 executing program 0: ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)=ANY=[@ANYBLOB="f2c74c5fb0d956417cc980144cd44dd385bfb522c7f45902e781e1213a6b090007051b7b9dd170f0fd7d31adec224710f177651ca351dc32a1e960", @ANYRES32=0xffffffffffffffff, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000140), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$cgroup_pressure(r0, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) fstat(r1, &(0x7f0000003880)) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000faffffffffffffff0000000700000000000000000009000000000029008020000000000008ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) openat$cgroup_freezer_state(r3, &(0x7f0000000100), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYRES32, @ANYBLOB="000000002e2f8755d4950e02ce132c66696c653000"]) 14:43:19 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1}}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x3}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x400}}, {}, {@blksize={'blksize', 0x3d, 0x1e00}}, {@default_permissions}, {@default_permissions}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000001380)='.log\x00', &(0x7f00000013c0)='.log\x00', 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fspick(r1, &(0x7f0000000040)='./file1\x00', 0x1) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000280)='%,\x00', 0x0, 0xffffffffffffffff) [ 1670.237121][T16572] fuse: Bad value for 'fd' 14:43:19 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1}}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x3}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x400}}, {}, {@blksize={'blksize', 0x3d, 0x1e00}}, {@default_permissions}, {@default_permissions}]}}, 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000001380)='.log\x00', &(0x7f00000013c0)='.log\x00', 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fspick(r1, &(0x7f0000000040)='./file1\x00', 0x1) (async) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000280)='%,\x00', 0x0, 0xffffffffffffffff) 14:43:19 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000001040)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) fstat(r2, &(0x7f00000010c0)) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000040)={{r1}, 0x0, 0x2, @unused=[0xffffffffffffffff, 0x0, 0x9, 0x1], @name="919d2aaf13d7f6682a2f93ecbcf4461778d00cf4ec0d6393318ab06c0cb0e09dbfb8563e84e2cc28461e4c070eb89be9d801c5ee42e67c4b81ae30d48b40ffc8325389c03ac073756116037720f7f1632161e32b7a602aa2f10bc1e20f7ef77280982b5a4e1c7e09fc6e6a47f942b37ba1c7a95662a11aced152c8aa28e3fb306e73fcafef7ba1a540a30b9486cf8a3fba10bd799348dbbc0f998063c8bb57aff3c210ebcf5ab9163000a5abc63cb5d178da25ea62ab23b3569631fa97b9391f308d1445319cb5983403f054eb1f01027236173b5e7807c9d03572757df81af330454cb672debbda87817b72b9c5314187d1c0fa4d145981f541cc2e054e7871b05f66870ed4dbc9cfefdfb5d9f2b04d2082e8bcef7ec4082e5dad9acd1ffbc9ecd0b5bd9dd5c01345c498dfed6dd02c6465789653ff3c18bb4bd4cc1625fbff3d6ae05d39f8a0534b6a0f12a3f36b264e17468a4e11989aed51f3f8f781dac5fb92f2c77f13251110c7f1422081c01c64add03f27c23fc524405ae8c09a481d52fd7cab27e0cac1a4a42f326fc80e2239fb0139f406b4ecc3445596bcf3a06a47ca30e9e05f8ea44ca17df871ebd287eddcafe24eade69962fb008d00b3cc8ef0302c40bf2544b1803352c17923d69a43b1369131815ca2fc67fbda155c5a4fbd7209277ab148c7eb38f0134276b1f3a517a1511f45c274eefc9c856ea42f788901fde5c7de090e8d500d22cc7f7ca73ebbd8f862518766e3686bb58fddc5632b60cd0b51c2895e6837f7f0c77fb409c96767477a9232e49c5de750d27cd2701bb64e0e56b5df88c93ff5d7078fe2f5395ef72fe885336f78c7b7e6214d3cfdc479c65a61457ac3c9813db0ed3e9952950887dfd4e3a6579cc034fef2011f7fd4baec5521f3eb85e3704868a05c83211f18ebbe91a32c4c70d579bb726e904175c3bc3bfa687c1602c6bb768eae57c2cb2bf6ab4a0a017fb00e848c76695d531f1936fdffccb6e308cd43facfb32e6d569a868ee2d9f3150448dd7aa47553450d4060260dd2269c4608fc81a99f9c15607beb9c70566d58616c9cb9ce9a25a4b6b60270acd85cf37493a763c12376a753aeec5f90ea9260a5be4aa5dc059eac3453010a9417e9bb6ad3bc56d591df379a429c2c84588b5994daac74e8e272e54f151eda25366cb96518cfa01504be5942dcb19b23af37d5c9956dfb257f019254a0e60504c44e035f587d91d8d29b5c7fac35b6d8264da820761b0acfe90785234ac524b495f6ec1b34a0226bc32d83e54c5140545d0ca6d0b73d5f8e9c5bc18b007524b632f777b680e71dafdd94df58bc4d0b4c92036a67f6bfb3f768735354bef275be6f1c1147a151a40e3785c100f0595dc03e92db2362b6049417d1806ad245ad6fac9b98ba347b4d43b3978d410f79552dc1bfeae19c9fb9754909e4df9165ccfbfefbbaf9de650ea4a02213816599501e9372bfef7520a7168db167d77fefab85d49c1294f780c4c8b2a0e15e6ae4338bf1bae62266add1b330e09da9a36a17ddcc20779284edefea9ad518fcf0673d20e8ab5bb5019d3e45447c485b3fc2797a2dbec425d7b83a7aa126404e2c9848568b2b316cca0e0c6e9e36c6bd4db887786185b5df1767e38983f3d0ed8b9240b7e779934a0284729e3d33483a335ba7f634e6d5e5c68e45ee7091952082305ea9eaa2703f6e66096aecdb58581f16ae50c756cceba4a6acf290bb085bdb9dc75865c6b8d17ba044a52db7597bed467a51abc4764c6ccb56601839f0995590d7519bf80b6d33f0edbbd4f40d50fd4a74bda9d7c2b19d122d67cd0cd50fd53cafd6fc7dacc97d6bdc7701f4412cb762981dd5767a8c326ff05a44fb08015e0dd18478eaa15b727225391cf8ad21be90f106b28d00ef1fe857714f454118953fda6e4b2481e42f3dbb89103f8bcfff6113167cdb20ee5c655f61bbebcff7479f52630d8d6383707c943f194e5b9350362d60404795052821e39d4dd5d00959793cdf04bb19908c8c50c5fc6842e60b65b87724a0dfab1aa39a765d977625ebcf7f572d0aaf6a53c1b4c4ef03e63606883422f8ee01c8bcff3fdc06495a058dd5efd49d6f764307af7696f916df532100525c4f51e2ed729d0b07d3b09ca6cd2d9ad85d51952e8acb59f3bcdac4f10e79470a4813ae8b54509fcb50b34cca9e089707c0143fb870510a96da206094024afb1ef30ec54e1a227a13fcc2f432851523d7b0b09add423604082bc565da460b7c7e2011a4d5d6bfb5d8d1aa39bc9b14bdb3c59c6f9d8ed85da17a3324d27d613bd869061e60493de15cab24c0f1685080a7883bca950f037bed1323c34ee6f22427001f215b04344547dffaacc57783c21f1b266afcb2fad4137eeb7f7373715708007b4e9d7d7b77ea9b1565334d4985a0227f55e14958e9def3a5f2b6e7654aac15f22f87238d3b56eb2f5212cf4fdfc04d295acbd6c96ddd12cc06a8bd154e5159534f8eabea39fa89ca036ae561b739d6e29ce572e53c493b1cead0017523cebf33375bbdcfb9c98551fa47216c2332acb8531cf25ebb8ca6a90b6ce04d595e5d8dffe45f1d439b51e37c3c32caa360e5abe041ee5ec8a7ca563ee2780067ce9b26fd06a899961c411c5ebb6b1d5c18762b7ed8c5c47b89cddefb36070fd2678b884d0cafbb3f2aad5043fa0f2d38385615cf9bcc25b4e250ed507854016e551e03c7fd05ff5dc0e91b24215cb8779d11a17b93ce296d623f8d1c6b56698974ad1c1589e40a6b2358c00414b34ddfa32d81607ddb3905882a27e46595615f027b426eb246a8b9a5cac29c39553ac8573979759f03b7cd54a546c2a249fcaf1f07e32e82ecba67bbb3e2d56022faf5530d73e3db1bfbaf3662ccb10fd09dd8dbdab58db6880c5b9ae1b141d6a080cc50d86f9e8b1d7193a9cd6b8800cf568f1b20ad800f1c313ac1d501af9942d021f7ced4d10793d5b33cb131369d3d8526f2b2c79952dff9669b5867fc0b0f13d9c520315487d2018c52f6050d6d35b328a52c25b7d3296590cc3c1aa8993f9f17937cca41bd5dba51194b0ee446440b4b2b461c64eabe4638b1a44520d68d77d81e06b8e00a330a0789854ff66b2dd93697aeb677515383023e0c784ab880141d4f101cb9a46142abe6577d938176ee2648a94be2a9babc96b1acea184cb61509e73d46d87db5c196cdc88e11832c7a61c9775bd57ad449ffad4f510c3a250b1bcb4671dfe17dc1cde6a6325648d17a03f5cf5b11615792e54b4bc8fffe58563efb5b2f96d70e72eb4f3fd468293bea2de24308f6c11959c77fd91f7e5750af17dc457a7957d98a0f4c8edcaa6dae90227b4a1d627cf1cdcf3c07b59b1bfff5befdd54ead0b371b43a2b74338fe8133e299f8578c12568bcb12a4f04d2fda58e5d45d7f42a931e5f23775488689e698fe74217cafa0dba155a3fcc74a1610e86b31d7275d524986ee0308e32899d7f545744503bf88a3ca2648a5e40a628989f1adc32d8f3d16ce0dcf1d07af52c8527ca8d75e29695fa06d58379a77a2afae277c5e79e7aecf6f9fe79ffd626c4d246b27ea0543dd7d13817fe9edaf6d3ba317736af2efa3a442ab3e3a6cbd62a4af7fc8e75cfac4ebe8e426a6aa460a96b01d30772fd8ec9b5d1b0f722f2e9560b758b93dc9e2dd80c817b611dc0ebd630442675cb8a8fa79e6ae6cc59cc2c753ffcf1ebf74fd66114045c22f643ccc67a3e32fef2ef97e78a1033208b8c46bb9d8d199b36305351893b62453f91ad87f4d84bb0896e3aa83ea35987e2cf11d8669740682de8f5edb6ba7c73925e1c8590890cc48f28343768ede07d43365889c37db1ef9707a3c4caf22476a04ee37adb1ba65a59a8a9189301d1c4eb3514015b12f1ed27a00b9a2a69a4aeac6a1eff1dfe6f873191b8623b1bab9661be0bcadfad96e98c263a6f40721442dc0d3f0e3264371e0cb0f77e7859c07cedf58dc46723bc62ae1444327a680b8b785243d77c2fe90e5a0005b0696cf3ca43a2cbcf8bcf9c77c59d993a9320ec7fa8a7ce4aa699f96001546979f1696df44235f3a38c5cdb9c231327c437893fdbed1d6e8d36fcb16909f567a28df27ecf486ac0e476a98b28a009051115eec4efb08b71cc2f7d32cc94a3a14a703e2f5f9bc2256c3ac30c7c3fe58fc034b690eb8fc8441cc9d46ba80fc3668e9eab835a3e3928f597c84dbeaab6f741045cbe5bc704e647d5a34b06da67bb1588f51d98aa2036f6b8f4ab2bd32ace11d5543c20d9ce22c98fb858d9e1523319f95de1092704f8788ef53077422b9f7287955b780b132f1a4192cb095f615ac2ce30b29275559abe5299a88749f53b3420ece41ebd942e1663820fef3ba1e5a1134769ebf67d7ed90f36bd6ee0e0a60fc73ef06d61bdcdb6a203958406407a8034919adc45df6ca0815908a9b43f3c4aa20967fccf4909bde503938acb2d5d7bfeeb7ce6a7c347b975238b2728a6342630c06cd973b9043bf649b0fe263ed2bae2c6d5e7e299d18d41ab110f5ab27badcbfb9f4d2077a865b05138c806cf8d1e3b1b82faa7ac4d8419cbc062e7e6347a92fade899dfb0f9333cab7309e429e8151478d49e81dc083c4ef3e81372dc93450eb4a5d3a57b83bdef4a5349a0dc30cc53edc1efffb969950d01076b2d74ff9d465c17357338a98f18bc9bfaf7662f8506802aeae639ce287f3725200f32615b4f2a752e168d065d9f8e3f22fe31dce35f2b1cf53d1957929657f378f474c101ac7f60646056c9cc76ecdeef0a952d12b62d5522b7d88ad6448ed11ba30afcb0248d476d984ddaf04b877055abbbdb494728645f25d1d70e1916641af0f6fc7d40a76e538eb9ac3d96e31e5373e66ad93348aa08c4f88900b82c1869bbf7965ebdf368e8fa0d488174b1b1253c42c6d1739efe173242b24c29bfd6beb3e93c4976ae7701816297470cb24ca585f98b26d11ba26e46eef764cbef36749a353a46026373dc559e9e000f7abc324d8684972804ad61f6fc3e2feeb60e51a29ddf7b3661a5bd73418606dcc78204a1965dea557cfffac703922513f3a6466a6c767551eb3d9a394ab6295d30a5cb9cc18af1ad28b5183186f896a8524c72cfe04e32262239b9d769b2531823f5089c251356dfbd11d1b3e8deb9207d6001a901bda6676dad0755a97da402f424c7305037e0bb4db59cc74333038ad4fb10a85efde91789143ea10638102e170a1e384a0831f4de66d62b7c49a0a86dd12c5dd4e3dec8391fc6e4a063a939106c7d7063fadf776bb7c5dfc4165e12fe4df51800ede767f26bf2a8cd200285616b89938aa82b014519f336fdf9e980bf25d709c75d972d9fb3defe8aad5cffdbd19a61c5e466b460e19d7a6d73b9b11f706759086343511cd6b5db7c5744437a377a4a73809034650c1f814b8322c2e2f60067e9408c973d15dfabc136cfd187fd8b7052818bed2589bf764187051d454317a7300799a552fc5a93b443e8e0fb9ced4effaca21fe711387241ffbf551f8f237c9bc359b2f6f3850a5d77f775bb775867d887c3279158944023d1fcdc281534fa91ac860a317bcb2acea1d392caf7fa4185425d14347e5157f998ce67218ffe92fa4bb4b05542c72cf448c08c875cdcc28be69a0b1e5cd79e6f76a7370b2c10876d131f6dbed84f13b9b462e58353f8b0f349340fcc5190c47fdc3919e97b5c7f90"}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000001040)={{0x1, 0x1, 0x18}, './file0\x00'}) (async) fstat(r2, &(0x7f00000010c0)) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000040)={{r1}, 0x0, 0x2, @unused=[0xffffffffffffffff, 0x0, 0x9, 0x1], @name="919d2aaf13d7f6682a2f93ecbcf4461778d00cf4ec0d6393318ab06c0cb0e09dbfb8563e84e2cc28461e4c070eb89be9d801c5ee42e67c4b81ae30d48b40ffc8325389c03ac073756116037720f7f1632161e32b7a602aa2f10bc1e20f7ef77280982b5a4e1c7e09fc6e6a47f942b37ba1c7a95662a11aced152c8aa28e3fb306e73fcafef7ba1a540a30b9486cf8a3fba10bd799348dbbc0f998063c8bb57aff3c210ebcf5ab9163000a5abc63cb5d178da25ea62ab23b3569631fa97b9391f308d1445319cb5983403f054eb1f01027236173b5e7807c9d03572757df81af330454cb672debbda87817b72b9c5314187d1c0fa4d145981f541cc2e054e7871b05f66870ed4dbc9cfefdfb5d9f2b04d2082e8bcef7ec4082e5dad9acd1ffbc9ecd0b5bd9dd5c01345c498dfed6dd02c6465789653ff3c18bb4bd4cc1625fbff3d6ae05d39f8a0534b6a0f12a3f36b264e17468a4e11989aed51f3f8f781dac5fb92f2c77f13251110c7f1422081c01c64add03f27c23fc524405ae8c09a481d52fd7cab27e0cac1a4a42f326fc80e2239fb0139f406b4ecc3445596bcf3a06a47ca30e9e05f8ea44ca17df871ebd287eddcafe24eade69962fb008d00b3cc8ef0302c40bf2544b1803352c17923d69a43b1369131815ca2fc67fbda155c5a4fbd7209277ab148c7eb38f0134276b1f3a517a1511f45c274eefc9c856ea42f788901fde5c7de090e8d500d22cc7f7ca73ebbd8f862518766e3686bb58fddc5632b60cd0b51c2895e6837f7f0c77fb409c96767477a9232e49c5de750d27cd2701bb64e0e56b5df88c93ff5d7078fe2f5395ef72fe885336f78c7b7e6214d3cfdc479c65a61457ac3c9813db0ed3e9952950887dfd4e3a6579cc034fef2011f7fd4baec5521f3eb85e3704868a05c83211f18ebbe91a32c4c70d579bb726e904175c3bc3bfa687c1602c6bb768eae57c2cb2bf6ab4a0a017fb00e848c76695d531f1936fdffccb6e308cd43facfb32e6d569a868ee2d9f3150448dd7aa47553450d4060260dd2269c4608fc81a99f9c15607beb9c70566d58616c9cb9ce9a25a4b6b60270acd85cf37493a763c12376a753aeec5f90ea9260a5be4aa5dc059eac3453010a9417e9bb6ad3bc56d591df379a429c2c84588b5994daac74e8e272e54f151eda25366cb96518cfa01504be5942dcb19b23af37d5c9956dfb257f019254a0e60504c44e035f587d91d8d29b5c7fac35b6d8264da820761b0acfe90785234ac524b495f6ec1b34a0226bc32d83e54c5140545d0ca6d0b73d5f8e9c5bc18b007524b632f777b680e71dafdd94df58bc4d0b4c92036a67f6bfb3f768735354bef275be6f1c1147a151a40e3785c100f0595dc03e92db2362b6049417d1806ad245ad6fac9b98ba347b4d43b3978d410f79552dc1bfeae19c9fb9754909e4df9165ccfbfefbbaf9de650ea4a02213816599501e9372bfef7520a7168db167d77fefab85d49c1294f780c4c8b2a0e15e6ae4338bf1bae62266add1b330e09da9a36a17ddcc20779284edefea9ad518fcf0673d20e8ab5bb5019d3e45447c485b3fc2797a2dbec425d7b83a7aa126404e2c9848568b2b316cca0e0c6e9e36c6bd4db887786185b5df1767e38983f3d0ed8b9240b7e779934a0284729e3d33483a335ba7f634e6d5e5c68e45ee7091952082305ea9eaa2703f6e66096aecdb58581f16ae50c756cceba4a6acf290bb085bdb9dc75865c6b8d17ba044a52db7597bed467a51abc4764c6ccb56601839f0995590d7519bf80b6d33f0edbbd4f40d50fd4a74bda9d7c2b19d122d67cd0cd50fd53cafd6fc7dacc97d6bdc7701f4412cb762981dd5767a8c326ff05a44fb08015e0dd18478eaa15b727225391cf8ad21be90f106b28d00ef1fe857714f454118953fda6e4b2481e42f3dbb89103f8bcfff6113167cdb20ee5c655f61bbebcff7479f52630d8d6383707c943f194e5b9350362d60404795052821e39d4dd5d00959793cdf04bb19908c8c50c5fc6842e60b65b87724a0dfab1aa39a765d977625ebcf7f572d0aaf6a53c1b4c4ef03e63606883422f8ee01c8bcff3fdc06495a058dd5efd49d6f764307af7696f916df532100525c4f51e2ed729d0b07d3b09ca6cd2d9ad85d51952e8acb59f3bcdac4f10e79470a4813ae8b54509fcb50b34cca9e089707c0143fb870510a96da206094024afb1ef30ec54e1a227a13fcc2f432851523d7b0b09add423604082bc565da460b7c7e2011a4d5d6bfb5d8d1aa39bc9b14bdb3c59c6f9d8ed85da17a3324d27d613bd869061e60493de15cab24c0f1685080a7883bca950f037bed1323c34ee6f22427001f215b04344547dffaacc57783c21f1b266afcb2fad4137eeb7f7373715708007b4e9d7d7b77ea9b1565334d4985a0227f55e14958e9def3a5f2b6e7654aac15f22f87238d3b56eb2f5212cf4fdfc04d295acbd6c96ddd12cc06a8bd154e5159534f8eabea39fa89ca036ae561b739d6e29ce572e53c493b1cead0017523cebf33375bbdcfb9c98551fa47216c2332acb8531cf25ebb8ca6a90b6ce04d595e5d8dffe45f1d439b51e37c3c32caa360e5abe041ee5ec8a7ca563ee2780067ce9b26fd06a899961c411c5ebb6b1d5c18762b7ed8c5c47b89cddefb36070fd2678b884d0cafbb3f2aad5043fa0f2d38385615cf9bcc25b4e250ed507854016e551e03c7fd05ff5dc0e91b24215cb8779d11a17b93ce296d623f8d1c6b56698974ad1c1589e40a6b2358c00414b34ddfa32d81607ddb3905882a27e46595615f027b426eb246a8b9a5cac29c39553ac8573979759f03b7cd54a546c2a249fcaf1f07e32e82ecba67bbb3e2d56022faf5530d73e3db1bfbaf3662ccb10fd09dd8dbdab58db6880c5b9ae1b141d6a080cc50d86f9e8b1d7193a9cd6b8800cf568f1b20ad800f1c313ac1d501af9942d021f7ced4d10793d5b33cb131369d3d8526f2b2c79952dff9669b5867fc0b0f13d9c520315487d2018c52f6050d6d35b328a52c25b7d3296590cc3c1aa8993f9f17937cca41bd5dba51194b0ee446440b4b2b461c64eabe4638b1a44520d68d77d81e06b8e00a330a0789854ff66b2dd93697aeb677515383023e0c784ab880141d4f101cb9a46142abe6577d938176ee2648a94be2a9babc96b1acea184cb61509e73d46d87db5c196cdc88e11832c7a61c9775bd57ad449ffad4f510c3a250b1bcb4671dfe17dc1cde6a6325648d17a03f5cf5b11615792e54b4bc8fffe58563efb5b2f96d70e72eb4f3fd468293bea2de24308f6c11959c77fd91f7e5750af17dc457a7957d98a0f4c8edcaa6dae90227b4a1d627cf1cdcf3c07b59b1bfff5befdd54ead0b371b43a2b74338fe8133e299f8578c12568bcb12a4f04d2fda58e5d45d7f42a931e5f23775488689e698fe74217cafa0dba155a3fcc74a1610e86b31d7275d524986ee0308e32899d7f545744503bf88a3ca2648a5e40a628989f1adc32d8f3d16ce0dcf1d07af52c8527ca8d75e29695fa06d58379a77a2afae277c5e79e7aecf6f9fe79ffd626c4d246b27ea0543dd7d13817fe9edaf6d3ba317736af2efa3a442ab3e3a6cbd62a4af7fc8e75cfac4ebe8e426a6aa460a96b01d30772fd8ec9b5d1b0f722f2e9560b758b93dc9e2dd80c817b611dc0ebd630442675cb8a8fa79e6ae6cc59cc2c753ffcf1ebf74fd66114045c22f643ccc67a3e32fef2ef97e78a1033208b8c46bb9d8d199b36305351893b62453f91ad87f4d84bb0896e3aa83ea35987e2cf11d8669740682de8f5edb6ba7c73925e1c8590890cc48f28343768ede07d43365889c37db1ef9707a3c4caf22476a04ee37adb1ba65a59a8a9189301d1c4eb3514015b12f1ed27a00b9a2a69a4aeac6a1eff1dfe6f873191b8623b1bab9661be0bcadfad96e98c263a6f40721442dc0d3f0e3264371e0cb0f77e7859c07cedf58dc46723bc62ae1444327a680b8b785243d77c2fe90e5a0005b0696cf3ca43a2cbcf8bcf9c77c59d993a9320ec7fa8a7ce4aa699f96001546979f1696df44235f3a38c5cdb9c231327c437893fdbed1d6e8d36fcb16909f567a28df27ecf486ac0e476a98b28a009051115eec4efb08b71cc2f7d32cc94a3a14a703e2f5f9bc2256c3ac30c7c3fe58fc034b690eb8fc8441cc9d46ba80fc3668e9eab835a3e3928f597c84dbeaab6f741045cbe5bc704e647d5a34b06da67bb1588f51d98aa2036f6b8f4ab2bd32ace11d5543c20d9ce22c98fb858d9e1523319f95de1092704f8788ef53077422b9f7287955b780b132f1a4192cb095f615ac2ce30b29275559abe5299a88749f53b3420ece41ebd942e1663820fef3ba1e5a1134769ebf67d7ed90f36bd6ee0e0a60fc73ef06d61bdcdb6a203958406407a8034919adc45df6ca0815908a9b43f3c4aa20967fccf4909bde503938acb2d5d7bfeeb7ce6a7c347b975238b2728a6342630c06cd973b9043bf649b0fe263ed2bae2c6d5e7e299d18d41ab110f5ab27badcbfb9f4d2077a865b05138c806cf8d1e3b1b82faa7ac4d8419cbc062e7e6347a92fade899dfb0f9333cab7309e429e8151478d49e81dc083c4ef3e81372dc93450eb4a5d3a57b83bdef4a5349a0dc30cc53edc1efffb969950d01076b2d74ff9d465c17357338a98f18bc9bfaf7662f8506802aeae639ce287f3725200f32615b4f2a752e168d065d9f8e3f22fe31dce35f2b1cf53d1957929657f378f474c101ac7f60646056c9cc76ecdeef0a952d12b62d5522b7d88ad6448ed11ba30afcb0248d476d984ddaf04b877055abbbdb494728645f25d1d70e1916641af0f6fc7d40a76e538eb9ac3d96e31e5373e66ad93348aa08c4f88900b82c1869bbf7965ebdf368e8fa0d488174b1b1253c42c6d1739efe173242b24c29bfd6beb3e93c4976ae7701816297470cb24ca585f98b26d11ba26e46eef764cbef36749a353a46026373dc559e9e000f7abc324d8684972804ad61f6fc3e2feeb60e51a29ddf7b3661a5bd73418606dcc78204a1965dea557cfffac703922513f3a6466a6c767551eb3d9a394ab6295d30a5cb9cc18af1ad28b5183186f896a8524c72cfe04e32262239b9d769b2531823f5089c251356dfbd11d1b3e8deb9207d6001a901bda6676dad0755a97da402f424c7305037e0bb4db59cc74333038ad4fb10a85efde91789143ea10638102e170a1e384a0831f4de66d62b7c49a0a86dd12c5dd4e3dec8391fc6e4a063a939106c7d7063fadf776bb7c5dfc4165e12fe4df51800ede767f26bf2a8cd200285616b89938aa82b014519f336fdf9e980bf25d709c75d972d9fb3defe8aad5cffdbd19a61c5e466b460e19d7a6d73b9b11f706759086343511cd6b5db7c5744437a377a4a73809034650c1f814b8322c2e2f60067e9408c973d15dfabc136cfd187fd8b7052818bed2589bf764187051d454317a7300799a552fc5a93b443e8e0fb9ced4effaca21fe711387241ffbf551f8f237c9bc359b2f6f3850a5d77f775bb775867d887c3279158944023d1fcdc281534fa91ac860a317bcb2acea1d392caf7fa4185425d14347e5157f998ce67218ffe92fa4bb4b05542c72cf448c08c875cdcc28be69a0b1e5cd79e6f76a7370b2c10876d131f6dbed84f13b9b462e58353f8b0f349340fcc5190c47fdc3919e97b5c7f90"}) (async) [ 1670.282170][T16578] fuse: Bad value for 'fd' 14:43:19 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x40043, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000100)) 14:43:19 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) mount$nfs(&(0x7f0000000080)=')\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000180), 0x80000, &(0x7f00000001c0)={[{'overlay\x00'}, {'overlay\x00'}], [{@audit}, {@fowner_gt={'fowner>', r1}}, {@hash}]}) 14:43:19 executing program 0: ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000001c0)=ANY=[@ANYBLOB="f2c74c5fb0d956417cc980144cd44dd385bfb522c7f45902e781e1213a6b090007051b7b9dd170f0fd7d31adec224710f177651ca351dc32a1e960", @ANYRES32=0xffffffffffffffff, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000140), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) openat$cgroup_pressure(r0, &(0x7f0000000180)='cpu.pressure\x00', 0x2, 0x0) fstat(r1, &(0x7f0000003880)) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000000000faffffffffffffff0000000700000000000000000009000000000029008020000000000008ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) openat$cgroup_freezer_state(r3, &(0x7f0000000100), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000280)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYRES32, @ANYBLOB="000000002e2f8755d4950e02ce132c66696c653000"]) 14:43:19 executing program 4: read$ptp(0xffffffffffffffff, 0x0, 0x0) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @unused=[0x7, 0x8001, 0x20, 0x7], @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async, rerun: 64) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (rerun: 64) fstat(r3, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {r1}}, './file0\x00'}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r3, 0x50009417, &(0x7f0000001380)={{r4}, 0x0, 0x4, @unused=[0xfffffffffffffffa, 0x200, 0x2, 0x9], @subvolid=0x3}) (async, rerun: 32) r5 = fspick(r2, &(0x7f0000000000)='./file0\x00', 0x1) (rerun: 32) fsconfig$FSCONFIG_SET_FD(r5, 0x5, &(0x7f0000000100)='})\x00', 0x0, r0) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000062ba09a27fb481256d9477a877081a0100170018000000880a269645c680198eef487bbf644d90fc77be9afb72e73e26395939eb2b71d4f2aa7c681668f4696591a90708895896e11de6b50b3903fd7f35c96241e2621a45be00356ceda3d1a6e919f6afee264cd1203eefdc8a3fd117867595c94f3f7be788b1e3a70fda4500"/142, @ANYRES32, @ANYBLOB="ffffffff000000002e2f66696c653000"]) 14:43:19 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, &(0x7f0000001040)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) fstat(r2, &(0x7f00000010c0)) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000040)={{r1}, 0x0, 0x2, @unused=[0xffffffffffffffff, 0x0, 0x9, 0x1], @name="919d2aaf13d7f6682a2f93ecbcf4461778d00cf4ec0d6393318ab06c0cb0e09dbfb8563e84e2cc28461e4c070eb89be9d801c5ee42e67c4b81ae30d48b40ffc8325389c03ac073756116037720f7f1632161e32b7a602aa2f10bc1e20f7ef77280982b5a4e1c7e09fc6e6a47f942b37ba1c7a95662a11aced152c8aa28e3fb306e73fcafef7ba1a540a30b9486cf8a3fba10bd799348dbbc0f998063c8bb57aff3c210ebcf5ab9163000a5abc63cb5d178da25ea62ab23b3569631fa97b9391f308d1445319cb5983403f054eb1f01027236173b5e7807c9d03572757df81af330454cb672debbda87817b72b9c5314187d1c0fa4d145981f541cc2e054e7871b05f66870ed4dbc9cfefdfb5d9f2b04d2082e8bcef7ec4082e5dad9acd1ffbc9ecd0b5bd9dd5c01345c498dfed6dd02c6465789653ff3c18bb4bd4cc1625fbff3d6ae05d39f8a0534b6a0f12a3f36b264e17468a4e11989aed51f3f8f781dac5fb92f2c77f13251110c7f1422081c01c64add03f27c23fc524405ae8c09a481d52fd7cab27e0cac1a4a42f326fc80e2239fb0139f406b4ecc3445596bcf3a06a47ca30e9e05f8ea44ca17df871ebd287eddcafe24eade69962fb008d00b3cc8ef0302c40bf2544b1803352c17923d69a43b1369131815ca2fc67fbda155c5a4fbd7209277ab148c7eb38f0134276b1f3a517a1511f45c274eefc9c856ea42f788901fde5c7de090e8d500d22cc7f7ca73ebbd8f862518766e3686bb58fddc5632b60cd0b51c2895e6837f7f0c77fb409c96767477a9232e49c5de750d27cd2701bb64e0e56b5df88c93ff5d7078fe2f5395ef72fe885336f78c7b7e6214d3cfdc479c65a61457ac3c9813db0ed3e9952950887dfd4e3a6579cc034fef2011f7fd4baec5521f3eb85e3704868a05c83211f18ebbe91a32c4c70d579bb726e904175c3bc3bfa687c1602c6bb768eae57c2cb2bf6ab4a0a017fb00e848c76695d531f1936fdffccb6e308cd43facfb32e6d569a868ee2d9f3150448dd7aa47553450d4060260dd2269c4608fc81a99f9c15607beb9c70566d58616c9cb9ce9a25a4b6b60270acd85cf37493a763c12376a753aeec5f90ea9260a5be4aa5dc059eac3453010a9417e9bb6ad3bc56d591df379a429c2c84588b5994daac74e8e272e54f151eda25366cb96518cfa01504be5942dcb19b23af37d5c9956dfb257f019254a0e60504c44e035f587d91d8d29b5c7fac35b6d8264da820761b0acfe90785234ac524b495f6ec1b34a0226bc32d83e54c5140545d0ca6d0b73d5f8e9c5bc18b007524b632f777b680e71dafdd94df58bc4d0b4c92036a67f6bfb3f768735354bef275be6f1c1147a151a40e3785c100f0595dc03e92db2362b6049417d1806ad245ad6fac9b98ba347b4d43b3978d410f79552dc1bfeae19c9fb9754909e4df9165ccfbfefbbaf9de650ea4a02213816599501e9372bfef7520a7168db167d77fefab85d49c1294f780c4c8b2a0e15e6ae4338bf1bae62266add1b330e09da9a36a17ddcc20779284edefea9ad518fcf0673d20e8ab5bb5019d3e45447c485b3fc2797a2dbec425d7b83a7aa126404e2c9848568b2b316cca0e0c6e9e36c6bd4db887786185b5df1767e38983f3d0ed8b9240b7e779934a0284729e3d33483a335ba7f634e6d5e5c68e45ee7091952082305ea9eaa2703f6e66096aecdb58581f16ae50c756cceba4a6acf290bb085bdb9dc75865c6b8d17ba044a52db7597bed467a51abc4764c6ccb56601839f0995590d7519bf80b6d33f0edbbd4f40d50fd4a74bda9d7c2b19d122d67cd0cd50fd53cafd6fc7dacc97d6bdc7701f4412cb762981dd5767a8c326ff05a44fb08015e0dd18478eaa15b727225391cf8ad21be90f106b28d00ef1fe857714f454118953fda6e4b2481e42f3dbb89103f8bcfff6113167cdb20ee5c655f61bbebcff7479f52630d8d6383707c943f194e5b9350362d60404795052821e39d4dd5d00959793cdf04bb19908c8c50c5fc6842e60b65b87724a0dfab1aa39a765d977625ebcf7f572d0aaf6a53c1b4c4ef03e63606883422f8ee01c8bcff3fdc06495a058dd5efd49d6f764307af7696f916df532100525c4f51e2ed729d0b07d3b09ca6cd2d9ad85d51952e8acb59f3bcdac4f10e79470a4813ae8b54509fcb50b34cca9e089707c0143fb870510a96da206094024afb1ef30ec54e1a227a13fcc2f432851523d7b0b09add423604082bc565da460b7c7e2011a4d5d6bfb5d8d1aa39bc9b14bdb3c59c6f9d8ed85da17a3324d27d613bd869061e60493de15cab24c0f1685080a7883bca950f037bed1323c34ee6f22427001f215b04344547dffaacc57783c21f1b266afcb2fad4137eeb7f7373715708007b4e9d7d7b77ea9b1565334d4985a0227f55e14958e9def3a5f2b6e7654aac15f22f87238d3b56eb2f5212cf4fdfc04d295acbd6c96ddd12cc06a8bd154e5159534f8eabea39fa89ca036ae561b739d6e29ce572e53c493b1cead0017523cebf33375bbdcfb9c98551fa47216c2332acb8531cf25ebb8ca6a90b6ce04d595e5d8dffe45f1d439b51e37c3c32caa360e5abe041ee5ec8a7ca563ee2780067ce9b26fd06a899961c411c5ebb6b1d5c18762b7ed8c5c47b89cddefb36070fd2678b884d0cafbb3f2aad5043fa0f2d38385615cf9bcc25b4e250ed507854016e551e03c7fd05ff5dc0e91b24215cb8779d11a17b93ce296d623f8d1c6b56698974ad1c1589e40a6b2358c00414b34ddfa32d81607ddb3905882a27e46595615f027b426eb246a8b9a5cac29c39553ac8573979759f03b7cd54a546c2a249fcaf1f07e32e82ecba67bbb3e2d56022faf5530d73e3db1bfbaf3662ccb10fd09dd8dbdab58db6880c5b9ae1b141d6a080cc50d86f9e8b1d7193a9cd6b8800cf568f1b20ad800f1c313ac1d501af9942d021f7ced4d10793d5b33cb131369d3d8526f2b2c79952dff9669b5867fc0b0f13d9c520315487d2018c52f6050d6d35b328a52c25b7d3296590cc3c1aa8993f9f17937cca41bd5dba51194b0ee446440b4b2b461c64eabe4638b1a44520d68d77d81e06b8e00a330a0789854ff66b2dd93697aeb677515383023e0c784ab880141d4f101cb9a46142abe6577d938176ee2648a94be2a9babc96b1acea184cb61509e73d46d87db5c196cdc88e11832c7a61c9775bd57ad449ffad4f510c3a250b1bcb4671dfe17dc1cde6a6325648d17a03f5cf5b11615792e54b4bc8fffe58563efb5b2f96d70e72eb4f3fd468293bea2de24308f6c11959c77fd91f7e5750af17dc457a7957d98a0f4c8edcaa6dae90227b4a1d627cf1cdcf3c07b59b1bfff5befdd54ead0b371b43a2b74338fe8133e299f8578c12568bcb12a4f04d2fda58e5d45d7f42a931e5f23775488689e698fe74217cafa0dba155a3fcc74a1610e86b31d7275d524986ee0308e32899d7f545744503bf88a3ca2648a5e40a628989f1adc32d8f3d16ce0dcf1d07af52c8527ca8d75e29695fa06d58379a77a2afae277c5e79e7aecf6f9fe79ffd626c4d246b27ea0543dd7d13817fe9edaf6d3ba317736af2efa3a442ab3e3a6cbd62a4af7fc8e75cfac4ebe8e426a6aa460a96b01d30772fd8ec9b5d1b0f722f2e9560b758b93dc9e2dd80c817b611dc0ebd630442675cb8a8fa79e6ae6cc59cc2c753ffcf1ebf74fd66114045c22f643ccc67a3e32fef2ef97e78a1033208b8c46bb9d8d199b36305351893b62453f91ad87f4d84bb0896e3aa83ea35987e2cf11d8669740682de8f5edb6ba7c73925e1c8590890cc48f28343768ede07d43365889c37db1ef9707a3c4caf22476a04ee37adb1ba65a59a8a9189301d1c4eb3514015b12f1ed27a00b9a2a69a4aeac6a1eff1dfe6f873191b8623b1bab9661be0bcadfad96e98c263a6f40721442dc0d3f0e3264371e0cb0f77e7859c07cedf58dc46723bc62ae1444327a680b8b785243d77c2fe90e5a0005b0696cf3ca43a2cbcf8bcf9c77c59d993a9320ec7fa8a7ce4aa699f96001546979f1696df44235f3a38c5cdb9c231327c437893fdbed1d6e8d36fcb16909f567a28df27ecf486ac0e476a98b28a009051115eec4efb08b71cc2f7d32cc94a3a14a703e2f5f9bc2256c3ac30c7c3fe58fc034b690eb8fc8441cc9d46ba80fc3668e9eab835a3e3928f597c84dbeaab6f741045cbe5bc704e647d5a34b06da67bb1588f51d98aa2036f6b8f4ab2bd32ace11d5543c20d9ce22c98fb858d9e1523319f95de1092704f8788ef53077422b9f7287955b780b132f1a4192cb095f615ac2ce30b29275559abe5299a88749f53b3420ece41ebd942e1663820fef3ba1e5a1134769ebf67d7ed90f36bd6ee0e0a60fc73ef06d61bdcdb6a203958406407a8034919adc45df6ca0815908a9b43f3c4aa20967fccf4909bde503938acb2d5d7bfeeb7ce6a7c347b975238b2728a6342630c06cd973b9043bf649b0fe263ed2bae2c6d5e7e299d18d41ab110f5ab27badcbfb9f4d2077a865b05138c806cf8d1e3b1b82faa7ac4d8419cbc062e7e6347a92fade899dfb0f9333cab7309e429e8151478d49e81dc083c4ef3e81372dc93450eb4a5d3a57b83bdef4a5349a0dc30cc53edc1efffb969950d01076b2d74ff9d465c17357338a98f18bc9bfaf7662f8506802aeae639ce287f3725200f32615b4f2a752e168d065d9f8e3f22fe31dce35f2b1cf53d1957929657f378f474c101ac7f60646056c9cc76ecdeef0a952d12b62d5522b7d88ad6448ed11ba30afcb0248d476d984ddaf04b877055abbbdb494728645f25d1d70e1916641af0f6fc7d40a76e538eb9ac3d96e31e5373e66ad93348aa08c4f88900b82c1869bbf7965ebdf368e8fa0d488174b1b1253c42c6d1739efe173242b24c29bfd6beb3e93c4976ae7701816297470cb24ca585f98b26d11ba26e46eef764cbef36749a353a46026373dc559e9e000f7abc324d8684972804ad61f6fc3e2feeb60e51a29ddf7b3661a5bd73418606dcc78204a1965dea557cfffac703922513f3a6466a6c767551eb3d9a394ab6295d30a5cb9cc18af1ad28b5183186f896a8524c72cfe04e32262239b9d769b2531823f5089c251356dfbd11d1b3e8deb9207d6001a901bda6676dad0755a97da402f424c7305037e0bb4db59cc74333038ad4fb10a85efde91789143ea10638102e170a1e384a0831f4de66d62b7c49a0a86dd12c5dd4e3dec8391fc6e4a063a939106c7d7063fadf776bb7c5dfc4165e12fe4df51800ede767f26bf2a8cd200285616b89938aa82b014519f336fdf9e980bf25d709c75d972d9fb3defe8aad5cffdbd19a61c5e466b460e19d7a6d73b9b11f706759086343511cd6b5db7c5744437a377a4a73809034650c1f814b8322c2e2f60067e9408c973d15dfabc136cfd187fd8b7052818bed2589bf764187051d454317a7300799a552fc5a93b443e8e0fb9ced4effaca21fe711387241ffbf551f8f237c9bc359b2f6f3850a5d77f775bb775867d887c3279158944023d1fcdc281534fa91ac860a317bcb2acea1d392caf7fa4185425d14347e5157f998ce67218ffe92fa4bb4b05542c72cf448c08c875cdcc28be69a0b1e5cd79e6f76a7370b2c10876d131f6dbed84f13b9b462e58353f8b0f349340fcc5190c47fdc3919e97b5c7f90"}) 14:43:19 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)={{}, 0x2c, {}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1}}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x3}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0x400}}, {}, {@blksize={'blksize', 0x3d, 0x1e00}}, {@default_permissions}, {@default_permissions}]}}, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000001380)='.log\x00', &(0x7f00000013c0)='.log\x00', 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fspick(r1, &(0x7f0000000040)='./file1\x00', 0x1) (async) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000280)='%,\x00', 0x0, 0xffffffffffffffff) [ 1670.419321][T16590] fuse: Bad value for 'fd' [ 1670.423082][T16585] fuse: Bad value for 'fd' [ 1670.441288][T16597] overlay: Unknown parameter '\' [ 1670.453313][T16592] fuse: Bad value for 'user_id' 14:43:19 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:19 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async, rerun: 64) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x40043, 0x0) (rerun: 64) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000100)) [ 1670.496925][T16601] fuse: Bad value for 'fd' 14:43:19 executing program 0: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r3, 0x82307202, &(0x7f0000001340)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:19 executing program 4: read$ptp(0xffffffffffffffff, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @unused=[0x7, 0x8001, 0x20, 0x7], @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {r1}}, './file0\x00'}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r3, 0x50009417, &(0x7f0000001380)={{r4}, 0x0, 0x4, @unused=[0xfffffffffffffffa, 0x200, 0x2, 0x9], @subvolid=0x3}) r5 = fspick(r2, &(0x7f0000000000)='./file0\x00', 0x1) fsconfig$FSCONFIG_SET_FD(r5, 0x5, &(0x7f0000000100)='})\x00', 0x0, r0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000062ba09a27fb481256d9477a877081a0100170018000000880a269645c680198eef487bbf644d90fc77be9afb72e73e26395939eb2b71d4f2aa7c681668f4696591a90708895896e11de6b50b3903fd7f35c96241e2621a45be00356ceda3d1a6e919f6afee264cd1203eefdc8a3fd117867595c94f3f7be788b1e3a70fda4500"/142, @ANYRES32, @ANYBLOB="ffffffff000000002e2f66696c653000"]) read$ptp(0xffffffffffffffff, 0x0, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @unused=[0x7, 0x8001, 0x20, 0x7], @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r3, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000140)={{0x1, 0x1, 0x18, r2, {r1}}, './file0\x00'}) (async) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r3, 0x50009417, &(0x7f0000001380)={{r4}, 0x0, 0x4, @unused=[0xfffffffffffffffa, 0x200, 0x2, 0x9], @subvolid=0x3}) (async) fspick(r2, &(0x7f0000000000)='./file0\x00', 0x1) (async) fsconfig$FSCONFIG_SET_FD(r5, 0x5, &(0x7f0000000100)='})\x00', 0x0, r0) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000062ba09a27fb481256d9477a877081a0100170018000000880a269645c680198eef487bbf644d90fc77be9afb72e73e26395939eb2b71d4f2aa7c681668f4696591a90708895896e11de6b50b3903fd7f35c96241e2621a45be00356ceda3d1a6e919f6afee264cd1203eefdc8a3fd117867595c94f3f7be788b1e3a70fda4500"/142, @ANYRES32, @ANYBLOB="ffffffff000000002e2f66696c653000"]) (async) 14:43:19 executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) r1 = openat(0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x480, 0x10) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000480)={{0x1, 0x1, 0x18, r1, {0x1}}, './file0\x00'}) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000040)={0x0, 0x1, 0xa0}) mmap$dsp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000002, 0x10, 0xffffffffffffffff, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) write$smackfs_labels_list(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="050000ee950000"], 0xa) [ 1670.582438][T16608] fuse: Bad value for 'fd' [ 1670.601920][T16609] overlay: Unknown parameter '\' 14:43:19 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff0000e0ff000000000000000000000000000100"/80]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @aes256, 0x4, @desc3}) write$yama_ptrace_scope(r0, &(0x7f0000000100)='3\x00', 0x2) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:19 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) [ 1670.626535][T16613] fuse: Bad value for 'fd' [ 1670.628052][T16614] fuse: Bad value for 'fd' 14:43:19 executing program 0: mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x6, 0x10, 0xffffffffffffffff, 0x3) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c00d0cb8a607a1182544eea62f6bbae2247bb515c27eebf98b41cf545ae690fcc414c05cb644553c94f95a404d92a8390e8226f0de1efd540f57b394cddbab1d44eea4fcf2c12d2c3daf4caec1014c912cfcff7e85df6a3ec0f47740b5dea8bb90f06f1e3fb0fe20c6b7a5a440d2d884002bb0cec3c5c591d3de5c7120d4c32e8f3104f45fae7c7c085b2f3f0245af082bbbb094891c83f36ece678e7e05140a8a43d5fbc031b7a3e53f896bf8aa979485e9892425bc88abdf17d8ff480a1320c35dff27ce3ca955fb73b2a7920d3f77645"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:19 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x202002, 0x0) read$ptp(r0, 0x0, 0x0) 14:43:19 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff0000e0ff000000000000000000000000000100"/80]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @aes256, 0x4, @desc3}) write$yama_ptrace_scope(r0, &(0x7f0000000100)='3\x00', 0x2) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff0000e0ff000000000000000000000000000100"/80]}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @aes256, 0x4, @desc3}) (async) write$yama_ptrace_scope(r0, &(0x7f0000000100)='3\x00', 0x2) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:19 executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) (async) r1 = openat(0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x480, 0x10) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000480)={{0x1, 0x1, 0x18, r1, {0x1}}, './file0\x00'}) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x4) (async) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000040)={0x0, 0x1, 0xa0}) (async, rerun: 64) mmap$dsp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000002, 0x10, 0xffffffffffffffff, 0x0) (rerun: 64) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) write$smackfs_labels_list(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="050000ee950000"], 0xa) [ 1670.729160][T16625] fuse: Bad value for 'fd' [ 1670.737003][T16627] overlay: Unknown parameter '\' 14:43:19 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00'/10, @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x40043, 0x0) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000100)) 14:43:19 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1670.779040][T16627] overlay: Unknown parameter '\' 14:43:19 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x202002, 0x0) read$ptp(r0, 0x0, 0x0) [ 1670.842150][T16634] fuse: Bad value for 'fd' [ 1670.856122][T16637] fuse: Bad value for 'fd' [ 1670.862484][T16638] fuse: Bad value for 'fd' 14:43:20 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB]) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000380)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) mount_setattr(r2, &(0x7f0000000340)='./file0\x00', 0x8000, &(0x7f00000003c0)={0x1, 0x81, 0x180000, {r3}}, 0x20) quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000080)=@md0, r1, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) mount_setattr(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x900, &(0x7f00000002c0)={0x100000, 0x7, 0xa0000, {r4}}, 0x20) 14:43:20 executing program 1: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) openat(0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x480, 0x10) (async) r1 = openat(0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00', 0x480, 0x10) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r1, 0xc018937e, &(0x7f0000000480)={{0x1, 0x1, 0x18, r1, {0x1}}, './file0\x00'}) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000040)={0x0, 0x1, 0xa0}) mmap$dsp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000002, 0x10, 0xffffffffffffffff, 0x0) (async) mmap$dsp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000002, 0x10, 0xffffffffffffffff, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) write$smackfs_labels_list(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="050000ee950000"], 0xa) (async) write$smackfs_labels_list(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="050000ee950000"], 0xa) 14:43:20 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) open_tree(r1, &(0x7f0000000100)='./file0\x00', 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1670.888738][T16634] fuse: Bad value for 'fd' 14:43:20 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x307020, 0x0, 0x4, 0x0, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:20 executing program 2: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff0000e0ff000000000000000000000000000100"/80]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000040)=@v1={0x0, @aes256, 0x4, @desc3}) write$yama_ptrace_scope(r0, &(0x7f0000000100)='3\x00', 0x2) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:20 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$cgroup(r0, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount_setattr(r1, &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000000c0)={0xf1, 0x8, 0x1e0000, {r0}}, 0x20) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee00, r2}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000140)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r3, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) openat(r4, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:20 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x202002, 0x0) read$ptp(r0, 0x0, 0x0) (async) read$ptp(r0, 0x0, 0x0) [ 1670.976169][T16649] overlayfs: missing 'lowerdir' [ 1670.995978][T16654] fuse: Bad value for 'fd' 14:43:20 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) open_tree(r1, &(0x7f0000000100)='./file0\x00', 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) (async) open_tree(r1, &(0x7f0000000100)='./file0\x00', 0x1) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:20 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB]) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)) (async) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000380)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) mount_setattr(r2, &(0x7f0000000340)='./file0\x00', 0x8000, &(0x7f00000003c0)={0x1, 0x81, 0x180000, {r3}}, 0x20) quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000080)=@md0, r1, &(0x7f0000000200)) (async) quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000080)=@md0, r1, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) mount_setattr(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x900, &(0x7f00000002c0)={0x100000, 0x7, 0xa0000, {r4}}, 0x20) 14:43:20 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x78) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000000)=']\x00', 0x0, r0) fspick(r0, &(0x7f0000000040)='./file0\x00', 0x1) read$ptp(r0, 0x0, 0x0) 14:43:20 executing program 0: r0 = syz_io_uring_complete(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000040)) epoll_create1(0x80000) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1671.080226][T16662] fuse: Bad value for 'fd' 14:43:20 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$cgroup(r0, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount_setattr(r1, &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000000c0)={0xf1, 0x8, 0x1e0000, {r0}}, 0x20) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee00, r2}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000140)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r3, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) openat(r4, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$cgroup(r0, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000001340)) (async) mount_setattr(r1, &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000000c0)={0xf1, 0x8, 0x1e0000, {r0}}, 0x20) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee00, r2}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000140)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r3, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) (async) openat(r4, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) [ 1671.107563][T16659] fuse: Bad value for 'fd' 14:43:20 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10040, &(0x7f0000000140)={{}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x9}}, {@default_permissions}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x683}}], [{@func={'func', 0x3d, 'KEXEC_KERNEL_CHECK'}}, {@uid_eq}, {@hash}, {@smackfsdef={'smackfsdef', 0x3d, 'user_id'}}, {@obj_user={'obj_user', 0x3d, '.{$]&}@,'}}]}}, 0x1, 0x0, &(0x7f0000000280)="cadfea566696d34707a9ca1e") r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) fsconfig$FSCONFIG_SET_PATH(r3, 0x3, &(0x7f00000002c0)='uid', &(0x7f0000000380)='./file0\x00', r4) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) [ 1671.138785][T16664] fuse: Bad value for 'fd' 14:43:20 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$cgroup(r0, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount_setattr(r1, &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000000c0)={0xf1, 0x8, 0x1e0000, {r0}}, 0x20) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xee00, r2}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r3, 0xc0189371, &(0x7f0000000140)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r3, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) (async) openat(r4, &(0x7f0000000180)='./file0\x00', 0x0, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) [ 1671.183223][T16673] overlayfs: missing 'lowerdir' [ 1671.190472][T16664] fuse: Bad value for 'fd' [ 1671.203673][T16668] fuse: Bad value for 'fd' 14:43:20 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB]) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000380)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000380)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) mount_setattr(r2, &(0x7f0000000340)='./file0\x00', 0x8000, &(0x7f00000003c0)={0x1, 0x81, 0x180000, {r3}}, 0x20) quotactl$Q_GETQUOTA(0xffffffff80000700, &(0x7f0000000080)=@md0, r1, &(0x7f0000000200)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000280)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) mount_setattr(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x900, &(0x7f00000002c0)={0x100000, 0x7, 0xa0000, {r4}}, 0x20) (async) mount_setattr(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x900, &(0x7f00000002c0)={0x100000, 0x7, 0xa0000, {r4}}, 0x20) 14:43:20 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x78) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x78) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000000)=']\x00', 0x0, r0) fspick(r0, &(0x7f0000000040)='./file0\x00', 0x1) read$ptp(r0, 0x0, 0x0) [ 1671.231459][T16679] fuse: Bad value for 'fd' 14:43:20 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x0, 0xee01}}, './file0\x00'}) open_tree(r1, &(0x7f0000000100)='./file0\x00', 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:20 executing program 0: ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8}}, './file0\x00'}) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) r1 = openat$cgroup_pressure(r0, &(0x7f0000000240)='cpu.pressure\x00', 0x2, 0x0) r2 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x90000, &(0x7f0000000180)=ANY=[@ANYRES32=r1]) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f00000001c0)=ANY=[@ANYBLOB="93e02945b92961393c4501000021000000800018000800", @ANYRES32=r2, @ANYBLOB="02000000070000002e2f66696c653000"]) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0xc018937a, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x10001}}, './file0\x00'}) [ 1671.262979][T16679] fuse: Bad value for 'fd' 14:43:20 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10040, &(0x7f0000000140)={{}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x9}}, {@default_permissions}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x683}}], [{@func={'func', 0x3d, 'KEXEC_KERNEL_CHECK'}}, {@uid_eq}, {@hash}, {@smackfsdef={'smackfsdef', 0x3d, 'user_id'}}, {@obj_user={'obj_user', 0x3d, '.{$]&}@,'}}]}}, 0x1, 0x0, &(0x7f0000000280)="cadfea566696d34707a9ca1e") r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) fsconfig$FSCONFIG_SET_PATH(r3, 0x3, &(0x7f00000002c0)='uid', &(0x7f0000000380)='./file0\x00', r4) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10040, &(0x7f0000000140)={{}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x9}}, {@default_permissions}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x683}}], [{@func={'func', 0x3d, 'KEXEC_KERNEL_CHECK'}}, {@uid_eq}, {@hash}, {@smackfsdef={'smackfsdef', 0x3d, 'user_id'}}, {@obj_user={'obj_user', 0x3d, '.{$]&}@,'}}]}}, 0x1, 0x0, &(0x7f0000000280)="cadfea566696d34707a9ca1e") (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) (async) fsconfig$FSCONFIG_SET_PATH(r3, 0x3, &(0x7f00000002c0)='uid', &(0x7f0000000380)='./file0\x00', r4) (async) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:20 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f455a64dbd77570df12ad89996fe881863a2685fd7eb68e4f9d45b9133dfc78f786320716348781db2f3962940b189961382fbdba2deda2", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1671.297481][T16684] overlayfs: missing 'lowerdir' [ 1671.314439][T16686] fuse: Bad value for 'fd' 14:43:20 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='L']) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100), 0x48c03, 0x0) r1 = epoll_create(0x7) epoll_pwait(r1, &(0x7f0000001340)=[{}], 0x1, 0x0, 0x0, 0x0) r2 = open_tree(r0, &(0x7f0000000140)='./file0\x00', 0x1000) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x4e24, @rand_addr=0x64010102}}}, 0x90) openat$incfs(0xffffffffffffff9c, &(0x7f0000000180)='.log\x00', 0xa8000, 0x22) 14:43:20 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x121840, 0x0) mknodat$null(r0, &(0x7f0000000080)='./file0\x00', 0x8000, 0x103) 14:43:20 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x78) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async, rerun: 64) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000000)=']\x00', 0x0, r0) fspick(r0, &(0x7f0000000040)='./file0\x00', 0x1) (async) read$ptp(r0, 0x0, 0x0) 14:43:20 executing program 0: mremap(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x1000, 0x7, &(0x7f0000ffd000/0x1000)=nil) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1671.424033][T16697] fuse: Bad value for 'fd' 14:43:20 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x121840, 0x0) (async) mknodat$null(r0, &(0x7f0000000080)='./file0\x00', 0x8000, 0x103) 14:43:20 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) read$ptp(r0, 0x0, 0x0) [ 1671.460451][T16705] fuse: Bad value for 'fd' [ 1671.464445][T16704] overlay: Unknown parameter 'L' [ 1671.483878][T16708] fuse: Bad value for 'fd' [ 1671.503842][T16709] fuse: Bad value for 'fd' 14:43:20 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='L']) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100), 0x48c03, 0x0) (async) r1 = epoll_create(0x7) epoll_pwait(r1, &(0x7f0000001340)=[{}], 0x1, 0x0, 0x0, 0x0) (async) r2 = open_tree(r0, &(0x7f0000000140)='./file0\x00', 0x1000) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x4e24, @rand_addr=0x64010102}}}, 0x90) openat$incfs(0xffffffffffffff9c, &(0x7f0000000180)='.log\x00', 0xa8000, 0x22) 14:43:20 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000040), 0x121840, 0x0) mknodat$null(r0, &(0x7f0000000080)='./file0\x00', 0x8000, 0x103) [ 1671.514767][T16697] fuse: Bad value for 'fd' [ 1671.533416][T16705] fuse: Bad value for 'fd' 14:43:20 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f455a64dbd77570df12ad89996fe881863a2685fd7eb68e4f9d45b9133dfc78f786320716348781db2f3962940b189961382fbdba2deda2", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:20 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10040, &(0x7f0000000140)={{}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x9}}, {@default_permissions}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x683}}], [{@func={'func', 0x3d, 'KEXEC_KERNEL_CHECK'}}, {@uid_eq}, {@hash}, {@smackfsdef={'smackfsdef', 0x3d, 'user_id'}}, {@obj_user={'obj_user', 0x3d, '.{$]&}@,'}}]}}, 0x1, 0x0, &(0x7f0000000280)="cadfea566696d34707a9ca1e") r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) fsconfig$FSCONFIG_SET_PATH(r3, 0x3, &(0x7f00000002c0)='uid', &(0x7f0000000380)='./file0\x00', r4) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x10040, &(0x7f0000000140)={{}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x9}}, {@default_permissions}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x683}}], [{@func={'func', 0x3d, 'KEXEC_KERNEL_CHECK'}}, {@uid_eq}, {@hash}, {@smackfsdef={'smackfsdef', 0x3d, 'user_id'}}, {@obj_user={'obj_user', 0x3d, '.{$]&}@,'}}]}}, 0x1, 0x0, &(0x7f0000000280)="cadfea566696d34707a9ca1e") (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) (async) fsconfig$FSCONFIG_SET_PATH(r3, 0x3, &(0x7f00000002c0)='uid', &(0x7f0000000380)='./file0\x00', r4) (async) unlinkat(r1, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:20 executing program 0: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c75cc6f00705f69643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1671.604763][T16721] overlay: Unknown parameter 'L' 14:43:20 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='L']) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100), 0x48c03, 0x0) epoll_create(0x7) (async) r1 = epoll_create(0x7) epoll_pwait(r1, &(0x7f0000001340)=[{}], 0x1, 0x0, 0x0, 0x0) r2 = open_tree(r0, &(0x7f0000000140)='./file0\x00', 0x1000) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x4e24, @rand_addr=0x64010102}}}, 0x90) (async) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x4e24, @rand_addr=0x64010102}}}, 0x90) openat$incfs(0xffffffffffffff9c, &(0x7f0000000180)='.log\x00', 0xa8000, 0x22) 14:43:20 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f455a64dbd77570df12ad89996fe881863a2685fd7eb68e4f9d45b9133dfc78f786320716348781db2f3962940b189961382fbdba2deda2", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1671.640116][T16725] fuse: Bad value for 'fd' 14:43:20 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x109341, 0xfd) [ 1671.693697][T16731] fuse: Bad value for 'fd' [ 1671.700525][T16732] fuse: Bad value for 'fd' [ 1671.712342][T16734] overlay: Unknown parameter 'L' 14:43:20 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="5c48dcf9d8579d5b89daec65326a5cbe875444d17f23024dd5cb57a0483da88bf012c6851c915fb0143485daab4917c8cbf5d89cf3b54851305e8ac8327ad46f14f00cd37c096e57c675488b03995c6a428899130043d897d7bf74e9fdf70100008055ad01ee4000bf592359c6705d9daed26a91724e20d8151e00000000", @ANYBLOB="1c06c6f51a491908d9f5c402dc81d7f86dd5e138c95c61211f7e5b753f404bc775f48e"]) 14:43:20 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000280)=ANY=[@ANYBLOB="9c2d5a1f43038981a7fa32dd15fbfb6e2f6f000010000000000000"], 0xffffffffffffffff, &(0x7f0000000140)={0x9, 0xc000000000000000, 0x7ff, 0x100000000, 0x200, 0x10001, 0x4, 0x4, 0x7}) 14:43:20 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000040)='./file0/file0\x00', 0x200) [ 1671.743763][T16739] fuse: Bad value for 'fd' [ 1671.748956][T16732] fuse: Bad value for 'fd' [ 1671.767208][T16732] fuse: Bad value for 'fd' [ 1671.784161][T16741] fuse: Bad value for 'fd' [ 1671.830610][T16748] fuse: Bad value for 'fd' [ 1671.853591][T16750] overlay: Unknown parameter '\HÜùØW[‰Úìe2j\¾‡TDÑ#MÕËW H' [ 1671.887894][T16751] overlay: Unknown parameter 'subj_role' [ 1671.897451][T16751] overlay: Unknown parameter 'ÿÿÿÿ' 14:43:21 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x0, @inherit={0x48, &(0x7f0000001340)={0x0, 0x0, 0x7, 0x33, {0x9, 0x80, 0xfe, 0x10000, 0x10000}}}, @devid}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000140)={0x9, 0x108, 0xfa00, {r2, 0x9, "cd6168", "d521a2d5058cb9d0448b905bf2219a2ae3de581262ff8496dd8c520463f88cd3161fa29e265c709537df8177d5fe0ebfe3e9369504ac3089e513bcdbbc2b95444cc9c26d8fd622951e99ce88b92ec49dba34bf06b1aad1a3c1739615b55fb21436bdd9fa215feb29c6e9b02e6694c55b7977b6affad39d07be8b7375f23ea748b999497af6a4a4929cc9930c057adcffdbd7ff5716d6693dafaea4ae749d8979b715526d9f352d663bc8c4a43a283276a757ad79417873be05121df804864a5869a33f44de02455ed20bf17b3a5a76c7677f57474e67f3044821a0664c7ae7f2771be277bb780801a3c1db7b4f83a72be3ec6bba1112d9fe93b328c7196d27a8"}}, 0x110) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:21 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x109341, 0xfd) openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x109341, 0xfd) (async) 14:43:21 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000040)='./file0/file0\x00', 0x200) 14:43:21 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="5c48dcf9d8579d5b89daec65326a5cbe875444d17f23024dd5cb57a0483da88bf012c6851c915fb0143485daab4917c8cbf5d89cf3b54851305e8ac8327ad46f14f00cd37c096e57c675488b03995c6a428899130043d897d7bf74e9fdf70100008055ad01ee4000bf592359c6705d9daed26a91724e20d8151e00000000", @ANYBLOB="1c06c6f51a491908d9f5c402dc81d7f86dd5e138c95c61211f7e5b753f404bc775f48e"]) 14:43:21 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000280)=ANY=[@ANYBLOB="9c2d5a1f43038981a7fa32dd15fbfb6e2f6f000010000000000000"], 0xffffffffffffffff, &(0x7f0000000140)={0x9, 0xc000000000000000, 0x7ff, 0x100000000, 0x200, 0x10001, 0x4, 0x4, 0x7}) 14:43:21 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) read$ptp(r0, 0x0, 0x0) 14:43:21 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x109341, 0xfd) [ 1672.419526][T16757] fuse: Bad value for 'fd' [ 1672.436139][T16760] overlay: Unknown parameter '\HÜùØW[‰Úìe2j\¾‡TDÑ#MÕËW H' [ 1672.446414][T16758] fuse: Bad value for 'fd' 14:43:21 executing program 3: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(r0, &(0x7f0000000040)='./file0/file0\x00', 0x200) (async) unlinkat(r0, &(0x7f0000000040)='./file0/file0\x00', 0x200) 14:43:21 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x0, @inherit={0x48, &(0x7f0000001340)={0x0, 0x0, 0x7, 0x33, {0x9, 0x80, 0xfe, 0x10000, 0x10000}}}, @devid}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000140)={0x9, 0x108, 0xfa00, {r2, 0x9, "cd6168", "d521a2d5058cb9d0448b905bf2219a2ae3de581262ff8496dd8c520463f88cd3161fa29e265c709537df8177d5fe0ebfe3e9369504ac3089e513bcdbbc2b95444cc9c26d8fd622951e99ce88b92ec49dba34bf06b1aad1a3c1739615b55fb21436bdd9fa215feb29c6e9b02e6694c55b7977b6affad39d07be8b7375f23ea748b999497af6a4a4929cc9930c057adcffdbd7ff5716d6693dafaea4ae749d8979b715526d9f352d663bc8c4a43a283276a757ad79417873be05121df804864a5869a33f44de02455ed20bf17b3a5a76c7677f57474e67f3044821a0664c7ae7f2771be277bb780801a3c1db7b4f83a72be3ec6bba1112d9fe93b328c7196d27a8"}}, 0x110) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:21 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="5c48dcf9d8579d5b89daec65326a5cbe875444d17f23024dd5cb57a0483da88bf012c6851c915fb0143485daab4917c8cbf5d89cf3b54851305e8ac8327ad46f14f00cd37c096e57c675488b03995c6a428899130043d897d7bf74e9fdf70100008055ad01ee4000bf592359c6705d9daed26a91724e20d8151e00000000", @ANYBLOB="1c06c6f51a491908d9f5c402dc81d7f86dd5e138c95c61211f7e5b753f404bc775f48e"]) [ 1672.472499][T16761] overlay: Unknown parameter 'subj_role' [ 1672.507380][T16761] overlay: Unknown parameter 'ÿÿÿÿ' 14:43:21 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) quotactl$Q_SETQUOTA(0xffffffff80000802, &(0x7f0000000280)=ANY=[@ANYBLOB="9c2d5a1f43038981a7fa32dd15fbfb6e2f6f000010000000000000"], 0xffffffffffffffff, &(0x7f0000000140)={0x9, 0xc000000000000000, 0x7ff, 0x100000000, 0x200, 0x10001, 0x4, 0x4, 0x7}) [ 1672.538952][T16767] fuse: Bad value for 'fd' 14:43:21 executing program 3: ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000380)={0x0, 0x7, 0x1, [0x6, 0x4, 0x3, 0x4, 0x4b], [0x4, 0x32, 0x7, 0xae09, 0x20, 0x5, 0x6e, 0x6, 0x9, 0x76b6, 0x0, 0x1e08309b, 0xfffffffffffffff9, 0x4, 0x4, 0x2, 0xfffffffffffffff9, 0x3ff, 0x6d25, 0x941, 0x1, 0x476, 0x3, 0x200000002, 0x3f, 0x7, 0x1, 0x2, 0x0, 0x80, 0x1, 0x80, 0x1, 0x6, 0x100000000007, 0x8, 0x3, 0x8, 0x7fff, 0x0, 0x6, 0x6, 0xfff, 0x1c00, 0x6, 0x10001, 0x101, 0x5, 0x80000000, 0x1, 0xd231, 0x1, 0x0, 0x2, 0x8000, 0x7fff, 0x8, 0x100000001, 0x7fff, 0x38, 0x9, 0x4, 0x3, 0x935, 0x5, 0x9, 0x5, 0x1, 0x1, 0x4, 0xfffffffffffffc01, 0x400, 0xce3b, 0x26ee, 0xdde, 0x5, 0xffffffffffffffe1, 0x5, 0x1ff, 0x401, 0x8000, 0x1f, 0x8, 0x8, 0x2, 0x3, 0x9, 0xffffffffffffffff, 0x3f, 0x6, 0x6, 0x4, 0x8000000000000008, 0x5, 0x0, 0x0, 0x4, 0x4, 0xaca4, 0x0, 0x2, 0x6, 0x3, 0x8, 0xffffffffffffff84, 0xc1e, 0x7, 0x2, 0x1, 0x3f, 0xb24, 0x101, 0x2, 0x2, 0x80000001, 0x0, 0x8c, 0x4, 0x6, 0x5, 0xfffffffffffffffe]}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000007c0)={{}, 0x0, 0x6, @unused=[0x2, 0x401, 0x0, 0xf7], @devid=r0}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1672.561538][T16768] fuse: Bad value for 'fd' 14:43:21 executing program 1: fspick(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x1) 14:43:21 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x0, @inherit={0x48, &(0x7f0000001340)={0x0, 0x0, 0x7, 0x33, {0x9, 0x80, 0xfe, 0x10000, 0x10000}}}, @devid}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000140)={0x9, 0x108, 0xfa00, {r2, 0x9, "cd6168", "d521a2d5058cb9d0448b905bf2219a2ae3de581262ff8496dd8c520463f88cd3161fa29e265c709537df8177d5fe0ebfe3e9369504ac3089e513bcdbbc2b95444cc9c26d8fd622951e99ce88b92ec49dba34bf06b1aad1a3c1739615b55fb21436bdd9fa215feb29c6e9b02e6694c55b7977b6affad39d07be8b7375f23ea748b999497af6a4a4929cc9930c057adcffdbd7ff5716d6693dafaea4ae749d8979b715526d9f352d663bc8c4a43a283276a757ad79417873be05121df804864a5869a33f44de02455ed20bf17b3a5a76c7677f57474e67f3044821a0664c7ae7f2771be277bb780801a3c1db7b4f83a72be3ec6bba1112d9fe93b328c7196d27a8"}}, 0x110) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x0, @inherit={0x48, &(0x7f0000001340)={0x0, 0x0, 0x7, 0x33, {0x9, 0x80, 0xfe, 0x10000, 0x10000}}}, @devid}) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040), 0x2, 0x1}}, 0x20) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000140)={0x9, 0x108, 0xfa00, {r2, 0x9, "cd6168", "d521a2d5058cb9d0448b905bf2219a2ae3de581262ff8496dd8c520463f88cd3161fa29e265c709537df8177d5fe0ebfe3e9369504ac3089e513bcdbbc2b95444cc9c26d8fd622951e99ce88b92ec49dba34bf06b1aad1a3c1739615b55fb21436bdd9fa215feb29c6e9b02e6694c55b7977b6affad39d07be8b7375f23ea748b999497af6a4a4929cc9930c057adcffdbd7ff5716d6693dafaea4ae749d8979b715526d9f352d663bc8c4a43a283276a757ad79417873be05121df804864a5869a33f44de02455ed20bf17b3a5a76c7677f57474e67f3044821a0664c7ae7f2771be277bb780801a3c1db7b4f83a72be3ec6bba1112d9fe93b328c7196d27a8"}}, 0x110) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) [ 1672.601295][T16772] overlay: Unknown parameter '\HÜùØW[‰Úìe2j\¾‡TDÑ#MÕËW H' 14:43:21 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00']) 14:43:21 executing program 1: fspick(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x1) 14:43:21 executing program 3: ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000380)={0x0, 0x7, 0x1, [0x6, 0x4, 0x3, 0x4, 0x4b], [0x4, 0x32, 0x7, 0xae09, 0x20, 0x5, 0x6e, 0x6, 0x9, 0x76b6, 0x0, 0x1e08309b, 0xfffffffffffffff9, 0x4, 0x4, 0x2, 0xfffffffffffffff9, 0x3ff, 0x6d25, 0x941, 0x1, 0x476, 0x3, 0x200000002, 0x3f, 0x7, 0x1, 0x2, 0x0, 0x80, 0x1, 0x80, 0x1, 0x6, 0x100000000007, 0x8, 0x3, 0x8, 0x7fff, 0x0, 0x6, 0x6, 0xfff, 0x1c00, 0x6, 0x10001, 0x101, 0x5, 0x80000000, 0x1, 0xd231, 0x1, 0x0, 0x2, 0x8000, 0x7fff, 0x8, 0x100000001, 0x7fff, 0x38, 0x9, 0x4, 0x3, 0x935, 0x5, 0x9, 0x5, 0x1, 0x1, 0x4, 0xfffffffffffffc01, 0x400, 0xce3b, 0x26ee, 0xdde, 0x5, 0xffffffffffffffe1, 0x5, 0x1ff, 0x401, 0x8000, 0x1f, 0x8, 0x8, 0x2, 0x3, 0x9, 0xffffffffffffffff, 0x3f, 0x6, 0x6, 0x4, 0x8000000000000008, 0x5, 0x0, 0x0, 0x4, 0x4, 0xaca4, 0x0, 0x2, 0x6, 0x3, 0x8, 0xffffffffffffff84, 0xc1e, 0x7, 0x2, 0x1, 0x3f, 0xb24, 0x101, 0x2, 0x2, 0x80000001, 0x0, 0x8c, 0x4, 0x6, 0x5, 0xfffffffffffffffe]}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000007c0)={{}, 0x0, 0x6, @unused=[0x2, 0x401, 0x0, 0xf7], @devid=r0}) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1672.647114][T16774] overlay: Unknown parameter 'subj_role' [ 1672.663268][T16776] fuse: Bad value for 'fd' [ 1672.686038][T16780] fuse: Bad value for 'fd' [ 1672.688092][T16774] overlay: Unknown parameter 'ÿÿÿÿ' [ 1672.740072][T16783] overlayfs: missing 'lowerdir' [ 1672.766533][T16786] fuse: Bad value for 'fd' 14:43:22 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) read$ptp(r0, 0x0, 0x0) 14:43:22 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:22 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) 14:43:22 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00']) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00']) 14:43:22 executing program 1: fspick(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x1) 14:43:22 executing program 3: ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000380)={0x0, 0x7, 0x1, [0x6, 0x4, 0x3, 0x4, 0x4b], [0x4, 0x32, 0x7, 0xae09, 0x20, 0x5, 0x6e, 0x6, 0x9, 0x76b6, 0x0, 0x1e08309b, 0xfffffffffffffff9, 0x4, 0x4, 0x2, 0xfffffffffffffff9, 0x3ff, 0x6d25, 0x941, 0x1, 0x476, 0x3, 0x200000002, 0x3f, 0x7, 0x1, 0x2, 0x0, 0x80, 0x1, 0x80, 0x1, 0x6, 0x100000000007, 0x8, 0x3, 0x8, 0x7fff, 0x0, 0x6, 0x6, 0xfff, 0x1c00, 0x6, 0x10001, 0x101, 0x5, 0x80000000, 0x1, 0xd231, 0x1, 0x0, 0x2, 0x8000, 0x7fff, 0x8, 0x100000001, 0x7fff, 0x38, 0x9, 0x4, 0x3, 0x935, 0x5, 0x9, 0x5, 0x1, 0x1, 0x4, 0xfffffffffffffc01, 0x400, 0xce3b, 0x26ee, 0xdde, 0x5, 0xffffffffffffffe1, 0x5, 0x1ff, 0x401, 0x8000, 0x1f, 0x8, 0x8, 0x2, 0x3, 0x9, 0xffffffffffffffff, 0x3f, 0x6, 0x6, 0x4, 0x8000000000000008, 0x5, 0x0, 0x0, 0x4, 0x4, 0xaca4, 0x0, 0x2, 0x6, 0x3, 0x8, 0xffffffffffffff84, 0xc1e, 0x7, 0x2, 0x1, 0x3f, 0xb24, 0x101, 0x2, 0x2, 0x80000001, 0x0, 0x8c, 0x4, 0x6, 0x5, 0xfffffffffffffffe]}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000007c0)={{}, 0x0, 0x6, @unused=[0x2, 0x401, 0x0, 0xf7], @devid=r0}) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1673.326264][T16791] overlayfs: missing 'lowerdir' 14:43:22 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x80343, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fchownat(r1, &(0x7f0000000080)='./file0\x00', 0xee00, 0xee01, 0x100) epoll_wait(0xffffffffffffffff, &(0x7f0000000000)=[{}, {}, {}, {}, {}], 0x5, 0x5) [ 1673.350922][T16795] fuse: Bad value for 'fd' [ 1673.357297][T16799] overlayfs: missing 'lowerdir' [ 1673.362629][T16796] overlay: Unknown parameter 'subj_role' [ 1673.368673][T16797] fuse: Bad value for 'fd' 14:43:22 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:22 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\x00']) 14:43:22 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000140)={0x8, 0x120, 0xfa00, {0x3, {0x7, 0x1, "0fa097e3501bc95100a135ff58795eed77812a30c405eb308030757799f45c7d1f4d7725e35f4af7b09edfee6f9893612bd87aea97a2bfa50358489ca2d47b572ef6c0477247d424fb7358989f4a7bb3725d069bb70d677659a22123fa1a1bbc0b54b4fd7bf992e729cf61c36ede77f98daeadf95a3f627220993c5d2d5e93915f137fe7955be1546d57fb4dc10b0ded9b1a57f53b494755a4efa40e881d8474669f8c1c4efdbaa0ff907edc12bf961c820f73c8b7db4c0dc0f6df798b7404051c156c55aba1bad69d55759e982d236c0cceb9b4110a5fd053c973b6ce37dff326091f35ea0c9edf7dff08799f30349e77fbdda4e8a6a3898b7e9e19e9491ddb", 0x2, 0x4, 0xf6, 0x3, 0x8, 0x6, 0x8}, r2}}, 0x128) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1673.392406][T16796] overlay: Unknown parameter 'ÿÿÿÿ' 14:43:22 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:22 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x80343, 0x0) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) fchownat(r1, &(0x7f0000000080)='./file0\x00', 0xee00, 0xee01, 0x100) (async) epoll_wait(0xffffffffffffffff, &(0x7f0000000000)=[{}, {}, {}, {}, {}], 0x5, 0x5) [ 1673.470398][T16807] overlayfs: missing 'lowerdir' [ 1673.488179][T16810] fuse: Bad value for 'fd' [ 1673.498483][T16811] overlay: Unknown parameter 'subj_role' [ 1673.507174][T16809] fuse: Bad value for 'fd' 14:43:23 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f00000000c0)={0x0, 0x7fff, 0xab, 0x1}) read$ptp(r0, 0x0, 0x0) 14:43:23 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r2 = epoll_create1(0x80000) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) openat$cgroup_procs(r4, &(0x7f0000000100)='tasks\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)={0x40002004}) r5 = fsmount(0xffffffffffffffff, 0x1, 0x0) r6 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000340)={{r6}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) renameat2(r4, &(0x7f0000000140)='./file0\x00', r5, &(0x7f0000001380)='./file0\x00', 0x0) fstat(r1, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f0000000180)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="44dd33666b1db2477c74d0b6037cb197b5bab96701c893e550d8f18036d1013c8e803edb1749f4ba2da44fdb5dcd52013d190c552e7a4246560bc121c0fae5212763f6c04212b03035037c93426b6e0002000000000000009acbb4f32ff6a4d71157b64a8929fbb57acd5ee0df9c94a4622d10b3af326b18180362604204adefd7167a9de9465045309aeda65b171009b342b1c636593b07b19fd48792a7f7f45132ae5704895358f4e69b09c6fc7cf44e1919861a31e0142bfcaa63bee0a9078ff4b60675808bf3571cabd300b885e679584e7e93"]) 14:43:23 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:23 executing program 0: mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:23 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000140)={0x8, 0x120, 0xfa00, {0x3, {0x7, 0x1, "0fa097e3501bc95100a135ff58795eed77812a30c405eb308030757799f45c7d1f4d7725e35f4af7b09edfee6f9893612bd87aea97a2bfa50358489ca2d47b572ef6c0477247d424fb7358989f4a7bb3725d069bb70d677659a22123fa1a1bbc0b54b4fd7bf992e729cf61c36ede77f98daeadf95a3f627220993c5d2d5e93915f137fe7955be1546d57fb4dc10b0ded9b1a57f53b494755a4efa40e881d8474669f8c1c4efdbaa0ff907edc12bf961c820f73c8b7db4c0dc0f6df798b7404051c156c55aba1bad69d55759e982d236c0cceb9b4110a5fd053c973b6ce37dff326091f35ea0c9edf7dff08799f30349e77fbdda4e8a6a3898b7e9e19e9491ddb", 0x2, 0x4, 0xf6, 0x3, 0x8, 0x6, 0x8}, r2}}, 0x128) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:23 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x80343, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x80343, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) fchownat(r1, &(0x7f0000000080)='./file0\x00', 0xee00, 0xee01, 0x100) epoll_wait(0xffffffffffffffff, &(0x7f0000000000)=[{}, {}, {}, {}, {}], 0x5, 0x5) 14:43:23 executing program 3: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000000140)={0x8, 0x120, 0xfa00, {0x3, {0x7, 0x1, "0fa097e3501bc95100a135ff58795eed77812a30c405eb308030757799f45c7d1f4d7725e35f4af7b09edfee6f9893612bd87aea97a2bfa50358489ca2d47b572ef6c0477247d424fb7358989f4a7bb3725d069bb70d677659a22123fa1a1bbc0b54b4fd7bf992e729cf61c36ede77f98daeadf95a3f627220993c5d2d5e93915f137fe7955be1546d57fb4dc10b0ded9b1a57f53b494755a4efa40e881d8474669f8c1c4efdbaa0ff907edc12bf961c820f73c8b7db4c0dc0f6df798b7404051c156c55aba1bad69d55759e982d236c0cceb9b4110a5fd053c973b6ce37dff326091f35ea0c9edf7dff08799f30349e77fbdda4e8a6a3898b7e9e19e9491ddb", 0x2, 0x4, 0xf6, 0x3, 0x8, 0x6, 0x8}, r2}}, 0x128) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:23 executing program 0: mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:23 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x4, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x6000) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000040)='group_id', &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000380)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="8cea9c78ac6a8165ba5b2012f19d091f20f4c6191b41fa747ba36486ed2aeb5853612e5d12e0040000c3000000000000000087fe0647ce4a0822fb4b828c534adc83f40ce5cd351394e78fc8526587ca487ad50d7eff103ad9daf6260f784616e968d260971a90a9dfe60d8a6466edb83c3442b17cbc8765a367e0ce519bd070094fdf02bb26727b22553aff840e7c3acc63024672ed99078251477543337ac90cf5467ca7e273362c0a0fb008c7ff8ba314aaef3408a8e0bbdf54831b1fb47b4506b8a164adbfa2c33574272cff40197be4687a174fe5b0ef57329ee1b4e3ee66a6da1be12494178ac88db8078051f814463487a70000000073886c03673a499ddf14598a4106a457eb0000864b7f"]) mknodat$null(r1, &(0x7f0000000180)='./file0\x00', 0x8, 0x103) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:23 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xe, 0x10010, r1, 0x10000000) [ 1674.297858][T16827] fuse: Bad value for 'fd' [ 1674.304827][T16829] fuse: Bad value for 'fd' [ 1674.319841][T16820] overlay: Unknown parameter 'DÝ3fk²G|tж|±—µº¹gÈ“åPØñ€6Ñ<Ž€>ÛIôº-¤OÛ]ÍR' 14:43:23 executing program 0: mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:23 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async, rerun: 64) r2 = epoll_create1(0x80000) (rerun: 64) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) (async) openat$cgroup_procs(r4, &(0x7f0000000100)='tasks\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)={0x40002004}) (async) r5 = fsmount(0xffffffffffffffff, 0x1, 0x0) r6 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000340)={{r6}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) renameat2(r4, &(0x7f0000000140)='./file0\x00', r5, &(0x7f0000001380)='./file0\x00', 0x0) (async) fstat(r1, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f0000000180)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async, rerun: 32) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="44dd33666b1db2477c74d0b6037cb197b5bab96701c893e550d8f18036d1013c8e803edb1749f4ba2da44fdb5dcd52013d190c552e7a4246560bc121c0fae5212763f6c04212b03035037c93426b6e0002000000000000009acbb4f32ff6a4d71157b64a8929fbb57acd5ee0df9c94a4622d10b3af326b18180362604204adefd7167a9de9465045309aeda65b171009b342b1c636593b07b19fd48792a7f7f45132ae5704895358f4e69b09c6fc7cf44e1919861a31e0142bfcaa63bee0a9078ff4b60675808bf3571cabd300b885e679584e7e93"]) (rerun: 32) [ 1674.407331][T16834] fuse: Bad value for 'fd' [ 1674.437993][T16835] fuse: Bad value for 'fd' 14:43:24 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xe, 0x10010, r1, 0x10000000) 14:43:24 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f00000000c0)={0x0, 0x7fff, 0xab, 0x1}) read$ptp(r0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r1, &(0x7f0000003880)) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f00000000c0)={0x0, 0x7fff, 0xab, 0x1}) (async) read$ptp(r0, 0x0, 0x0) (async) 14:43:24 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x4, 0x0, 0x0) (async) newfstatat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x6000) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000040)='group_id', &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000380)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="8cea9c78ac6a8165ba5b2012f19d091f20f4c6191b41fa747ba36486ed2aeb5853612e5d12e0040000c3000000000000000087fe0647ce4a0822fb4b828c534adc83f40ce5cd351394e78fc8526587ca487ad50d7eff103ad9daf6260f784616e968d260971a90a9dfe60d8a6466edb83c3442b17cbc8765a367e0ce519bd070094fdf02bb26727b22553aff840e7c3acc63024672ed99078251477543337ac90cf5467ca7e273362c0a0fb008c7ff8ba314aaef3408a8e0bbdf54831b1fb47b4506b8a164adbfa2c33574272cff40197be4687a174fe5b0ef57329ee1b4e3ee66a6da1be12494178ac88db8078051f814463487a70000000073886c03673a499ddf14598a4106a457eb0000864b7f"]) mknodat$null(r1, &(0x7f0000000180)='./file0\x00', 0x8, 0x103) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:24 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1a0482, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:24 executing program 0: syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:24 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r2 = epoll_create1(0x80000) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) openat$cgroup_procs(r4, &(0x7f0000000100)='tasks\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)={0x40002004}) (async) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)={0x40002004}) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r5 = fsmount(0xffffffffffffffff, 0x1, 0x0) r6 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000340)={{r6}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) renameat2(r4, &(0x7f0000000140)='./file0\x00', r5, &(0x7f0000001380)='./file0\x00', 0x0) fstat(r1, &(0x7f0000003880)) (async) fstat(r1, &(0x7f0000003880)) ioctl$VFAT_IOCTL_READDIR_SHORT(r1, 0x82307202, &(0x7f0000000180)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="44dd33666b1db2477c74d0b6037cb197b5bab96701c893e550d8f18036d1013c8e803edb1749f4ba2da44fdb5dcd52013d190c552e7a4246560bc121c0fae5212763f6c04212b03035037c93426b6e0002000000000000009acbb4f32ff6a4d71157b64a8929fbb57acd5ee0df9c94a4622d10b3af326b18180362604204adefd7167a9de9465045309aeda65b171009b342b1c636593b07b19fd48792a7f7f45132ae5704895358f4e69b09c6fc7cf44e1919861a31e0142bfcaa63bee0a9078ff4b60675808bf3571cabd300b885e679584e7e93"]) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="44dd33666b1db2477c74d0b6037cb197b5bab96701c893e550d8f18036d1013c8e803edb1749f4ba2da44fdb5dcd52013d190c552e7a4246560bc121c0fae5212763f6c04212b03035037c93426b6e0002000000000000009acbb4f32ff6a4d71157b64a8929fbb57acd5ee0df9c94a4622d10b3af326b18180362604204adefd7167a9de9465045309aeda65b171009b342b1c636593b07b19fd48792a7f7f45132ae5704895358f4e69b09c6fc7cf44e1919861a31e0142bfcaa63bee0a9078ff4b60675808bf3571cabd300b885e679584e7e93"]) [ 1675.144132][T16850] fuse: Bad value for 'fd' 14:43:24 executing program 0: syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:24 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1a0482, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1a0482, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) 14:43:24 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x4, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x6000) (async) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000040)='group_id', &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000380)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="8cea9c78ac6a8165ba5b2012f19d091f20f4c6191b41fa747ba36486ed2aeb5853612e5d12e0040000c3000000000000000087fe0647ce4a0822fb4b828c534adc83f40ce5cd351394e78fc8526587ca487ad50d7eff103ad9daf6260f784616e968d260971a90a9dfe60d8a6466edb83c3442b17cbc8765a367e0ce519bd070094fdf02bb26727b22553aff840e7c3acc63024672ed99078251477543337ac90cf5467ca7e273362c0a0fb008c7ff8ba314aaef3408a8e0bbdf54831b1fb47b4506b8a164adbfa2c33574272cff40197be4687a174fe5b0ef57329ee1b4e3ee66a6da1be12494178ac88db8078051f814463487a70000000073886c03673a499ddf14598a4106a457eb0000864b7f"]) mknodat$null(r1, &(0x7f0000000180)='./file0\x00', 0x8, 0x103) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:24 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xe, 0x10010, r1, 0x10000000) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0xe, 0x10010, r1, 0x10000000) (async) 14:43:24 executing program 0: syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:24 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001700)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000fb01000000000000000000000000002a1fde987e18ed15a4fe1205ae3702d3274d7b833f701dbcce3d31e35ecdf7c1907b951a35d1c3e42cdd5f91a6bcee11efbc0487984340620a870e6438d8f56743eeb4d3"]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="04000000fb097a128fc6597b6c65300021ad617d36"]) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x80800, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d30303030303020303030303030303031303030303030302c757365525f69643d5d736a7ab317afe3327be6a40e33df11841d1a9b623d06adac8fff7a4bedf532df2d55db134120dd2dd8bf7cf2172c267d64b16175761f7ca1089c6ae675643339e79500a9aa8b9409569a62e3da22dfc92dc3fa91026a1cbd5823df9cf24f513ebfae63a9fa6d585d46b5dd2f4e826ab97520728e75e0aa9ee2156ad06870de615ebcc42980f3203105471fa588c32563b60b5dc8d271dec87ce6de12d6f84d3e6147394ff6faf6c73e416953210d", @ANYRESDEC=0x0, @ANYBLOB="2c77726fa3ee9ec240398b1c49563475705f69643db61ebe63128e46ee25b5c1aff81408a597b783a621f55ce6299123ec685a61a1d459e32bd924667bc3781d4c70bd46ce28d96031da6f06ad9b32bb22a234040829739fea3c72fc7df865325210156bfb13b89a79cf04301faaf1ed3a12ce53ffbdee19271f4ea05e73a0c07a65bdbe455d1b45e611a92dd636a1f01cf14f588fb634040939e342f6aede247d27d6395b731b4e7e3e476b5339779dbb9cad0492312e2718c57ee4bf10bd121d10b48a717a1f540b00e8d3b457acf5a37be9", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000000000000100000000000000070000759002ed66db42c5000000000009000000000000008000000000000000ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r3, 0xc0506617, &(0x7f0000000180)={@desc={0x1, 0x0, @desc1}, 0x40, 0x0, '\x00', @a}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000100)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) r5 = fsopen(&(0x7f0000000280)='ubifs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000015c0)={{0x1, 0x1, 0x18, r5, {0x3}}, './file0\x00'}) ioctl$VFAT_IOCTL_READDIR_SHORT(r4, 0x82307202, &(0x7f0000001380)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 14:43:24 executing program 4: openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f00000000c0)={0x0, 0x7fff, 0xab, 0x1}) read$ptp(r0, 0x0, 0x0) [ 1675.236989][T16861] overlay: Unknown parameter 'DÝ3fk²G|tж|±—µº¹gÈ“åPØñ€6Ñ<Ž€>ÛIôº-¤OÛ]ÍR' [ 1675.249094][T16864] fuse: Bad value for 'fd' [ 1675.272102][T16860] overlay: Unknown parameter 'DÝ3fk²G|tж|±—µº¹gÈ“åPØñ€6Ñ<Ž€>ÛIôº-¤OÛ]ÍR' 14:43:24 executing program 3: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1a0482, &(0x7f0000000300), 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x1a0482, &(0x7f0000000300), 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:24 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1000) read$FUSE(r1, &(0x7f0000000100)={0x2020}, 0x2020) 14:43:24 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:24 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {r2, 0x8}}, 0x10) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0xffff}}, './file0\x00'}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r3, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f0000000140), 0x4, {0xa, 0x4e24, 0x27, @dev={0xfe, 0x80, '\x00', 0x32}, 0x765}, r2}}, 0x38) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:24 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 32) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (rerun: 32) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001700)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000fb01000000000000000000000000002a1fde987e18ed15a4fe1205ae3702d3274d7b833f701dbcce3d31e35ecdf7c1907b951a35d1c3e42cdd5f91a6bcee11efbc0487984340620a870e6438d8f56743eeb4d3"]}, @subvolid=0x1}) (async, rerun: 32) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="04000000fb097a128fc6597b6c65300021ad617d36"]) (async, rerun: 32) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x80800, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d30303030303020303030303030303031303030303030302c757365525f69643d5d736a7ab317afe3327be6a40e33df11841d1a9b623d06adac8fff7a4bedf532df2d55db134120dd2dd8bf7cf2172c267d64b16175761f7ca1089c6ae675643339e79500a9aa8b9409569a62e3da22dfc92dc3fa91026a1cbd5823df9cf24f513ebfae63a9fa6d585d46b5dd2f4e826ab97520728e75e0aa9ee2156ad06870de615ebcc42980f3203105471fa588c32563b60b5dc8d271dec87ce6de12d6f84d3e6147394ff6faf6c73e416953210d", @ANYRESDEC=0x0, @ANYBLOB="2c77726fa3ee9ec240398b1c49563475705f69643db61ebe63128e46ee25b5c1aff81408a597b783a621f55ce6299123ec685a61a1d459e32bd924667bc3781d4c70bd46ce28d96031da6f06ad9b32bb22a234040829739fea3c72fc7df865325210156bfb13b89a79cf04301faaf1ed3a12ce53ffbdee19271f4ea05e73a0c07a65bdbe455d1b45e611a92dd636a1f01cf14f588fb634040939e342f6aede247d27d6395b731b4e7e3e476b5339779dbb9cad0492312e2718c57ee4bf10bd121d10b48a717a1f540b00e8d3b457acf5a37be9", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000000000000100000000000000070000759002ed66db42c5000000000009000000000000008000000000000000ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) (async, rerun: 64) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async, rerun: 64) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r3, 0xc0506617, &(0x7f0000000180)={@desc={0x1, 0x0, @desc1}, 0x40, 0x0, '\x00', @a}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000100)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r4, &(0x7f0000003880)) (async) r5 = fsopen(&(0x7f0000000280)='ubifs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000015c0)={{0x1, 0x1, 0x18, r5, {0x3}}, './file0\x00'}) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r4, 0x82307202, &(0x7f0000001380)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 14:43:24 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) unlinkat(r2, &(0x7f0000000140)='./file0/file0\x00', 0x200) 14:43:24 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {r2, 0x8}}, 0x10) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0xffff}}, './file0\x00'}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r3, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f0000000140), 0x4, {0xa, 0x4e24, 0x27, @dev={0xfe, 0x80, '\x00', 0x32}, 0x765}, r2}}, 0x38) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040), 0x111, 0x4}}, 0x20) (async) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {r2, 0x8}}, 0x10) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0xffff}}, './file0\x00'}) (async) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r3, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f0000000140), 0x4, {0xa, 0x4e24, 0x27, @dev={0xfe, 0x80, '\x00', 0x32}, 0x765}, r2}}, 0x38) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) 14:43:24 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:24 executing program 2: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f0000001700)=ANY=[@ANYBLOB="000000000000000001000000000000000700000000000000000000000000000009000000000000008000000000000000ff00000000000000000000000000000000fb01000000000000000000000000002a1fde987e18ed15a4fe1205ae3702d3274d7b833f701dbcce3d31e35ecdf7c1907b951a35d1c3e42cdd5f91a6bcee11efbc0487984340620a870e6438d8f56743eeb4d3"]}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="04000000fb097a128fc6597b6c65300021ad617d36"]) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x80800, &(0x7f00000017c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d30303030303020303030303030303031303030303030302c757365525f69643d5d736a7ab317afe3327be6a40e33df11841d1a9b623d06adac8fff7a4bedf532df2d55db134120dd2dd8bf7cf2172c267d64b16175761f7ca1089c6ae675643339e79500a9aa8b9409569a62e3da22dfc92dc3fa91026a1cbd5823df9cf24f513ebfae63a9fa6d585d46b5dd2f4e826ab97520728e75e0aa9ee2156ad06870de615ebcc42980f3203105471fa588c32563b60b5dc8d271dec87ce6de12d6f84d3e6147394ff6faf6c73e416953210d", @ANYRESDEC=0x0, @ANYBLOB="2c77726fa3ee9ec240398b1c49563475705f69643db61ebe63128e46ee25b5c1aff81408a597b783a621f55ce6299123ec685a61a1d459e32bd924667bc3781d4c70bd46ce28d96031da6f06ad9b32bb22a234040829739fea3c72fc7df865325210156bfb13b89a79cf04301faaf1ed3a12ce53ffbdee19271f4ea05e73a0c07a65bdbe455d1b45e611a92dd636a1f01cf14f588fb634040939e342f6aede247d27d6395b731b4e7e3e476b5339779dbb9cad0492312e2718c57ee4bf10bd121d10b48a717a1f540b00e8d3b457acf5a37be9", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) (async) r2 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async, rerun: 64) r3 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (rerun: 64) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000000340)={{r3}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000000000000100000000000000070000759002ed66db42c5000000000009000000000000008000000000000000ff00000000000000000000000000000000000100"/80]}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) (async) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r3, 0xc0506617, &(0x7f0000000180)={@desc={0x1, 0x0, @desc1}, 0x40, 0x0, '\x00', @a}) (async, rerun: 32) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (rerun: 32) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000100)={@id={0x2, 0x0, @b}, 0x21, 0x0, '\x00', @c}) (async, rerun: 64) r4 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (rerun: 64) fstat(r4, &(0x7f0000003880)) r5 = fsopen(&(0x7f0000000280)='ubifs\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000015c0)={{0x1, 0x1, 0x18, r5, {0x3}}, './file0\x00'}) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r4, 0x82307202, &(0x7f0000001380)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 14:43:24 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1000) (async) read$FUSE(r1, &(0x7f0000000100)={0x2020}, 0x2020) 14:43:24 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) [ 1675.554604][T16902] fuse: Bad value for 'fd' 14:43:25 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {r2, 0x8}}, 0x10) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0xffff}}, './file0\x00'}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r3, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f0000000140), 0x4, {0xa, 0x4e24, 0x27, @dev={0xfe, 0x80, '\x00', 0x32}, 0x765}, r2}}, 0x38) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040), 0x111, 0x4}}, 0x20) (async) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {r2, 0x8}}, 0x10) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r1, 0xc0189372, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0, {0xffff}}, './file0\x00'}) (async) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r3, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f0000000140), 0x4, {0xa, 0x4e24, 0x27, @dev={0xfe, 0x80, '\x00', 0x32}, 0x765}, r2}}, 0x38) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) 14:43:25 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) unlinkat(r2, &(0x7f0000000140)='./file0/file0\x00', 0x200) 14:43:25 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:25 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1000) (async, rerun: 64) read$FUSE(r1, &(0x7f0000000100)={0x2020}, 0x2020) (rerun: 64) 14:43:25 executing program 2: openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f6465a081338730303030303030303030303030303030303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c726f6f74636f6e746578743d726f6f742c636f6e746578743d757365725f752c7375626a5f726f6c653d8bbc3b53b938347195c3be8dbef2142fc22c657569643c", @ANYRESDEC, @ANYBLOB=',obj_user=group_id,\x00'], 0x0, 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:25 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) [ 1676.309858][T16917] fuse: Bad value for 'fd' 14:43:25 executing program 2: openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f6465a081338730303030303030303030303030303030303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c726f6f74636f6e746578743d726f6f742c636f6e746578743d757365725f752c7375626a5f726f6c653d8bbc3b53b938347195c3be8dbef2142fc22c657569643c", @ANYRESDEC, @ANYBLOB=',obj_user=group_id,\x00'], 0x0, 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:25 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x110, r1, 0x10000000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32=r1, @ANYBLOB="04000000000000002e2f66696c653000"]) open_tree(r1, &(0x7f00000002c0)='./file0\x00', 0x81100) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r2 = openat$damon_attrs(0xffffffffffffff9c, &(0x7f0000000040), 0x8400, 0x171) ioctl$VFAT_IOCTL_READDIR_SHORT(r2, 0x82307202, &(0x7f0000000080)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 14:43:25 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = fspick(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x1) r1 = syz_mount_image$fuse(&(0x7f00000001c0), &(0x7f0000000200)='./file1\x00', 0x280018, &(0x7f0000000240)={{}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x3}}], [{@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}, {@subj_type={'subj_type', 0x3d, 'overlay\x00'}}, {@appraise}]}}, 0x1, 0x0, &(0x7f0000000300)="8873313ab12ddbda8f198425f280e22343b077376e7b") fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000100)='\x00', &(0x7f0000000180)='./file0\x00', r1) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:25 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) unlinkat(r2, &(0x7f0000000140)='./file0/file0\x00', 0x200) (async) unlinkat(r2, &(0x7f0000000140)='./file0/file0\x00', 0x200) [ 1676.365791][T16925] fuse: Bad value for 'fd' 14:43:25 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r0 = fspick(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x1) (async, rerun: 32) r1 = syz_mount_image$fuse(&(0x7f00000001c0), &(0x7f0000000200)='./file1\x00', 0x280018, &(0x7f0000000240)={{}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x3}}], [{@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}, {@subj_type={'subj_type', 0x3d, 'overlay\x00'}}, {@appraise}]}}, 0x1, 0x0, &(0x7f0000000300)="8873313ab12ddbda8f198425f280e22343b077376e7b") (rerun: 32) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000100)='\x00', &(0x7f0000000180)='./file0\x00', r1) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:25 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:25 executing program 2: openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f6465a081338730303030303030303030303030303030303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c726f6f74636f6e746578743d726f6f742c636f6e746578743d757365725f752c7375626a5f726f6c653d8bbc3b53b938347195c3be8dbef2142fc22c657569643c", @ANYRESDEC, @ANYBLOB=',obj_user=group_id,\x00'], 0x0, 0x0, 0x0) (async) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1676.450440][T16932] overlay: Unknown parameter '\' [ 1676.467325][T16933] fuse: Bad value for 'fd' 14:43:25 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x110, r1, 0x10000000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32=r1, @ANYBLOB="04000000000000002e2f66696c653000"]) open_tree(r1, &(0x7f00000002c0)='./file0\x00', 0x81100) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) r2 = openat$damon_attrs(0xffffffffffffff9c, &(0x7f0000000040), 0x8400, 0x171) ioctl$VFAT_IOCTL_READDIR_SHORT(r2, 0x82307202, &(0x7f0000000080)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 14:43:25 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) unlinkat(r2, &(0x7f0000000140)='./file0/file0\x00', 0x200) [ 1676.530630][T16937] fuse: Bad value for 'fd' 14:43:25 executing program 2: r0 = openat$damon_schemes(0xffffffffffffff9c, &(0x7f0000000040), 0x200200, 0x100) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000200)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="00000000000001402e2f66694c653000"]) r3 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="9ddc6e707f4954bb5c53afadee4c5d2c00"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) renameat2(r3, &(0x7f00000001c0)='./file0\x00', r5, &(0x7f0000000280)='./file0\x00', 0x0) [ 1676.595542][T16939] overlay: Unknown parameter '\' 14:43:25 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x110, r1, 0x10000000) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32=r1, @ANYBLOB="04000000000000002e2f66696c653000"]) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB='\x00'/12, @ANYRES32=r1, @ANYBLOB="04000000000000002e2f66696c653000"]) open_tree(r1, &(0x7f00000002c0)='./file0\x00', 0x81100) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r2 = openat$damon_attrs(0xffffffffffffff9c, &(0x7f0000000040), 0x8400, 0x171) ioctl$VFAT_IOCTL_READDIR_SHORT(r2, 0x82307202, &(0x7f0000000080)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) [ 1676.693208][T16952] fuse: Bad value for 'fd' [ 1676.693515][T16955] fuse: Bad value for 'fd' 14:43:26 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:26 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x8, @inherit={0x48, &(0x7f0000001380)=ANY=[@ANYBLOB="000000000000000000000000000067000700000000000000000000000000000009000000000000008000000000000000ff0000000000000000a139c1a4000000000001000000000013c81ca5521365e4a03c552cae030516ae963ddf003764ed83da90468e6b372fd06db87f62552e805e9197bca5cb03437dcd7d7df42e78e4dba38a39246d896c54dc4333"]}, @devid}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r0, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xbf3}}, './file0\x00'}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080), 0x501a40, 0x0) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x10002, 0x3) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f00000001c0)='.pending_reads\x00', 0x525a01, 0x12c) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) r6 = fsmount(0xffffffffffffffff, 0x1, 0x0) r7 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r7}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r7, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, r4, {0x0, 0x2}}, './file0\x00'}) r9 = openat$cgroup_type(r8, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_RESIZE(r3, 0x50009403, &(0x7f0000000140)=ANY=[@ANYRES32=r9, @ANYBLOB="0098f9a0bf5e0431d38933302441d5a64e16dd4fc01ed6802be2400dc5b5b8c68d", @ANYRESDEC=0x0, @ANYBLOB=':max']) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:26 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) unlinkat(r2, &(0x7f0000000140)='./file0/file0\x00', 0x200) 14:43:26 executing program 2: r0 = openat$damon_schemes(0xffffffffffffff9c, &(0x7f0000000040), 0x200200, 0x100) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000200)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="00000000000001402e2f66694c653000"]) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000200)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="00000000000001402e2f66694c653000"]) r3 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="9ddc6e707f4954bb5c53afadee4c5d2c00"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) renameat2(r3, &(0x7f00000001c0)='./file0\x00', r5, &(0x7f0000000280)='./file0\x00', 0x0) (async) renameat2(r3, &(0x7f00000001c0)='./file0\x00', r5, &(0x7f0000000280)='./file0\x00', 0x0) 14:43:26 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fspick(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x1) (async) r0 = fspick(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x1) r1 = syz_mount_image$fuse(&(0x7f00000001c0), &(0x7f0000000200)='./file1\x00', 0x280018, &(0x7f0000000240)={{}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x3}}], [{@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}, {@subj_type={'subj_type', 0x3d, 'overlay\x00'}}, {@appraise}]}}, 0x1, 0x0, &(0x7f0000000300)="8873313ab12ddbda8f198425f280e22343b077376e7b") fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000100)='\x00', &(0x7f0000000180)='./file0\x00', r1) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:26 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) read$ptp(r0, 0x0, 0x0) (async) 14:43:26 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) unlinkat(r2, &(0x7f0000000140)='./file0/file0\x00', 0x200) 14:43:26 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x8, @inherit={0x48, &(0x7f0000001380)=ANY=[@ANYBLOB="000000000000000000000000000067000700000000000000000000000000000009000000000000008000000000000000ff0000000000000000a139c1a4000000000001000000000013c81ca5521365e4a03c552cae030516ae963ddf003764ed83da90468e6b372fd06db87f62552e805e9197bca5cb03437dcd7d7df42e78e4dba38a39246d896c54dc4333"]}, @devid}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r0, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xbf3}}, './file0\x00'}) (async) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080), 0x501a40, 0x0) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x10002, 0x3) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f00000001c0)='.pending_reads\x00', 0x525a01, 0x12c) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) (async) r6 = fsmount(0xffffffffffffffff, 0x1, 0x0) r7 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r7}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r7, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, r4, {0x0, 0x2}}, './file0\x00'}) r9 = openat$cgroup_type(r8, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_RESIZE(r3, 0x50009403, &(0x7f0000000140)=ANY=[@ANYRES32=r9, @ANYBLOB="0098f9a0bf5e0431d38933302441d5a64e16dd4fc01ed6802be2400dc5b5b8c68d", @ANYRESDEC=0x0, @ANYBLOB=':max']) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:26 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001380)={"6586ef5b2f03a74892ae5538e10b5bb8", 0x0, 0x0, {0x1, 0x7ff}, {0x6, 0x3}, 0x7, [0x4ca7, 0x1ba0, 0x6b, 0x100, 0x2, 0x1f, 0x81, 0x80000000, 0x9, 0x3, 0x300000000000, 0x1, 0x8000000000000001, 0x3, 0x1, 0x433]}) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f0000000080)='].&\x00', &(0x7f0000000100)='./file0\x00', r3) [ 1677.272165][T16966] fuse: Bad value for 'fd' [ 1677.278350][T16968] overlay: Unknown parameter '\' [ 1677.298009][T16967] fuse: Bad value for 'fd' 14:43:26 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) 14:43:26 executing program 2: r0 = openat$damon_schemes(0xffffffffffffff9c, &(0x7f0000000040), 0x200200, 0x100) (async) r1 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r2 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000000340)={{r2}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_VERSION(r1, 0xc0189371, &(0x7f0000000200)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="00000000000001402e2f66694c653000"]) r3 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="9ddc6e707f4954bb5c53afadee4c5d2c00"], 0x0, 0x0, 0x0) (async) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) (async) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) (async) renameat2(r3, &(0x7f00000001c0)='./file0\x00', r5, &(0x7f0000000280)='./file0\x00', 0x0) [ 1677.389058][T16975] fuse: Bad value for 'fd' 14:43:26 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) [ 1677.434309][T16979] overlay: Unknown parameter '\' [ 1677.447023][T16982] fuse: Bad value for 'fd' 14:43:26 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001380)={"6586ef5b2f03a74892ae5538e10b5bb8", 0x0, 0x0, {0x1, 0x7ff}, {0x6, 0x3}, 0x7, [0x4ca7, 0x1ba0, 0x6b, 0x100, 0x2, 0x1f, 0x81, 0x80000000, 0x9, 0x3, 0x300000000000, 0x1, 0x8000000000000001, 0x3, 0x1, 0x433]}) (async) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f0000000080)='].&\x00', &(0x7f0000000100)='./file0\x00', r3) [ 1677.475781][T16986] overlay: Unknown parameter 'subj_role' [ 1677.485088][T16988] fuse: Bad value for 'fd' [ 1677.556334][T16991] overlay: Unknown parameter '\' 14:43:27 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) 14:43:27 executing program 2: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1000) read$FUSE(r1, &(0x7f0000000100)={0x2020}, 0x2020) 14:43:27 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) 14:43:27 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x8, @inherit={0x48, &(0x7f0000001380)=ANY=[@ANYBLOB="000000000000000000000000000067000700000000000000000000000000000009000000000000008000000000000000ff0000000000000000a139c1a4000000000001000000000013c81ca5521365e4a03c552cae030516ae963ddf003764ed83da90468e6b372fd06db87f62552e805e9197bca5cb03437dcd7d7df42e78e4dba38a39246d896c54dc4333"]}, @devid}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r0, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xbf3}}, './file0\x00'}) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080), 0x501a40, 0x0) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x10002, 0x3) r4 = fsmount(0xffffffffffffffff, 0x1, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f00000001c0)='.pending_reads\x00', 0x525a01, 0x12c) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) r6 = fsmount(0xffffffffffffffff, 0x1, 0x0) r7 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r7}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r7, {0x4}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, r4, {0x0, 0x2}}, './file0\x00'}) r9 = openat$cgroup_type(r8, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_RESIZE(r3, 0x50009403, &(0x7f0000000140)=ANY=[@ANYRES32=r9, @ANYBLOB="0098f9a0bf5e0431d38933302441d5a64e16dd4fc01ed6802be2400dc5b5b8c68d", @ANYRESDEC=0x0, @ANYBLOB=':max']) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x8, @inherit={0x48, &(0x7f0000001380)=ANY=[@ANYBLOB="000000000000000000000000000067000700000000000000000000000000000009000000000000008000000000000000ff0000000000000000a139c1a4000000000001000000000013c81ca5521365e4a03c552cae030516ae963ddf003764ed83da90468e6b372fd06db87f62552e805e9197bca5cb03437dcd7d7df42e78e4dba38a39246d896c54dc4333"]}, @devid}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r0, 0xc0189373, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xbf3}}, './file0\x00'}) (async) openat$mixer(0xffffffffffffff9c, &(0x7f0000000080), 0x501a40, 0x0) (async) openat(r2, &(0x7f00000000c0)='./file0\x00', 0x10002, 0x3) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f00000001c0)='.pending_reads\x00', 0x525a01, 0x12c) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r4, 0x5000943a, &(0x7f0000000340)={{r5}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r5, {0x4}}, './file0\x00'}) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r6, 0x5000943a, &(0x7f0000000340)={{r7}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r7, {0x4}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(r2, 0xc0189377, &(0x7f0000000180)={{0x1, 0x1, 0x18, r4, {0x0, 0x2}}, './file0\x00'}) (async) openat$cgroup_type(r8, &(0x7f0000000100), 0x2, 0x0) (async) ioctl$BTRFS_IOC_RESIZE(r3, 0x50009403, &(0x7f0000000140)=ANY=[@ANYRES32=r9, @ANYBLOB="0098f9a0bf5e0431d38933302441d5a64e16dd4fc01ed6802be2400dc5b5b8c68d", @ANYRESDEC=0x0, @ANYBLOB=':max']) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) 14:43:27 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, 0x0) 14:43:27 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r2, &(0x7f0000003880)) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000001380)={"6586ef5b2f03a74892ae5538e10b5bb8", 0x0, 0x0, {0x1, 0x7ff}, {0x6, 0x3}, 0x7, [0x4ca7, 0x1ba0, 0x6b, 0x100, 0x2, 0x1f, 0x81, 0x80000000, 0x9, 0x3, 0x300000000000, 0x1, 0x8000000000000001, 0x3, 0x1, 0x433]}) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f0000000080)='].&\x00', &(0x7f0000000100)='./file0\x00', r3) [ 1678.146763][T16997] overlayfs: missing 'lowerdir' 14:43:27 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x3ff) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000000440)) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000040)={0x0, 0x3f, 0x7f}) 14:43:27 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, 0x0) 14:43:27 executing program 2: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1000) read$FUSE(r1, &(0x7f0000000100)={0x2020}, 0x2020) [ 1678.169460][T17003] overlay: Unknown parameter '\' 14:43:27 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) unlinkat(r1, &(0x7f0000000080)='./file0\x00', 0x200) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) [ 1678.208546][T17004] fuse: Bad value for 'fd' 14:43:27 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:43:27 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x3ff) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000000440)) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000040)={0x0, 0x3f, 0x7f}) [ 1678.309992][T17015] overlayfs: missing 'lowerdir' [ 1678.369605][T17017] overlay: Unknown parameter '\' 14:43:28 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) 14:43:28 executing program 2: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1000) read$FUSE(r1, &(0x7f0000000100)={0x2020}, 0x2020) 14:43:28 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, 0x0) 14:43:28 executing program 3: ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:43:28 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) unlinkat(r1, &(0x7f0000000080)='./file0\x00', 0x200) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) fsmount(0xffffffffffffffff, 0x1, 0x0) (async) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) unlinkat(r1, &(0x7f0000000080)='./file0\x00', 0x200) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) 14:43:28 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x3ff) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000000440)) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000040)={0x0, 0x3f, 0x7f}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x3ff) (async) openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) fstat(r1, &(0x7f0000000440)) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000040)={0x0, 0x3f, 0x7f}) (async) 14:43:28 executing program 3: ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:43:28 executing program 2: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', r1, r2, 0x1000) 14:43:28 executing program 1: mknodat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x4, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:28 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)={[], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) [ 1679.112965][T17031] overlayfs: missing 'lowerdir' [ 1679.119429][T17029] overlay: Unknown parameter '\' [ 1679.146882][T17029] overlay: Unknown parameter '\' 14:43:28 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) unlinkat(r1, &(0x7f0000000080)='./file0\x00', 0x200) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) 14:43:28 executing program 3: ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) [ 1679.250608][T17045] overlay: Unknown parameter 'subj_role' [ 1679.308848][T17049] overlay: Unknown parameter '\' 14:43:29 executing program 2: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x1000) 14:43:29 executing program 1: mknodat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x4, 0x0) (async) mknodat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x4, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:29 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:43:29 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)) 14:43:29 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) 14:43:29 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) fspick(r1, &(0x7f0000000100)='./file0\x00', 0x0) 14:43:29 executing program 1: mknodat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x4, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:29 executing program 2: fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x1000) 14:43:29 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) [ 1680.023421][T17057] overlayfs: missing 'lowerdir' [ 1680.034116][T17060] overlay: Unknown parameter '\' 14:43:29 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) fspick(r1, &(0x7f0000000100)='./file0\x00', 0x0) 14:43:29 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)) 14:43:29 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, 0x0, 0x42002, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:43:29 executing program 2: fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x1000) 14:43:29 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) openat$incfs(r1, &(0x7f0000000000)='.log\x00', 0x241, 0x0) [ 1680.166998][T17073] overlay: Unknown parameter '\' 14:43:29 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:43:29 executing program 2: fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x1000) [ 1680.187747][T17075] overlayfs: missing 'lowerdir' 14:43:29 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) 14:43:29 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) fspick(r1, &(0x7f0000000100)='./file0\x00', 0x0) 14:43:29 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)) 14:43:29 executing program 2: syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x1000) 14:43:29 executing program 3: openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:43:29 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) openat$incfs(r1, &(0x7f0000000000)='.log\x00', 0x241, 0x0) 14:43:30 executing program 1: r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r1 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f0000000340)={{r1}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) (async) openat$incfs(r1, &(0x7f0000000000)='.log\x00', 0x241, 0x0) [ 1680.928276][T17091] overlayfs: missing 'lowerdir' 14:43:30 executing program 3: openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) 14:43:30 executing program 2: syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x1000) 14:43:30 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x40800000, 0x9}}, './file0\x00'}) mknodat$null(r1, &(0x7f0000000100)='./file0\x00', 0x10, 0x103) 14:43:30 executing program 0: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x0, 0x0) 14:43:30 executing program 3: openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18}, './file0\x00'}) [ 1681.059160][T17107] overlayfs: missing 'lowerdir' [ 1681.070901][T17109] overlay: Unknown parameter '\' 14:43:30 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x64b003, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000080)={0x0, 0x6639ff95, 0x6, 0x1}) read$ptp(r0, 0x0, 0x0) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r3, 0x50009417, &(0x7f0000000600)={{r2}, 0x0, 0xa, @inherit={0x58, &(0x7f0000000580)={0x1, 0x2, 0x3, 0x487af888, {0x4, 0x20, 0x4}, [0x2, 0x33ae]}}, @devid=r1}) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000500), 0x1ef209c497e8e179, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, &(0x7f0000000540)={{0x1, 0x1, 0x18, r0, {0x1f}}, './file0\x00'}) fstat(0xffffffffffffffff, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x10b280, 0x0) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r5, 0xc0189375, &(0x7f0000000480)={{0x1, 0x1, 0x18, r6}, './file0\x00'}) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x110, r2, 0x7715000) 14:43:30 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x2c0c0, 0x0) 14:43:30 executing program 2: syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x1000) 14:43:30 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x40800000, 0x9}}, './file0\x00'}) mknodat$null(r1, &(0x7f0000000100)='./file0\x00', 0x10, 0x103) 14:43:30 executing program 0: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x4, 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x6000) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000040)='group_id', &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000380)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r0, @ANYBLOB="8cea9c78ac6a8165ba5b2012f19d091f20f4c6191b41fa747ba36486ed2aeb5853612e5d12e0040000c3000000000000000087fe0647ce4a0822fb4b828c534adc83f40ce5cd351394e78fc8526587ca487ad50d7eff103ad9daf6260f784616e968d260971a90a9dfe60d8a6466edb83c3442b17cbc8765a367e0ce519bd070094fdf02bb26727b22553aff840e7c3acc63024672ed99078251477543337ac90cf5467ca7e273362c0a0fb008c7ff8ba314aaef3408a8e0bbdf54831b1fb47b4506b8a164adbfa2c33574272cff40197be4687a174fe5b0ef57329ee1b4e3ee66a6da1be12494178ac88db8078051f814463487a70000000073886c03673a499ddf14598a4106a457eb0000864b7f"]) mknodat$null(r1, &(0x7f0000000180)='./file0\x00', 0x8, 0x103) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:30 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, 0x0) 14:43:30 executing program 2: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x1000) 14:43:30 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, 0x0) [ 1681.841575][T17118] overlay: Unknown parameter '\' [ 1681.842052][T17122] fuse: Bad value for 'fd' 14:43:31 executing program 5: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(0xffffffffffffffff, 0xc0189371, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='\\']) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x40800000, 0x9}}, './file0\x00'}) mknodat$null(r1, &(0x7f0000000100)='./file0\x00', 0x10, 0x103) 14:43:31 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x2c0c0, 0x0) 14:43:31 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, 0x0) 14:43:31 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x64b003, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000080)={0x0, 0x6639ff95, 0x6, 0x1}) (async) read$ptp(r0, 0x0, 0x0) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r3, 0x50009417, &(0x7f0000000600)={{r2}, 0x0, 0xa, @inherit={0x58, &(0x7f0000000580)={0x1, 0x2, 0x3, 0x487af888, {0x4, 0x20, 0x4}, [0x2, 0x33ae]}}, @devid=r1}) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000500), 0x1ef209c497e8e179, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, &(0x7f0000000540)={{0x1, 0x1, 0x18, r0, {0x1f}}, './file0\x00'}) (async) fstat(0xffffffffffffffff, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x10b280, 0x0) (async) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r5, 0xc0189375, &(0x7f0000000480)={{0x1, 0x1, 0x18, r6}, './file0\x00'}) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x110, r2, 0x7715000) 14:43:31 executing program 0: r0 = syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x8000, &(0x7f0000000240)={[{@xino_off}], [{@subj_role={'subj_role', 0x3d, 'overlay\x00'}}]}) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYRES32=r0]) [ 1681.981546][T17132] overlay: Unknown parameter '\' 14:43:31 executing program 2: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x1000) 14:43:31 executing program 1: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x2c0c0, 0x0) (async) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x2c0c0, 0x0) 14:43:31 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02fe10f72a1ab0f22995"]) 14:43:31 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x64b003, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000080)={0x0, 0x6639ff95, 0x6, 0x1}) (async) read$ptp(r0, 0x0, 0x0) (async) r2 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (async) r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r3, &(0x7f0000003880)) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r3, 0x50009417, &(0x7f0000000600)={{r2}, 0x0, 0xa, @inherit={0x58, &(0x7f0000000580)={0x1, 0x2, 0x3, 0x487af888, {0x4, 0x20, 0x4}, [0x2, 0x33ae]}}, @devid=r1}) (async) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000500), 0x1ef209c497e8e179, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, &(0x7f0000000540)={{0x1, 0x1, 0x18, r0, {0x1f}}, './file0\x00'}) (async) fstat(0xffffffffffffffff, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {0x7}}, './file0\x00'}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x10b280, 0x0) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r6, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r5, 0xc0189375, &(0x7f0000000480)={{0x1, 0x1, 0x18, r6}, './file0\x00'}) (async) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x110, r2, 0x7715000) 14:43:31 executing program 3: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x109341, 0xfd) [ 1682.053741][T17136] overlay: Unknown parameter 'subj_role' 14:43:31 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) openat$autofs(0xffffffffffffff9c, &(0x7f0000001400), 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, &(0x7f0000000040)={0x0, 0x6, 0x8001, 0x1}) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB='\n\x00\x00\x00\x00\x00\x00\x00./file0\x00']) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) mount$pvfs2(&(0x7f00000014c0), &(0x7f0000001500)='./file0\x00', &(0x7f0000001540), 0x800, &(0x7f0000001580)={[{'memory.events.local\x00'}, {'}'}, {'memory.events.local\x00'}, {'\x00'}], [{@obj_user}, {@seclabel}]}) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000001440)={{0x1, 0x1, 0x18, r0, {r5}}, './file0\x00'}) openat$cgroup_ro(r6, &(0x7f0000001480)='memory.events.local\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) fcntl$getownex(r3, 0x10, &(0x7f0000001380)) r7 = fsmount(0xffffffffffffffff, 0x1, 0x0) r8 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r7, 0x5000943a, &(0x7f0000000340)={{r8}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) r9 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r9, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_FAIL(r7, 0xc0189377, &(0x7f00000013c0)={{0x1, 0x1, 0x18, r9, {0x2, 0x8}}, './file0\x00'}) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000440)={{0x1, 0x1, 0x18, r5, {r2}}, './file0\x00'}) [ 1682.107517][T17147] overlay: Unknown parameter 'ÿÿÿÿ' 14:43:31 executing program 2: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x1000) 14:43:31 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES64=r1, @ANYBLOB="000900000001ce217572226dc7e1ffa85f77006e1c48f0aa940aec10666865616e0c3df561a9f92f1b43e88722b3c9dce60ca8e5db96d4dc160e3ae0748af4523c6af4c7456a40599878c3304b37d6acdbf3cf5c243af40383ca05c430e1c8590b92238fb75d03287ab5e898a2d46e2c9f3731"]) read$ptp(r0, 0x0, 0xffffffffffffff8d) epoll_create1(0x80000) 14:43:31 executing program 0: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1682.140643][T17153] overlay: Unknown parameter 'þ÷*°ò)•' 14:43:31 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02fe10f72a1ab0f22995"]) 14:43:31 executing program 3: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x109341, 0xfd) 14:43:31 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) openat$autofs(0xffffffffffffff9c, &(0x7f0000001400), 0x0, 0x0) (async) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, &(0x7f0000000040)={0x0, 0x6, 0x8001, 0x1}) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB='\n\x00\x00\x00\x00\x00\x00\x00./file0\x00']) (async) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) mount$pvfs2(&(0x7f00000014c0), &(0x7f0000001500)='./file0\x00', &(0x7f0000001540), 0x800, &(0x7f0000001580)={[{'memory.events.local\x00'}, {'}'}, {'memory.events.local\x00'}, {'\x00'}], [{@obj_user}, {@seclabel}]}) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000001440)={{0x1, 0x1, 0x18, r0, {r5}}, './file0\x00'}) openat$cgroup_ro(r6, &(0x7f0000001480)='memory.events.local\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) fcntl$getownex(r3, 0x10, &(0x7f0000001380)) (async) r7 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r8 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r7, 0x5000943a, &(0x7f0000000340)={{r8}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async) r9 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r9, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(r7, 0xc0189377, &(0x7f00000013c0)={{0x1, 0x1, 0x18, r9, {0x2, 0x8}}, './file0\x00'}) (async) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000440)={{0x1, 0x1, 0x18, r5, {r2}}, './file0\x00'}) [ 1682.238125][T17161] fuse: Bad value for 'fd' 14:43:31 executing program 2: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) fchownat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0) 14:43:31 executing program 5: syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02fe10f72a1ab0f22995"]) 14:43:31 executing program 3: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x109341, 0xfd) [ 1682.271417][T17166] overlay: Unknown parameter 'þ÷*°ò)•' 14:43:31 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) (async) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES64=r1, @ANYBLOB="000900000001ce217572226dc7e1ffa85f77006e1c48f0aa940aec10666865616e0c3df561a9f92f1b43e88722b3c9dce60ca8e5db96d4dc160e3ae0748af4523c6af4c7456a40599878c3304b37d6acdbf3cf5c243af40383ca05c430e1c8590b92238fb75d03287ab5e898a2d46e2c9f3731"]) read$ptp(r0, 0x0, 0xffffffffffffff8d) (async) epoll_create1(0x80000) 14:43:31 executing program 0: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000400)='}q\x00', &(0x7f0000000440)='/sys/kernel/debug/damon/attrs\x00', 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x100000001}}]}}, 0x0, 0x0, &(0x7f0000000240)="05f0fb64282053a99e6137e12167261644eb51dceedad96af88f60e8c72e6a6b503ef8bf4c05713a1ec339023380251596b0b76298f9147eef34578569a8b2d448dfc0b58507d30b520ab7a51e2ed3401bc99441b67cb1086e2705d6e2079439ec3afd30c7532d84f2fe503a9b01d0d6476e190ca8a8aa") openat$damon_attrs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40800, 0x5) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:31 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async, rerun: 64) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (rerun: 64) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) openat$autofs(0xffffffffffffff9c, &(0x7f0000001400), 0x0, 0x0) (async, rerun: 32) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, &(0x7f0000000040)={0x0, 0x6, 0x8001, 0x1}) (async) r3 = fsmount(0xffffffffffffffff, 0x1, 0x0) (async) r4 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000340)={{r4}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000001340)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB='\n\x00\x00\x00\x00\x00\x00\x00./file0\x00']) (async) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) mount$pvfs2(&(0x7f00000014c0), &(0x7f0000001500)='./file0\x00', &(0x7f0000001540), 0x800, &(0x7f0000001580)={[{'memory.events.local\x00'}, {'}'}, {'memory.events.local\x00'}, {'\x00'}], [{@obj_user}, {@seclabel}]}) (async, rerun: 32) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000001440)={{0x1, 0x1, 0x18, r0, {r5}}, './file0\x00'}) (rerun: 32) openat$cgroup_ro(r6, &(0x7f0000001480)='memory.events.local\x00', 0x0, 0x0) fstat(r5, &(0x7f0000003880)) fcntl$getownex(r3, 0x10, &(0x7f0000001380)) r7 = fsmount(0xffffffffffffffff, 0x1, 0x0) r8 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000240)='.log\x00', 0x424000, 0x105) ioctl$BTRFS_IOC_RM_DEV_V2(r7, 0x5000943a, &(0x7f0000000340)={{r8}, 0x0, 0x4, @inherit={0x50, &(0x7f00000002c0)={0x0, 0x1, 0x7, 0x0, {0x9, 0x80, 0xff, 0x0, 0x10000}, [0x0]}}, @subvolid=0x1}) (async, rerun: 32) r9 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) (rerun: 32) fstat(r9, &(0x7f0000003880)) ioctl$AUTOFS_DEV_IOCTL_FAIL(r7, 0xc0189377, &(0x7f00000013c0)={{0x1, 0x1, 0x18, r9, {0x2, 0x8}}, './file0\x00'}) (async) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r4, 0xc018937b, &(0x7f0000000440)={{0x1, 0x1, 0x18, r5, {r2}}, './file0\x00'}) 14:43:31 executing program 3: openat$incfs(0xffffffffffffff9c, 0x0, 0x109341, 0xfd) 14:43:31 executing program 5: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYRES8=r0, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c6772f61155069c1e61576f1c26c6e7d7e4", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x100001d, 0x40010, r1, 0xd351c000) [ 1682.394604][T17179] overlay: Unknown parameter 'þ÷*°ò)•' [ 1682.434379][T17183] fuse: Bad value for 'fd' 14:43:31 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1000000, &(0x7f0000000380)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@hash}]}}, 0x0, 0x0, &(0x7f0000000280)="b7b4bfe11a5aa3b3f4704ed672477def5f2a7dcf62a2c0b4d3ff583e678cb71c24a29193a8faa25cc88045bcd3c8d22e786879475215d3e477b33f168f03a7313dd9d300f06277db6c420e1c8b0471383268b4434538467f9b990af55cfe101284a5") r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:31 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES64=r1, @ANYBLOB="000900000001ce217572226dc7e1ffa85f77006e1c48f0aa940aec10666865616e0c3df561a9f92f1b43e88722b3c9dce60ca8e5db96d4dc160e3ae0748af4523c6af4c7456a40599878c3304b37d6acdbf3cf5c243af40383ca05c430e1c8590b92238fb75d03287ab5e898a2d46e2c9f3731"]) (async) read$ptp(r0, 0x0, 0xffffffffffffff8d) (async) epoll_create1(0x80000) [ 1682.460300][T17183] fuse: Bad value for 'user_id' [ 1682.487142][T17183] fuse: Bad value for 'user_id' 14:43:31 executing program 0: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000400)='}q\x00', &(0x7f0000000440)='/sys/kernel/debug/damon/attrs\x00', 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x100000001}}]}}, 0x0, 0x0, &(0x7f0000000240)="05f0fb64282053a99e6137e12167261644eb51dceedad96af88f60e8c72e6a6b503ef8bf4c05713a1ec339023380251596b0b76298f9147eef34578569a8b2d448dfc0b58507d30b520ab7a51e2ed3401bc99441b67cb1086e2705d6e2079439ec3afd30c7532d84f2fe503a9b01d0d6476e190ca8a8aa") openat$damon_attrs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40800, 0x5) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:31 executing program 3: openat$incfs(0xffffffffffffff9c, 0x0, 0x109341, 0xfd) [ 1682.530266][T17192] fuse: Unknown parameter '0xffffffffffffffff' [ 1682.558066][T17194] fuse: Bad value for 'fd' 14:43:31 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$ptp(r0, 0x0, 0x0) read$ptp(r0, &(0x7f0000000000)=""/70, 0x46) 14:43:31 executing program 5: r0 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r0, &(0x7f0000003880)) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYRES8=r0, @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c6772f61155069c1e61576f1c26c6e7d7e4", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) r1 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x100001d, 0x40010, r1, 0xd351c000) 14:43:31 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3}}, './file0\x00'}) fchmodat(r0, &(0x7f0000000140)='./file0/file0\x00', 0xc6) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x10000000}) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1, {r0}}, './file0\x00'}) [ 1682.596652][T17201] fuse: Bad value for 'fd' [ 1682.606109][T17194] fuse: Bad value for 'fd' [ 1682.612088][T17201] fuse: Bad value for 'user_id' 14:43:31 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1000000, &(0x7f0000000380)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@hash}]}}, 0x0, 0x0, &(0x7f0000000280)="b7b4bfe11a5aa3b3f4704ed672477def5f2a7dcf62a2c0b4d3ff583e678cb71c24a29193a8faa25cc88045bcd3c8d22e786879475215d3e477b33f168f03a7313dd9d300f06277db6c420e1c8b0471383268b4434538467f9b990af55cfe101284a5") r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1682.647120][T17201] fuse: Bad value for 'user_id' 14:43:31 executing program 0: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003840)='./binderfs/binder-control\x00', 0x0, 0x0) fstat(r1, &(0x7f0000003880)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {}, 0x2c, {[{}, {@blksize}, {@default_permissions}, {@allow_other}, {@default_permissions}]}}, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000400)='}q\x00', &(0x7f0000000440)='/sys/kernel/debug/damon/attrs\x00', 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1, &(0x7f0000000180)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x100000001}}]}}, 0x0, 0x0, &(0x7f0000000240)="05f0fb64282053a99e6137e12167261644eb51dceedad96af88f60e8c72e6a6b503ef8bf4c05713a1ec339023380251596b0b76298f9147eef34578569a8b2d448dfc0b58507d30b520ab7a51e2ed3401bc99441b67cb1086e2705d6e2079439ec3afd30c7532d84f2fe503a9b01d0d6476e190ca8a8aa") openat$damon_attrs(0xffffffffffffff9c, &(0x7f00000002c0), 0x40800, 0x5) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) 14:43:31 executing program 3: openat$incfs(0xffffffffffffff9c, 0x0, 0x109341, 0xfd) 14:43:31 executing program 5: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1000000, &(0x7f0000000380)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@hash}]}}, 0x0, 0x0, &(0x7f0000000280)="b7b4bfe11a5aa3b3f4704ed672477def5f2a7dcf62a2c0b4d3ff583e678cb71c24a29193a8faa25cc88045bcd3c8d22e786879475215d3e477b33f168f03a7313dd9d300f06277db6c420e1c8b0471383268b4434538467f9b990af55cfe101284a5") r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1682.690323][T17207] fuse: Unknown parameter '0xffffffffffffffff' 14:43:31 executing program 3: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x0, 0xfd) 14:43:31 executing program 1: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3}}, './file0\x00'}) fchmodat(r0, &(0x7f0000000140)='./file0/file0\x00', 0xc6) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x10000000}) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1, {r0}}, './file0\x00'}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x241, 0x0) (async) openat$cgroup_ro(r0, &(0x7f0000000040)='memory.numa_stat\x00', 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x3}}, './file0\x00'}) (async) fchmodat(r0, &(0x7f0000000140)='./file0/file0\x00', 0xc6) (async) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000080)={0x10000000}) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1, {r0}}, './file0\x00'}) (async) [ 1682.750625][T17214] fuse: Bad value for 'fd' [ 1682.767532][T17215] fuse: Bad value for 'fd' [ 1682.788489][T17218] fuse: Bad value for 'fd' [ 1682.792544][T17214] fuse: Bad value for 'user_id' 14:43:31 executing program 3: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.pending_reads\x00', 0x0, 0xfd) 14:43:31 executing program 5: syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6665dc", @ANYRESHEX, @ANYBLOB="2c726f6f818011f60fc6af7d94746d6f64653d3030303030303030303030303030303030302c753065725f69643dd99aeaab9767b0d2470ddc", @ANYRESDEC=0x0, @ANYBLOB='d=\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=0x0, @ANYBLOB="0400"], 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1682.805533][T17215] fuse: Bad value for 'fd' [ 1682.809814][T17218] fuse: Bad value for 'fd' [ 1682.820178][T17214] fuse: Bad value for 'user_id' 14:43:31 executing program 2: r0 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x1000000, &(0x7f0000000380)={{}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}], [{@hash}]}}, 0x0, 0x0, &(0x7f0000000280)="b7b4bfe11a5aa3b3f4704ed672477def5f2a7dcf62a2c0b4d3ff583e678cb71c24a29193a8faa25cc88045bcd3c8d22e786879475215d3e477b33f168f03a7313dd9d300f06277db6c420e1c8b0471383268b4434538467f9b990af55cfe101284a5") r3 = openat(0xffffffffffffff9c, &(0x7f0000001340)='./file0\x00', 0x141, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r3, 0x40086602, &(0x7f0000000000)={@desc={0x4000, 0x0, @desc3}}) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) [ 1682.918545][T17229] fuse: Unknown parameter 'feÜ0xffffffffffffffff' [ 1682.927646][T17230] fuse: Bad value for 'fd' [ 1682.943046][T17230] fuse: Bad value for 'fd' [ 1683.506679][T17206] ================================================================== [ 1683.514879][T17206] BUG: KASAN: slab-use-after-free in ptp_read+0x5e4/0x820 [ 1683.522046][T17206] Read of size 4 at addr ffff888057805004 by task syz-executor.4/17206 [ 1683.530292][T17206] [ 1683.532627][T17206] CPU: 0 PID: 17206 Comm: syz-executor.4 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1683.542697][T17206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1683.552753][T17206] Call Trace: [ 1683.556041][T17206] [ 1683.558997][T17206] dump_stack_lvl+0x1e7/0x2d0 [ 1683.563687][T17206] ? nf_tcp_handle_invalid+0x650/0x650 [ 1683.569141][T17206] ? panic+0x850/0x850 [ 1683.573217][T17206] ? _printk+0xd5/0x120 [ 1683.577384][T17206] print_report+0x163/0x540 [ 1683.581909][T17206] ? __virt_addr_valid+0x22f/0x2e0 [ 1683.587033][T17206] ? __phys_addr+0xba/0x170 [ 1683.591544][T17206] ? ptp_read+0x5e4/0x820 [ 1683.595903][T17206] kasan_report+0x142/0x170 [ 1683.600421][T17206] ? __futex_wait+0x286/0x320 [ 1683.605109][T17206] ? ptp_read+0x5e4/0x820 [ 1683.609442][T17206] ptp_read+0x5e4/0x820 [ 1683.613595][T17206] ? ptp_poll+0x160/0x160 [ 1683.617930][T17206] ? wake_bit_function+0x220/0x220 [ 1683.623049][T17206] ? __fsnotify_update_child_dentry_flags+0x2a0/0x2a0 [ 1683.629809][T17206] ? ptp_poll+0x160/0x160 [ 1683.634149][T17206] posix_clock_read+0x12f/0x190 [ 1683.639019][T17206] ? pc_clock_adjtime+0x220/0x220 [ 1683.644054][T17206] vfs_read+0x289/0xb00 [ 1683.648211][T17206] ? kernel_read+0x1f0/0x1f0 [ 1683.652796][T17206] ? __fget_files+0x29/0x480 [ 1683.657484][T17206] ? __fget_files+0x3fe/0x480 [ 1683.662188][T17206] ? __fget_files+0x29/0x480 [ 1683.666786][T17206] ? __fdget_pos+0x1df/0x340 [ 1683.671395][T17206] ? ksys_read+0x7b/0x2c0 [ 1683.675727][T17206] ksys_read+0x1a0/0x2c0 [ 1683.679990][T17206] ? print_irqtrace_events+0x220/0x220 [ 1683.685469][T17206] ? vfs_write+0xb20/0xb20 [ 1683.689924][T17206] ? syscall_enter_from_user_mode+0x32/0x230 [ 1683.695907][T17206] ? lockdep_hardirqs_on+0x98/0x140 [ 1683.701114][T17206] ? syscall_enter_from_user_mode+0x32/0x230 [ 1683.707084][T17206] do_syscall_64+0x44/0x110 [ 1683.711602][T17206] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1683.717497][T17206] RIP: 0033:0x7f027fe7cae9 [ 1683.721918][T17206] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1683.741516][T17206] RSP: 002b:00007f0280c980c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1683.749923][T17206] RAX: ffffffffffffffda RBX: 00007f027ff9bf80 RCX: 00007f027fe7cae9 [ 1683.757897][T17206] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1683.765880][T17206] RBP: 00007f027fec847a R08: 0000000000000000 R09: 0000000000000000 [ 1683.773858][T17206] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1683.781840][T17206] R13: 000000000000000b R14: 00007f027ff9bf80 R15: 00007ffd099b7568 [ 1683.789835][T17206] [ 1683.792842][T17206] [ 1683.795155][T17206] Allocated by task 17206: [ 1683.799571][T17206] kasan_set_track+0x4f/0x70 [ 1683.804153][T17206] __kasan_kmalloc+0x98/0xb0 [ 1683.808731][T17206] ptp_open+0xd9/0x430 [ 1683.812790][T17206] posix_clock_open+0x155/0x1f0 [ 1683.817638][T17206] chrdev_open+0x5ab/0x630 [ 1683.822052][T17206] do_dentry_open+0x8fd/0x1590 [ 1683.826822][T17206] path_openat+0x2845/0x3280 [ 1683.831420][T17206] do_filp_open+0x234/0x490 [ 1683.835920][T17206] do_sys_openat2+0x13e/0x1d0 [ 1683.840598][T17206] __x64_sys_openat+0x247/0x290 [ 1683.845445][T17206] do_syscall_64+0x44/0x110 [ 1683.849954][T17206] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1683.855846][T17206] [ 1683.858168][T17206] Freed by task 17216: [ 1683.862228][T17206] kasan_set_track+0x4f/0x70 [ 1683.866817][T17206] kasan_save_free_info+0x28/0x40 [ 1683.871843][T17206] ____kasan_slab_free+0xd6/0x120 [ 1683.876864][T17206] __kmem_cache_free+0x263/0x3a0 [ 1683.881810][T17206] ptp_release+0x1ce/0x1e0 [ 1683.886226][T17206] ptp_read+0x17f/0x820 [ 1683.890399][T17206] posix_clock_read+0x12f/0x190 [ 1683.895297][T17206] vfs_read+0x289/0xb00 [ 1683.899460][T17206] ksys_read+0x1a0/0x2c0 [ 1683.903705][T17206] do_syscall_64+0x44/0x110 [ 1683.908201][T17206] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1683.914090][T17206] [ 1683.916409][T17206] The buggy address belongs to the object at ffff888057804000 [ 1683.916409][T17206] which belongs to the cache kmalloc-8k of size 8192 [ 1683.930468][T17206] The buggy address is located 4100 bytes inside of [ 1683.930468][T17206] freed 8192-byte region [ffff888057804000, ffff888057806000) [ 1683.944425][T17206] [ 1683.946753][T17206] The buggy address belongs to the physical page: [ 1683.953162][T17206] page:ffffea00015e0000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x57800 [ 1683.963303][T17206] head:ffffea00015e0000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1683.972248][T17206] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 1683.980218][T17206] page_type: 0xffffffff() [ 1683.984536][T17206] raw: 00fff00000000840 ffff888012c42280 dead000000000122 0000000000000000 [ 1683.993200][T17206] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 1684.001792][T17206] page dumped because: kasan: bad access detected [ 1684.008217][T17206] page_owner tracks the page as allocated [ 1684.013937][T17206] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 17197, tgid 17193 (syz-executor.4), ts 1682584764245, free_ts 1682584508958 [ 1684.037408][T17206] post_alloc_hook+0x1e6/0x210 [ 1684.042188][T17206] get_page_from_freelist+0x339a/0x3530 [ 1684.047725][T17206] __alloc_pages+0x255/0x670 [ 1684.052303][T17206] alloc_pages_mpol+0x3de/0x640 [ 1684.057154][T17206] alloc_slab_page+0x6a/0x160 [ 1684.061837][T17206] new_slab+0x84/0x2f0 [ 1684.065903][T17206] ___slab_alloc+0xc85/0x1310 [ 1684.070588][T17206] __kmem_cache_alloc_node+0x21d/0x300 [ 1684.076061][T17206] kmalloc_trace+0x2a/0xe0 [ 1684.080488][T17206] ptp_open+0xd9/0x430 [ 1684.084665][T17206] posix_clock_open+0x155/0x1f0 [ 1684.089612][T17206] chrdev_open+0x5ab/0x630 [ 1684.094032][T17206] do_dentry_open+0x8fd/0x1590 [ 1684.098809][T17206] path_openat+0x2845/0x3280 [ 1684.103405][T17206] do_filp_open+0x234/0x490 [ 1684.107911][T17206] do_sys_openat2+0x13e/0x1d0 [ 1684.112595][T17206] page last free stack trace: [ 1684.117346][T17206] free_unref_page_prepare+0x92a/0xa50 [ 1684.122819][T17206] free_unref_page+0x37/0x3f0 [ 1684.127487][T17206] __unfreeze_partials+0x1dc/0x220 [ 1684.132589][T17206] put_cpu_partial+0x17b/0x250 [ 1684.137351][T17206] __slab_free+0x2b6/0x390 [ 1684.141780][T17206] qlist_free_all+0x75/0xe0 [ 1684.146280][T17206] kasan_quarantine_reduce+0x14b/0x160 [ 1684.151797][T17206] __kasan_slab_alloc+0x23/0x70 [ 1684.156694][T17206] slab_post_alloc_hook+0x6c/0x3c0 [ 1684.161822][T17206] kmem_cache_alloc+0x1be/0x350 [ 1684.166684][T17206] getname_flags+0xbc/0x4f0 [ 1684.171191][T17206] do_sys_openat2+0xd2/0x1d0 [ 1684.175775][T17206] __x64_sys_openat+0x247/0x290 [ 1684.180628][T17206] do_syscall_64+0x44/0x110 [ 1684.185118][T17206] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1684.191023][T17206] [ 1684.193379][T17206] Memory state around the buggy address: [ 1684.199005][T17206] ffff888057804f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1684.207165][T17206] ffff888057804f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1684.215236][T17206] >ffff888057805000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1684.223315][T17206] ^ [ 1684.227395][T17206] ffff888057805080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1684.235454][T17206] ffff888057805100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1684.243515][T17206] ================================================================== [ 1684.255760][T17206] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1684.263001][T17206] CPU: 0 PID: 17206 Comm: syz-executor.4 Not tainted 6.6.0-syzkaller-15029-gbe3ca57cfb77 #0 [ 1684.273070][T17206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 1684.283143][T17206] Call Trace: [ 1684.286426][T17206] [ 1684.289351][T17206] dump_stack_lvl+0x1e7/0x2d0 [ 1684.294035][T17206] ? nf_tcp_handle_invalid+0x650/0x650 [ 1684.299522][T17206] ? panic+0x850/0x850 [ 1684.303615][T17206] ? vscnprintf+0x5d/0x80 [ 1684.307965][T17206] panic+0x349/0x850 [ 1684.311890][T17206] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1684.318058][T17206] ? check_panic_on_warn+0x21/0xa0 [ 1684.323169][T17206] ? __memcpy_flushcache+0x2b0/0x2b0 [ 1684.328453][T17206] ? _raw_spin_unlock_irqrestore+0x12c/0x140 [ 1684.334435][T17206] ? _raw_spin_unlock+0x40/0x40 [ 1684.339297][T17206] ? print_report+0x4fb/0x540 [ 1684.343994][T17206] check_panic_on_warn+0x82/0xa0 [ 1684.348947][T17206] ? ptp_read+0x5e4/0x820 [ 1684.353288][T17206] end_report+0x6e/0x130 [ 1684.357524][T17206] kasan_report+0x153/0x170 [ 1684.362019][T17206] ? __futex_wait+0x286/0x320 [ 1684.366692][T17206] ? ptp_read+0x5e4/0x820 [ 1684.371109][T17206] ptp_read+0x5e4/0x820 [ 1684.375268][T17206] ? ptp_poll+0x160/0x160 [ 1684.379592][T17206] ? wake_bit_function+0x220/0x220 [ 1684.384698][T17206] ? __fsnotify_update_child_dentry_flags+0x2a0/0x2a0 [ 1684.391458][T17206] ? ptp_poll+0x160/0x160 [ 1684.395804][T17206] posix_clock_read+0x12f/0x190 [ 1684.400696][T17206] ? pc_clock_adjtime+0x220/0x220 [ 1684.405725][T17206] vfs_read+0x289/0xb00 [ 1684.409882][T17206] ? kernel_read+0x1f0/0x1f0 [ 1684.414466][T17206] ? __fget_files+0x29/0x480 [ 1684.419051][T17206] ? __fget_files+0x3fe/0x480 [ 1684.423738][T17206] ? __fget_files+0x29/0x480 [ 1684.428327][T17206] ? __fdget_pos+0x1df/0x340 [ 1684.432913][T17206] ? ksys_read+0x7b/0x2c0 [ 1684.437247][T17206] ksys_read+0x1a0/0x2c0 [ 1684.441487][T17206] ? print_irqtrace_events+0x220/0x220 [ 1684.447032][T17206] ? vfs_write+0xb20/0xb20 [ 1684.451524][T17206] ? syscall_enter_from_user_mode+0x32/0x230 [ 1684.457503][T17206] ? lockdep_hardirqs_on+0x98/0x140 [ 1684.462707][T17206] ? syscall_enter_from_user_mode+0x32/0x230 [ 1684.468683][T17206] do_syscall_64+0x44/0x110 [ 1684.473204][T17206] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1684.479120][T17206] RIP: 0033:0x7f027fe7cae9 [ 1684.483539][T17206] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 1684.503140][T17206] RSP: 002b:00007f0280c980c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1684.511548][T17206] RAX: ffffffffffffffda RBX: 00007f027ff9bf80 RCX: 00007f027fe7cae9 [ 1684.519517][T17206] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1684.527489][T17206] RBP: 00007f027fec847a R08: 0000000000000000 R09: 0000000000000000 [ 1684.535472][T17206] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1684.543460][T17206] R13: 000000000000000b R14: 00007f027ff9bf80 R15: 00007ffd099b7568 [ 1684.551631][T17206] [ 1684.554832][T17206] Kernel Offset: disabled [ 1684.559140][T17206] Rebooting in 86400 seconds..