00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) 09:01:15 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:15 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2766.987757][T11644] fuse: Bad value for 'fd' [ 2767.244526][T11649] fuse: Bad value for 'fd' 09:01:15 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(0xffffffffffffffff, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2767.410561][T11652] fuse: Bad value for 'fd' 09:01:16 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2767.996664][T11657] fuse: Bad value for 'fd' 09:01:16 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) 09:01:16 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) 09:01:16 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2768.325833][T11664] fuse: Bad value for 'fd' [ 2768.463893][T11668] fuse: Bad value for 'fd' [ 2768.534252][T11670] fuse: Bad value for 'fd' 09:01:17 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2769.192456][T11674] fuse: Bad value for 'fd' 09:01:17 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r6}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(0xffffffffffffffff, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:17 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2769.376925][T11677] fuse: Bad value for 'fd' 09:01:17 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r6}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(0xffffffffffffffff, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2769.632034][T11683] fuse: Bad value for 'fd' [ 2769.713344][T11684] fuse: Bad value for 'fd' 09:01:18 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r6}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(0xffffffffffffffff, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2770.241565][ T38] kauditd_printk_skb: 26 callbacks suppressed [ 2770.241574][ T38] audit: type=1804 audit(1682672478.536:1123): pid=11687 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2937/bus" dev="sda1" ino=1968 res=1 errno=0 09:01:18 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r6}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(0xffffffffffffffff, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2770.292511][ T38] audit: type=1804 audit(1682672478.596:1124): pid=11689 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6642/bus" dev="sda1" ino=1973 res=1 errno=0 09:01:18 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2770.346382][T11690] fuse: Bad value for 'fd' [ 2770.360411][T11691] fuse: Bad value for 'fd' [ 2770.430337][ T38] audit: type=1804 audit(1682672478.726:1125): pid=11693 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2643/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2770.458005][ T38] audit: type=1804 audit(1682672478.756:1126): pid=11693 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2643/bus" dev="sda1" ino=1972 res=1 errno=0 09:01:18 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2770.738448][ T38] audit: type=1804 audit(1682672479.036:1127): pid=11696 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1540/bus" dev="sda1" ino=1970 res=1 errno=0 [ 2770.757516][ T38] audit: type=1804 audit(1682672479.056:1128): pid=11696 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1540/bus" dev="sda1" ino=1970 res=1 errno=0 [ 2770.886319][T11698] fuse: Bad value for 'fd' 09:01:19 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2770.970065][ T38] audit: type=1804 audit(1682672479.266:1129): pid=11700 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6643/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2770.991827][ T38] audit: type=1804 audit(1682672479.286:1130): pid=11700 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6643/bus" dev="sda1" ino=1973 res=1 errno=0 09:01:19 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r6}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(0xffffffffffffffff, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2771.112467][ T38] audit: type=1804 audit(1682672479.416:1131): pid=11703 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2938/bus" dev="sda1" ino=1968 res=1 errno=0 [ 2771.178378][T11704] fuse: Bad value for 'fd' [ 2771.190594][T11705] fuse: Bad value for 'fd' 09:01:19 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2771.338357][ T38] audit: type=1804 audit(1682672479.636:1132): pid=11707 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2644/bus" dev="sda1" ino=1975 res=1 errno=0 09:01:19 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r6}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(0xffffffffffffffff, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:20 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r6}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(0xffffffffffffffff, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2771.801323][T11711] fuse: Bad value for 'fd' [ 2771.958237][T11714] fuse: Bad value for 'fd' 09:01:20 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:20 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:20 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:20 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2772.883608][T11730] fuse: Bad value for 'fd' 09:01:21 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:21 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2773.267749][T11738] fuse: Bad value for 'fd' 09:01:21 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r6}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(0xffffffffffffffff, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:22 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2773.781736][T11742] fuse: Bad value for 'fd' 09:01:22 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2773.949591][T11746] fuse: Bad value for 'fd' 09:01:22 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:22 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2774.463390][ T1342] ieee802154 phy0 wpan0: encryption failed: -22 [ 2774.466661][ T1342] ieee802154 phy1 wpan1: encryption failed: -22 [ 2774.556536][T11758] fuse: Bad value for 'fd' 09:01:23 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:23 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r13 = dup2(r1, r0) sendmsg$nl_route_sched(r13, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2775.073908][T11763] fuse: Bad value for 'fd' [ 2775.175043][T11765] fuse: Bad value for 'fd' 09:01:23 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:23 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2775.425433][ T38] kauditd_printk_skb: 28 callbacks suppressed [ 2775.425443][ T38] audit: type=1804 audit(1682672483.726:1161): pid=11767 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6647/bus" dev="sda1" ino=1960 res=1 errno=0 [ 2775.446774][ T38] audit: type=1804 audit(1682672483.736:1162): pid=11767 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6647/bus" dev="sda1" ino=1960 res=1 errno=0 09:01:23 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2775.490346][ T38] audit: type=1804 audit(1682672483.786:1163): pid=11771 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2649/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2775.509956][ T38] audit: type=1804 audit(1682672483.806:1164): pid=11771 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2649/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2775.544056][ T38] audit: type=1804 audit(1682672483.816:1165): pid=11769 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1545/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2775.577596][T11775] fuse: Bad value for 'fd' [ 2775.593622][ T38] audit: type=1804 audit(1682672483.816:1166): pid=11769 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1545/bus" dev="sda1" ino=1973 res=1 errno=0 09:01:24 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2776.027834][ T38] audit: type=1804 audit(1682672484.326:1167): pid=11778 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2943/bus" dev="sda1" ino=1968 res=1 errno=0 [ 2776.064889][ T38] audit: type=1804 audit(1682672484.326:1168): pid=11778 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2943/bus" dev="sda1" ino=1968 res=1 errno=0 09:01:24 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:24 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2776.424961][ T38] audit: type=1804 audit(1682672484.726:1169): pid=11782 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6648/bus" dev="sda1" ino=1960 res=1 errno=0 [ 2776.447197][ T38] audit: type=1804 audit(1682672484.726:1170): pid=11782 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6648/bus" dev="sda1" ino=1960 res=1 errno=0 09:01:24 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2776.639720][T11787] fuse: Bad value for 'fd' [ 2776.774955][T11790] fuse: Bad value for 'fd' 09:01:25 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2777.113079][T11793] fuse: Bad value for 'fd' 09:01:25 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2777.263399][T11797] fuse: Bad value for 'fd' 09:01:25 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:25 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:26 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2778.046764][T11809] fuse: Bad value for 'fd' 09:01:26 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) 09:01:26 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r5}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2778.252371][T11812] fuse: Bad value for 'fd' 09:01:26 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2778.754514][T11819] fuse: Bad value for 'fd' 09:01:27 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2778.926495][T11822] fuse: Bad value for 'fd' 09:01:27 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:27 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) 09:01:27 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2779.202726][T11830] fuse: Bad value for 'fd' [ 2779.263328][T11831] fuse: Bad value for 'fd' [ 2779.288807][T11829] fuse: Bad value for 'fd' 09:01:28 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:28 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:28 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) 09:01:28 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2780.176721][T11842] fuse: Bad value for 'fd' [ 2780.181771][T11843] fuse: Bad value for 'fd' 09:01:29 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:29 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2780.855212][ T38] kauditd_printk_skb: 36 callbacks suppressed [ 2780.855227][ T38] audit: type=1804 audit(1682672489.156:1207): pid=11845 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2948/bus" dev="sda1" ino=1952 res=1 errno=0 [ 2780.883177][ T38] audit: type=1804 audit(1682672489.166:1208): pid=11845 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2948/bus" dev="sda1" ino=1952 res=1 errno=0 [ 2780.913514][ T38] audit: type=1804 audit(1682672489.176:1209): pid=11847 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2655/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2780.941693][T11849] fuse: Bad value for 'fd' [ 2780.957834][ T38] audit: type=1804 audit(1682672489.176:1210): pid=11847 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2655/bus" dev="sda1" ino=1972 res=1 errno=0 09:01:29 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:29 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2780.997845][ T38] audit: type=1804 audit(1682672489.296:1211): pid=11851 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6653/bus" dev="sda1" ino=1965 res=1 errno=0 [ 2781.026930][ T38] audit: type=1804 audit(1682672489.326:1212): pid=11851 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6653/bus" dev="sda1" ino=1965 res=1 errno=0 [ 2781.077403][ T38] audit: type=1804 audit(1682672489.376:1213): pid=11853 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1551/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2781.093041][ T38] audit: type=1804 audit(1682672489.386:1214): pid=11853 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1551/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2781.162145][T11856] fuse: Bad value for 'fd' [ 2781.213771][T11857] fuse: Bad value for 'fd' 09:01:30 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:30 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r7}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2781.824874][ T38] audit: type=1804 audit(1682672490.126:1215): pid=11859 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2949/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2781.837682][ T38] audit: type=1804 audit(1682672490.126:1216): pid=11859 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2949/bus" dev="sda1" ino=1961 res=1 errno=0 09:01:30 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2781.959187][T11864] fuse: Bad value for 'fd' 09:01:30 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2782.048324][T11869] fuse: Bad value for 'fd' [ 2782.050959][T11870] fuse: Bad value for 'fd' [ 2782.120519][T11871] fuse: Bad value for 'fd' 09:01:30 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:31 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2782.857254][T11876] fuse: Bad value for 'fd' 09:01:31 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) r11 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r11}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r12 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r12, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:31 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2783.079769][T11885] fuse: Bad value for 'fd' [ 2783.110313][T11887] fuse: Bad value for 'fd' 09:01:31 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:32 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:32 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r6}, 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:32 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2784.111744][T11900] fuse: Bad value for 'fd' 09:01:32 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2784.692648][T11903] fuse: Bad value for 'fd' 09:01:33 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:33 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) 09:01:33 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2784.969078][T11909] fuse: Bad value for 'fd' [ 2785.095397][T11912] fuse: Bad value for 'fd' 09:01:33 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2785.608397][T11915] fuse: Bad value for 'fd' 09:01:34 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:34 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2785.890557][T11920] fuse: Bad value for 'fd' [ 2785.926129][T11921] fuse: Bad value for 'fd' 09:01:34 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2786.026036][ T38] kauditd_printk_skb: 36 callbacks suppressed [ 2786.026052][ T38] audit: type=1804 audit(1682672494.326:1253): pid=11923 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1556/bus" dev="sda1" ino=1974 res=1 errno=0 [ 2786.064288][ T38] audit: type=1804 audit(1682672494.326:1254): pid=11923 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1556/bus" dev="sda1" ino=1974 res=1 errno=0 [ 2786.108062][T11924] fuse: Bad value for 'fd' 09:01:34 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2786.427318][ T38] audit: type=1804 audit(1682672494.726:1255): pid=11926 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2954/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2786.448995][ T38] audit: type=1804 audit(1682672494.746:1256): pid=11926 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2954/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2786.523963][T11927] fuse: Bad value for 'fd' 09:01:35 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:35 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2786.717202][ T38] audit: type=1804 audit(1682672495.016:1257): pid=11930 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2661/bus" dev="sda1" ino=1967 res=1 errno=0 [ 2786.734902][ T38] audit: type=1804 audit(1682672495.026:1258): pid=11931 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6659/bus" dev="sda1" ino=1968 res=1 errno=0 [ 2786.766916][ T38] audit: type=1804 audit(1682672495.026:1259): pid=11930 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2661/bus" dev="sda1" ino=1967 res=1 errno=0 [ 2786.801042][ T38] audit: type=1804 audit(1682672495.036:1260): pid=11931 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6659/bus" dev="sda1" ino=1968 res=1 errno=0 [ 2786.801715][T11933] fuse: Bad value for 'fd' 09:01:35 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2786.936547][ T38] audit: type=1804 audit(1682672495.236:1261): pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1557/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2786.954847][ T38] audit: type=1804 audit(1682672495.246:1262): pid=11935 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1557/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2787.024443][T11936] fuse: Bad value for 'fd' 09:01:35 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:35 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) 09:01:35 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2787.714349][T11945] fuse: Bad value for 'fd' 09:01:36 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2787.960502][T11948] fuse: Bad value for 'fd' 09:01:36 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2788.433464][T11951] fuse: Bad value for 'fd' 09:01:36 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2788.542605][ T15] kworker/dying (15) used greatest stack depth: 20904 bytes left 09:01:36 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2788.638194][T11956] fuse: Bad value for 'fd' [ 2788.756117][T11957] fuse: Bad value for 'fd' 09:01:37 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2788.853024][T11960] fuse: Bad value for 'fd' 09:01:37 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2789.372845][T11963] fuse: Bad value for 'fd' 09:01:37 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:37 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:01:37 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2789.854723][T11972] fuse: Bad value for 'fd' 09:01:38 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) 09:01:38 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2790.435963][T11976] fuse: Bad value for 'fd' 09:01:38 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r11 = dup2(r1, r0) sendmsg$nl_route_sched(r11, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2790.565454][T11980] fuse: Bad value for 'fd' [ 2790.602135][T11981] fuse: Bad value for 'fd' 09:01:38 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2790.771087][T11984] fuse: Bad value for 'fd' 09:01:39 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2791.261330][ T38] kauditd_printk_skb: 32 callbacks suppressed [ 2791.261341][ T38] audit: type=1804 audit(1682672499.556:1295): pid=11986 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2959/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2791.312984][ T38] audit: type=1804 audit(1682672499.586:1296): pid=11986 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2959/bus" dev="sda1" ino=1961 res=1 errno=0 09:01:39 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2791.370727][T11987] fuse: Bad value for 'fd' 09:01:39 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2791.411799][ T38] audit: type=1804 audit(1682672499.706:1297): pid=11989 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6664/bus" dev="sda1" ino=1965 res=1 errno=0 [ 2791.441557][ T38] audit: type=1804 audit(1682672499.726:1298): pid=11989 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6664/bus" dev="sda1" ino=1965 res=1 errno=0 [ 2791.500067][ T38] audit: type=1804 audit(1682672499.796:1299): pid=11991 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2666/bus" dev="sda1" ino=1968 res=1 errno=0 [ 2791.525695][ T38] audit: type=1804 audit(1682672499.806:1300): pid=11991 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2666/bus" dev="sda1" ino=1968 res=1 errno=0 09:01:39 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) dup2(r1, r0) [ 2791.572425][ T38] audit: type=1804 audit(1682672499.876:1301): pid=11994 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1562/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2791.598642][ T38] audit: type=1804 audit(1682672499.886:1302): pid=11994 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1562/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2791.603568][T11992] fuse: Bad value for 'fd' [ 2791.614158][T11995] fuse: Bad value for 'fd' [ 2791.643440][T11997] fuse: Bad value for 'fd' 09:01:40 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2792.265864][ T38] audit: type=1804 audit(1682672500.566:1303): pid=11999 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2960/bus" dev="sda1" ino=1961 res=1 errno=0 09:01:40 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2792.305805][ T38] audit: type=1804 audit(1682672500.596:1304): pid=11999 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2960/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2792.417944][T12002] fuse: Bad value for 'fd' 09:01:40 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) 09:01:40 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) dup2(r1, r0) [ 2792.458672][T12004] fuse: Bad value for 'fd' [ 2792.540621][T12008] fuse: Bad value for 'fd' [ 2792.561560][T12009] fuse: Bad value for 'fd' 09:01:41 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) dup2(r1, r0) 09:01:41 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2793.309233][T12014] fuse: Bad value for 'fd' 09:01:41 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2793.348208][T12017] fuse: Bad value for 'fd' 09:01:41 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) dup2(r1, r0) [ 2793.441323][T12016] fuse: Bad value for 'fd' [ 2793.472828][T12021] fuse: Bad value for 'fd' 09:01:41 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2793.601333][T12024] fuse: Bad value for 'fd' 09:01:42 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) dup2(r1, r0) 09:01:42 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) dup2(r1, r0) [ 2794.252807][T12029] fuse: Bad value for 'fd' [ 2794.265638][T12030] fuse: Bad value for 'fd' 09:01:42 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) dup2(r1, r0) [ 2794.353964][T12033] fuse: Bad value for 'fd' 09:01:42 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) [ 2794.494623][T12036] fuse: Bad value for 'fd' 09:01:43 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:43 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2795.136749][T12041] fuse: Bad value for 'fd' 09:01:43 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) dup2(r1, r0) [ 2795.215403][T12043] fuse: Bad value for 'fd' 09:01:43 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) [ 2795.307915][T12046] fuse: Bad value for 'fd' [ 2795.394325][T12048] fuse: Bad value for 'fd' 09:01:44 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2796.063016][T12051] fuse: Bad value for 'fd' 09:01:44 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) 09:01:44 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r9, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r9, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) dup2(r1, r0) 09:01:44 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) [ 2796.217336][T12057] fuse: Bad value for 'fd' [ 2796.270501][T12059] fuse: Bad value for 'fd' [ 2796.287668][T12060] fuse: Bad value for 'fd' 09:01:45 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2796.901791][ T38] kauditd_printk_skb: 40 callbacks suppressed [ 2796.901806][ T38] audit: type=1804 audit(1682672505.196:1345): pid=12062 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2965/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2796.929471][ T38] audit: type=1804 audit(1682672505.206:1346): pid=12062 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2965/bus" dev="sda1" ino=1961 res=1 errno=0 09:01:45 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) [ 2797.001297][T12063] fuse: Bad value for 'fd' 09:01:45 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) [ 2797.071344][ T38] audit: type=1804 audit(1682672505.366:1347): pid=12065 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6670/bus" dev="sda1" ino=1965 res=1 errno=0 09:01:45 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2797.097071][ T38] audit: type=1804 audit(1682672505.396:1348): pid=12069 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1569/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2797.130997][ T38] audit: type=1804 audit(1682672505.396:1349): pid=12069 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1569/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2797.166266][T12071] fuse: Bad value for 'fd' [ 2797.175974][T12072] fuse: Bad value for 'fd' [ 2797.185067][ T38] audit: type=1804 audit(1682672505.406:1350): pid=12065 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6670/bus" dev="sda1" ino=1965 res=1 errno=0 [ 2797.221345][ T38] audit: type=1804 audit(1682672505.406:1351): pid=12067 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2672/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2797.287005][ T38] audit: type=1804 audit(1682672505.416:1352): pid=12067 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2672/bus" dev="sda1" ino=1972 res=1 errno=0 09:01:46 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) [ 2797.815131][ T38] audit: type=1804 audit(1682672506.116:1353): pid=12074 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2966/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2797.834634][ T38] audit: type=1804 audit(1682672506.126:1354): pid=12074 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2966/bus" dev="sda1" ino=1961 res=1 errno=0 09:01:46 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) [ 2797.913311][T12075] fuse: Bad value for 'fd' 09:01:46 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:46 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) [ 2798.048021][T12082] fuse: Bad value for 'fd' [ 2798.086196][T12084] fuse: Bad value for 'fd' 09:01:47 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:47 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:47 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:47 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:47 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:48 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) r10 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r10}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) dup2(r1, r0) 09:01:48 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2799.854169][T12104] fuse: Bad value for 'fd' 09:01:48 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2799.874076][T12105] fuse: Bad value for 'fd' 09:01:48 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:48 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:48 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2800.764158][T12116] fuse: Bad value for 'fd' 09:01:49 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r7}, 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2800.792883][T12118] fuse: Bad value for 'fd' [ 2800.868338][T12120] fuse: Bad value for 'fd' 09:01:49 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) 09:01:49 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2801.521086][T12123] fuse: Bad value for 'fd' 09:01:49 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) r9 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) write$cgroup_int(r9, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2801.609567][T12126] fuse: Bad value for 'fd' 09:01:49 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2801.707529][T12131] fuse: Bad value for 'fd' [ 2801.810162][T12133] fuse: Bad value for 'fd' 09:01:50 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2802.373166][ T38] kauditd_printk_skb: 38 callbacks suppressed [ 2802.373181][ T38] audit: type=1804 audit(1682672510.676:1393): pid=12135 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2971/bus" dev="sda1" ino=1961 res=1 errno=0 09:01:50 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2802.406111][ T38] audit: type=1804 audit(1682672510.676:1394): pid=12135 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2971/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2802.448889][T12138] fuse: Bad value for 'fd' [ 2802.474681][ T38] audit: type=1804 audit(1682672510.736:1395): pid=12137 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1575/bus" dev="sda1" ino=1963 res=1 errno=0 09:01:50 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2802.511509][T12139] fuse: Bad value for 'fd' [ 2802.538889][ T38] audit: type=1804 audit(1682672510.736:1396): pid=12137 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1575/bus" dev="sda1" ino=1963 res=1 errno=0 09:01:50 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2802.576520][ T38] audit: type=1804 audit(1682672510.846:1397): pid=12141 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6676/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2802.605282][ T38] audit: type=1804 audit(1682672510.856:1398): pid=12141 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6676/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2802.629058][T12144] fuse: Bad value for 'fd' [ 2802.668442][ T38] audit: type=1804 audit(1682672510.966:1399): pid=12143 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2678/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2802.684696][ T38] audit: type=1804 audit(1682672510.966:1400): pid=12143 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2678/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2802.781418][T12146] fuse: Bad value for 'fd' 09:01:51 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2803.305053][ T38] audit: type=1804 audit(1682672511.606:1401): pid=12148 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1576/bus" dev="sda1" ino=1963 res=1 errno=0 09:01:51 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r8, &(0x7f00000001c0), 0xfffffdef) r9 = openat$incfs(r6, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r8, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) r10 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r10, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) dup2(r1, r0) [ 2803.381392][ T38] audit: type=1804 audit(1682672511.636:1402): pid=12148 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1576/bus" dev="sda1" ino=1963 res=1 errno=0 [ 2803.424321][T12149] fuse: Bad value for 'fd' 09:01:51 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r8}, 0x8) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2803.510991][T12154] fuse: Bad value for 'fd' 09:01:51 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r9 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00', r8}, 0x10) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r9}, 0x8) write$cgroup_int(r10, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r10, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r7, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r10, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff]}, 0x80) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r11 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r11, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) r12 = dup2(r1, r0) sendmsg$nl_route_sched(r12, &(0x7f0000001400)={&(0x7f0000001200), 0xc, &(0x7f00000013c0)={0x0}}, 0x0) [ 2803.582069][T12156] fuse: Bad value for 'fd' [ 2804.032498][T12159] fuse: Bad value for 'fd' 09:01:52 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:01:52 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2804.305433][T12162] fuse: Bad value for 'fd' 09:01:52 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2804.414596][T12167] fuse: Bad value for 'fd' [ 2804.517331][T12168] fuse: Bad value for 'fd' 09:01:52 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000140)='mm_page_alloc\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2804.727445][T12171] fuse: Bad value for 'fd' 09:01:53 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2805.156667][T12174] fuse: Bad value for 'fd' 09:01:53 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2805.287951][T12177] fuse: Bad value for 'fd' 09:01:53 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2805.454359][T12180] fuse: Bad value for 'fd' 09:01:53 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2805.710439][T12183] fuse: Bad value for 'fd' 09:01:54 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2806.034490][T12186] fuse: Bad value for 'fd' 09:01:54 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2806.176204][T12189] fuse: Bad value for 'fd' 09:01:54 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2806.380076][T12192] fuse: Bad value for 'fd' 09:01:54 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2806.596276][T12195] fuse: Bad value for 'fd' 09:01:55 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r7}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2806.890403][T12198] fuse: Bad value for 'fd' 09:01:55 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2807.059504][T12201] fuse: Bad value for 'fd' 09:01:55 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2807.285325][T12204] fuse: Bad value for 'fd' 09:01:55 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2807.459151][ T38] kauditd_printk_skb: 36 callbacks suppressed [ 2807.459160][ T38] audit: type=1804 audit(1682672515.756:1439): pid=12206 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2683/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2807.497075][ T38] audit: type=1804 audit(1682672515.776:1440): pid=12206 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2683/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2807.569587][T12207] fuse: Bad value for 'fd' 09:01:55 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2807.710498][ T38] audit: type=1804 audit(1682672516.006:1441): pid=12209 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1581/bus" dev="sda1" ino=1963 res=1 errno=0 [ 2807.743294][ T38] audit: type=1804 audit(1682672516.026:1442): pid=12209 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1581/bus" dev="sda1" ino=1963 res=1 errno=0 [ 2807.787259][T12210] fuse: Bad value for 'fd' 09:01:56 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2807.856471][ T38] audit: type=1804 audit(1682672516.156:1443): pid=12212 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2977/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2807.887209][ T38] audit: type=1804 audit(1682672516.156:1444): pid=12212 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2977/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2807.917071][T12213] fuse: Bad value for 'fd' 09:01:56 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2808.104920][ T38] audit: type=1804 audit(1682672516.406:1445): pid=12215 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6682/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2808.126393][ T38] audit: type=1804 audit(1682672516.416:1446): pid=12215 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6682/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2808.179396][T12216] fuse: Bad value for 'fd' 09:01:56 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) r9 = syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) write$FUSE_INIT(r9, &(0x7f0000000e80)={0x50, 0x0, 0x0, {0x7, 0x26, 0x400, 0x400006, 0x8000, 0x3ff, 0x8f, 0x200}}, 0x50) [ 2808.419025][ T38] audit: type=1804 audit(1682672516.716:1447): pid=12218 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2684/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2808.466557][ T38] audit: type=1804 audit(1682672516.716:1448): pid=12218 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2684/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2808.488192][T12219] fuse: Bad value for 'fd' 09:01:56 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2808.688133][T12222] fuse: Bad value for 'fd' 09:01:57 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2808.806616][T12225] fuse: Bad value for 'fd' 09:01:57 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2809.104929][T12228] fuse: Bad value for 'fd' 09:01:57 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2809.430867][T12231] fuse: Bad value for 'fd' 09:01:57 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2809.535421][T12234] fuse: Bad value for 'fd' 09:01:57 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) [ 2809.676395][T12237] fuse: Bad value for 'fd' 09:01:58 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2810.026958][T12240] fuse: Bad value for 'fd' 09:01:58 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2810.281807][T12243] fuse: Bad value for 'fd' 09:01:58 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2810.422274][T12246] fuse: Bad value for 'fd' 09:01:58 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) [ 2810.597968][T12249] fuse: Bad value for 'fd' 09:01:59 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2810.914467][T12252] fuse: Bad value for 'fd' 09:01:59 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) 09:01:59 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2811.284683][T12258] fuse: Bad value for 'fd' [ 2811.300069][T12257] fuse: Bad value for 'fd' 09:01:59 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2811.470982][T12261] fuse: Bad value for 'fd' 09:02:00 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) syz_open_dev$audion(&(0x7f0000000080), 0x1e88d974, 0x80000) [ 2811.879265][T12264] fuse: Bad value for 'fd' 09:02:00 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:00 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) [ 2812.166463][T12269] fuse: Bad value for 'fd' [ 2812.212144][T12270] fuse: Bad value for 'fd' 09:02:00 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:02:00 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2812.701097][ T38] kauditd_printk_skb: 36 callbacks suppressed [ 2812.701111][ T38] audit: type=1804 audit(1682672520.996:1485): pid=12275 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6687/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2812.741530][ T38] audit: type=1804 audit(1682672521.016:1486): pid=12275 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6687/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2812.789150][T12276] fuse: Bad value for 'fd' 09:02:01 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:01 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) [ 2812.996188][ T38] audit: type=1804 audit(1682672521.296:1487): pid=12278 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1587/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2813.013016][T12278] fuse: Bad value for 'fd' [ 2813.021584][ T38] audit: type=1804 audit(1682672521.306:1488): pid=12278 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1587/bus" dev="sda1" ino=1962 res=1 errno=0 09:02:01 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2813.092148][ T38] audit: type=1804 audit(1682672521.336:1489): pid=12280 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2689/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2813.124834][ T38] audit: type=1804 audit(1682672521.346:1490): pid=12280 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2689/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2813.168347][T12281] fuse: Bad value for 'fd' 09:02:01 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2813.219345][ T38] audit: type=1804 audit(1682672521.516:1491): pid=12285 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2983/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2813.237390][T12283] fuse: Bad value for 'fd' 09:02:01 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2813.252008][ T38] audit: type=1804 audit(1682672521.526:1492): pid=12283 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1588/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2813.296219][ T38] audit: type=1804 audit(1682672521.526:1493): pid=12283 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1588/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2813.339693][T12288] fuse: Bad value for 'fd' [ 2813.354691][ T38] audit: type=1804 audit(1682672521.546:1494): pid=12285 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2983/bus" dev="sda1" ino=1961 res=1 errno=0 09:02:01 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2813.436503][T12290] fuse: Bad value for 'fd' 09:02:01 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2813.517027][T12292] fuse: Bad value for 'fd' 09:02:01 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:01 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2813.608360][T12294] fuse: Bad value for 'fd' [ 2813.641620][T12296] fuse: Bad value for 'fd' 09:02:02 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) 09:02:02 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2813.906041][T12298] fuse: Bad value for 'fd' [ 2814.008292][T12301] fuse: Bad value for 'fd' 09:02:02 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) 09:02:02 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) 09:02:02 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280), 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2814.165822][T12308] fuse: Bad value for 'fd' [ 2814.180196][T12309] fuse: Bad value for 'fd' 09:02:03 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) [ 2814.927840][T12313] fuse: Bad value for 'fd' 09:02:03 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:03 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:03 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) [ 2815.048294][T12320] fuse: Bad value for 'fd' [ 2815.061519][T12321] fuse: Bad value for 'fd' 09:02:03 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) [ 2815.781636][T12325] fuse: Bad value for 'fd' 09:02:04 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:04 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2815.954070][T12330] fuse: Bad value for 'fd' [ 2815.957908][T12331] fuse: Bad value for 'fd' 09:02:04 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2816.102156][T12334] fuse: Bad value for 'fd' 09:02:04 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) [ 2816.641583][T12337] fuse: Bad value for 'fd' 09:02:05 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:05 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, 0xffffffffffffffff, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2816.795522][T12341] fuse: Bad value for 'fd' 09:02:05 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, 0xffffffffffffffff, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2816.841261][T12342] fuse: Bad value for 'fd' [ 2816.878440][T12344] fuse: Bad value for 'fd' 09:02:05 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, 0xffffffffffffffff, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:05 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2816.959677][T12346] fuse: Bad value for 'fd' 09:02:05 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2817.045773][T12349] fuse: Bad value for 'fd' 09:02:05 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:05 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) r8 = openat$incfs(r5, &(0x7f0000000740)='.log\x00', 0x1, 0x40) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r6, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff]}, 0x80) [ 2817.509570][T12356] fuse: Bad value for 'fd' 09:02:05 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:05 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r3]) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r6, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r6, r5, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:05 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2817.724917][T12363] fuse: Bad value for 'fd' [ 2817.739107][T12364] fuse: Bad value for 'fd' 09:02:06 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r7, &(0x7f00000001c0), 0xfffffdef) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2817.942300][ T38] kauditd_printk_skb: 44 callbacks suppressed [ 2817.942314][ T38] audit: type=1804 audit(1682672526.246:1539): pid=12366 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6694/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2817.976854][ T38] audit: type=1804 audit(1682672526.256:1540): pid=12366 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6694/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2818.019838][T12367] fuse: Bad value for 'fd' 09:02:06 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2818.343957][ T38] audit: type=1804 audit(1682672526.646:1541): pid=12369 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2695/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2818.364499][ T38] audit: type=1804 audit(1682672526.646:1542): pid=12369 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2695/bus" dev="sda1" ino=1961 res=1 errno=0 09:02:06 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:06 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2818.524895][ T38] audit: type=1804 audit(1682672526.826:1543): pid=12372 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1603/bus" dev="sda1" ino=1963 res=1 errno=0 [ 2818.543092][ T38] audit: type=1804 audit(1682672526.836:1544): pid=12372 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1603/bus" dev="sda1" ino=1963 res=1 errno=0 [ 2818.625144][ T38] audit: type=1804 audit(1682672526.886:1545): pid=12374 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2989/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2818.654107][T12375] fuse: Bad value for 'fd' [ 2818.661828][ T38] audit: type=1804 audit(1682672526.896:1546): pid=12374 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2989/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2818.694919][T12376] fuse: Bad value for 'fd' 09:02:07 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2818.882075][ T38] audit: type=1804 audit(1682672527.176:1547): pid=12378 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6695/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2818.898363][ T38] audit: type=1804 audit(1682672527.196:1548): pid=12378 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6695/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2818.962875][T12379] fuse: Bad value for 'fd' 09:02:07 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) openat$incfs(r4, &(0x7f0000000740)='.log\x00', 0x1, 0x40) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:07 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:07 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2819.520334][T12387] fuse: Bad value for 'fd' [ 2819.585821][T12388] fuse: Bad value for 'fd' 09:02:08 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) [ 2819.862750][T12391] fuse: Bad value for 'fd' 09:02:08 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:08 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:08 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2820.390142][T12397] fuse: Bad value for 'fd' [ 2820.493279][T12400] fuse: Bad value for 'fd' 09:02:09 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2820.830965][T12403] fuse: Bad value for 'fd' 09:02:09 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:09 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:09 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2821.305225][T12409] fuse: Bad value for 'fd' [ 2821.393587][T12412] fuse: Bad value for 'fd' 09:02:09 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2821.729025][T12415] fuse: Bad value for 'fd' 09:02:10 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:10 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = dup(r0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r3, r2, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(r1, r0) 09:02:10 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2822.254995][T12423] fuse: Bad value for 'fd' [ 2822.322254][T12424] fuse: Bad value for 'fd' 09:02:10 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2822.766804][T12427] fuse: Bad value for 'fd' 09:02:11 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:11 executing program 0: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, r0) 09:02:11 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2823.087001][ T38] kauditd_printk_skb: 34 callbacks suppressed [ 2823.087010][ T38] audit: type=1804 audit(1682672531.386:1583): pid=12432 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1608/bus" dev="sda1" ino=1963 res=1 errno=0 [ 2823.110556][ T38] audit: type=1804 audit(1682672531.406:1584): pid=12432 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1608/bus" dev="sda1" ino=1963 res=1 errno=0 [ 2823.143468][ T38] audit: type=1804 audit(1682672531.426:1585): pid=12434 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2994/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2823.174230][T12435] fuse: Bad value for 'fd' [ 2823.175469][ T38] audit: type=1804 audit(1682672531.436:1586): pid=12434 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2994/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2823.200615][T12436] fuse: Bad value for 'fd' 09:02:11 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r6}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2823.653971][ T38] audit: type=1804 audit(1682672531.956:1587): pid=12438 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6700/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2823.688254][ T38] audit: type=1804 audit(1682672531.976:1588): pid=12438 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6700/bus" dev="sda1" ino=1973 res=1 errno=0 09:02:12 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2823.743997][T12439] fuse: Bad value for 'fd' [ 2823.783873][ T38] audit: type=1804 audit(1682672532.086:1589): pid=12441 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2701/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2823.809149][ T38] audit: type=1804 audit(1682672532.096:1590): pid=12441 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2701/bus" dev="sda1" ino=1961 res=1 errno=0 09:02:12 executing program 0: mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:12 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2824.010679][ T38] audit: type=1804 audit(1682672532.306:1591): pid=12445 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2995/bus" dev="sda1" ino=1965 res=1 errno=0 [ 2824.031877][ T38] audit: type=1804 audit(1682672532.306:1592): pid=12445 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2995/bus" dev="sda1" ino=1965 res=1 errno=0 [ 2824.074786][T12447] fuse: Bad value for 'fd' [ 2824.085302][T12448] fuse: Bad value for 'fd' 09:02:12 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:12 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2824.715971][T12453] fuse: Bad value for 'fd' 09:02:13 executing program 0: mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:13 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:13 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:13 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2825.728651][T12465] fuse: Bad value for 'fd' [ 2825.728887][T12463] fuse: Bad value for 'fd' [ 2825.734303][T12464] fuse: Bad value for 'fd' 09:02:15 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:15 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:15 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:15 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2826.821122][T12475] fuse: Bad value for 'fd' [ 2826.835109][T12477] fuse: Bad value for 'fd' [ 2826.852377][T12478] fuse: Bad value for 'fd' 09:02:16 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:16 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:16 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) write$cgroup_int(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:16 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2827.821697][T12487] fuse: Bad value for 'fd' [ 2827.822156][T12488] fuse: Bad value for 'fd' [ 2827.837416][T12490] fuse: Bad value for 'fd' 09:02:17 executing program 0: mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:17 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 09:02:17 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:17 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2828.747223][ T38] kauditd_printk_skb: 30 callbacks suppressed [ 2828.747269][ T38] audit: type=1804 audit(1682672537.046:1623): pid=12495 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1613/bus" dev="sda1" ino=1970 res=1 errno=0 [ 2828.750969][T12496] fuse: Bad value for 'fd' [ 2828.782151][ T38] audit: type=1804 audit(1682672537.046:1624): pid=12496 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2999/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2828.816478][ T38] audit: type=1804 audit(1682672537.046:1625): pid=12496 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/2999/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2828.821673][T12499] fuse: Bad value for 'fd' [ 2828.863278][ T38] audit: type=1804 audit(1682672537.066:1626): pid=12497 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6705/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2828.922027][ T38] audit: type=1804 audit(1682672537.066:1627): pid=12497 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6705/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2828.969508][ T38] audit: type=1804 audit(1682672537.066:1628): pid=12495 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1613/bus" dev="sda1" ino=1970 res=1 errno=0 [ 2829.012906][ T38] audit: type=1804 audit(1682672537.066:1629): pid=12498 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2706/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2829.076414][ T38] audit: type=1804 audit(1682672537.066:1630): pid=12498 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2706/bus" dev="sda1" ino=1973 res=1 errno=0 09:02:17 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2829.136615][ T38] audit: type=1804 audit(1682672537.436:1631): pid=12503 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3000/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2829.160591][T12503] fuse: Bad value for 'fd' [ 2829.172593][ T38] audit: type=1804 audit(1682672537.436:1632): pid=12503 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3000/bus" dev="sda1" ino=1971 res=1 errno=0 09:02:17 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:18 executing program 0: mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2829.714771][T12505] fuse: Bad value for 'fd' 09:02:18 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:18 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 09:02:18 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2829.800241][T12514] fuse: Bad value for 'fd' [ 2829.814757][T12513] fuse: Bad value for 'fd' 09:02:18 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2829.881414][T12518] fuse: Bad value for 'fd' 09:02:18 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2829.926790][T12520] fuse: Bad value for 'fd' 09:02:18 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2830.032912][T12523] fuse: Bad value for 'fd' 09:02:18 executing program 0: mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:18 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 09:02:18 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2830.762953][T12531] fuse: Bad value for 'fd' 09:02:19 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2831.130048][T12535] fuse: Bad value for 'fd' 09:02:19 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:19 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:19 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2831.759833][T12542] fuse: Bad value for 'fd' [ 2831.762810][T12543] fuse: Bad value for 'fd' 09:02:20 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2832.204560][T12547] fuse: Bad value for 'fd' 09:02:20 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:20 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:21 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) [ 2832.745805][T12554] fuse: Bad value for 'fd' [ 2832.748152][T12555] fuse: Bad value for 'fd' 09:02:21 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:21 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:21 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:21 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) [ 2833.692849][T12566] fuse: Bad value for 'fd' [ 2833.706836][T12567] fuse: Bad value for 'fd' [ 2833.731098][T12568] fuse: Bad value for 'fd' 09:02:22 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:22 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x80) 09:02:22 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:22 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2834.580229][ T38] kauditd_printk_skb: 43 callbacks suppressed [ 2834.580238][ T38] audit: type=1804 audit(1682672542.876:1676): pid=12575 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1619/bus" dev="sda1" ino=1970 res=1 errno=0 [ 2834.609707][ T38] audit: type=1804 audit(1682672542.876:1677): pid=12573 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3009/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2834.637722][T12577] fuse: Bad value for 'fd' [ 2834.647400][ T38] audit: type=1804 audit(1682672542.876:1678): pid=12573 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3009/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2834.672358][T12580] fuse: Bad value for 'fd' [ 2834.686727][T12579] fuse: Bad value for 'fd' [ 2834.698904][ T38] audit: type=1804 audit(1682672542.886:1679): pid=12574 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2712/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2834.750769][ T38] audit: type=1804 audit(1682672542.886:1680): pid=12574 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2712/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2834.800988][ T38] audit: type=1804 audit(1682672542.896:1681): pid=12575 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1619/bus" dev="sda1" ino=1970 res=1 errno=0 [ 2834.850180][ T38] audit: type=1804 audit(1682672542.896:1682): pid=12576 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6711/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2834.904033][ T38] audit: type=1804 audit(1682672542.896:1683): pid=12576 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6711/bus" dev="sda1" ino=1973 res=1 errno=0 09:02:23 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:23 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:23 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:23 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2835.646592][ T38] audit: type=1804 audit(1682672543.946:1684): pid=12585 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2713/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2835.658744][ T38] audit: type=1804 audit(1682672543.946:1685): pid=12585 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2713/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2835.726562][T12590] fuse: Bad value for 'fd' [ 2835.737501][T12591] fuse: Bad value for 'fd' [ 2835.741305][T12592] fuse: Bad value for 'fd' [ 2835.892732][ T1342] ieee802154 phy0 wpan0: encryption failed: -22 [ 2835.895266][ T1342] ieee802154 phy1 wpan1: encryption failed: -22 09:02:24 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:24 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:24 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:24 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2836.681841][T12597] fuse: Bad value for 'fd' [ 2836.732594][T12601] fuse: Bad value for 'fd' [ 2836.735221][T12602] fuse: Bad value for 'fd' 09:02:25 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2836.821489][T12605] fuse: Bad value for 'fd' 09:02:25 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2836.954937][T12607] fuse: Bad value for 'fd' 09:02:25 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:25 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:25 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:25 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:25 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:25 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:25 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2837.673037][T12619] fuse: Bad value for 'fd' [ 2837.697172][T12620] fuse: Bad value for 'fd' 09:02:26 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2837.774822][T12624] fuse: Bad value for 'fd' [ 2837.819524][T12626] fuse: Bad value for 'fd' 09:02:26 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2838.115569][T12628] fuse: Bad value for 'fd' 09:02:26 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:26 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:26 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:26 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2838.615737][T12633] fuse: Bad value for 'fd' [ 2838.661900][T12637] fuse: Bad value for 'fd' 09:02:26 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:26 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2838.695611][T12640] fuse: Bad value for 'fd' [ 2838.700262][T12639] fuse: Bad value for 'fd' 09:02:27 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2838.746790][T12644] fuse: Bad value for 'fd' 09:02:27 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:27 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:27 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r3, 0x0, 0x1ffff) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r4}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r4, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff]}, 0x80) [ 2838.962688][T12651] fuse: Bad value for 'fd' 09:02:27 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:27 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r3, 0x0, 0x1ffff) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r4}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r4, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff]}, 0x80) 09:02:27 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2839.626803][T12658] fuse: Bad value for 'fd' [ 2839.638224][T12659] fuse: Bad value for 'fd' 09:02:28 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:28 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) write(0xffffffffffffffff, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(0xffffffffffffffff, r3, 0x0, 0x1ffff) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r4}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r4, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff]}, 0x80) [ 2839.863625][ T38] kauditd_printk_skb: 45 callbacks suppressed [ 2839.863634][ T38] audit: type=1804 audit(1682672548.166:1731): pid=12662 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6721/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2839.899215][ T38] audit: type=1804 audit(1682672548.176:1732): pid=12663 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2721/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2839.930970][ T38] audit: type=1804 audit(1682672548.186:1733): pid=12662 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6721/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2839.945230][T12664] fuse: Bad value for 'fd' 09:02:28 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2840.028639][ T38] audit: type=1804 audit(1682672548.326:1734): pid=12666 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2722/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2840.050839][ T38] audit: type=1804 audit(1682672548.346:1735): pid=12666 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2722/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2840.556860][ T38] audit: type=1804 audit(1682672548.856:1736): pid=12670 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3020/bus" dev="sda1" ino=1970 res=1 errno=0 [ 2840.572729][ T38] audit: type=1804 audit(1682672548.856:1737): pid=12671 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1625/bus" dev="sda1" ino=1972 res=1 errno=0 09:02:28 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:28 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2840.625124][ T38] audit: type=1804 audit(1682672548.856:1738): pid=12671 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1625/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2840.626637][T12672] fuse: Bad value for 'fd' [ 2840.642126][T12673] fuse: Bad value for 'fd' [ 2840.657206][ T38] audit: type=1804 audit(1682672548.866:1739): pid=12670 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3020/bus" dev="sda1" ino=1970 res=1 errno=0 09:02:29 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:29 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:29 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:29 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2841.567659][ T38] audit: type=1804 audit(1682672549.866:1740): pid=12679 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1626/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2841.640327][T12682] fuse: Bad value for 'fd' [ 2841.658554][T12685] fuse: Bad value for 'fd' [ 2841.662754][T12684] fuse: Bad value for 'fd' 09:02:31 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:31 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:31 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2842.934132][T12693] fuse: Bad value for 'fd' [ 2842.940938][T12694] fuse: Bad value for 'fd' 09:02:31 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2843.387129][T12697] fuse: Bad value for 'fd' 09:02:32 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:32 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:32 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2844.223414][T12704] fuse: Bad value for 'fd' [ 2844.234321][T12705] fuse: Bad value for 'fd' 09:02:33 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2845.282443][ T38] kauditd_printk_skb: 21 callbacks suppressed [ 2845.282452][ T38] audit: type=1804 audit(1682672553.586:1762): pid=12708 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1628/bus" dev="sda1" ino=1957 res=1 errno=0 [ 2845.318009][ T38] audit: type=1804 audit(1682672553.596:1763): pid=12708 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1628/bus" dev="sda1" ino=1957 res=1 errno=0 [ 2845.416304][T12709] fuse: Bad value for 'fd' 09:02:33 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:33 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:33 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2845.661088][ T38] audit: type=1804 audit(1682672553.956:1764): pid=12712 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2726/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2845.717590][ T38] audit: type=1804 audit(1682672553.986:1765): pid=12714 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3024/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2845.757341][T12717] fuse: Bad value for 'fd' [ 2845.785802][ T38] audit: type=1804 audit(1682672553.986:1766): pid=12712 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2726/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2845.805274][T12718] fuse: Bad value for 'fd' [ 2845.848599][ T38] audit: type=1804 audit(1682672553.986:1767): pid=12714 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3024/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2845.917161][ T38] audit: type=1804 audit(1682672554.026:1768): pid=12715 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6725/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2846.020828][ T38] audit: type=1804 audit(1682672554.046:1769): pid=12715 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6725/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2847.412016][ T38] audit: type=1804 audit(1682672555.706:1770): pid=12720 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1629/bus" dev="sda1" ino=1957 res=1 errno=0 09:02:35 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2847.453664][ T38] audit: type=1804 audit(1682672555.726:1771): pid=12720 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1629/bus" dev="sda1" ino=1957 res=1 errno=0 [ 2847.565778][T12721] fuse: Bad value for 'fd' [ 2848.843019][T12729] fuse: Bad value for 'fd' [ 2848.878054][T12730] fuse: Bad value for 'fd' [ 2848.890754][T12732] fuse: Bad value for 'fd' 09:02:37 executing program 3: syz_init_net_socket$llc(0x1a, 0x1, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:37 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:37 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:37 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, 0xffffffffffffffff, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:38 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB, @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:38 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, 0xffffffffffffffff, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:38 executing program 3: syz_init_net_socket$llc(0x1a, 0x1, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2850.344680][T12738] fuse: Bad value for 'fd' [ 2850.345110][T12737] fuse: Bad value for 'fd' [ 2850.491886][T12740] fuse: Bad value for 'fd' 09:02:39 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, 0xffffffffffffffff, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2851.470684][T12742] fuse: Bad value for 'fd' 09:02:39 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r3, 0xffffffffffffffff, 0x0, 0x1ffff) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r4}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r4, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff]}, 0x80) [ 2851.675447][ T38] kauditd_printk_skb: 10 callbacks suppressed 09:02:39 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB, @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:39 executing program 3: syz_init_net_socket$llc(0x1a, 0x1, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2851.675461][ T38] audit: type=1804 audit(1682672559.976:1782): pid=12747 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3027/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2851.786495][T12749] fuse: Bad value for 'fd' [ 2851.794066][T12750] fuse: Bad value for 'fd' [ 2851.796392][ T38] audit: type=1804 audit(1682672559.976:1783): pid=12746 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1632/bus" dev="sda1" ino=1968 res=1 errno=0 [ 2851.836436][ T38] audit: type=1804 audit(1682672560.006:1784): pid=12747 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3027/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2851.893518][ T38] audit: type=1804 audit(1682672560.006:1785): pid=12746 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1632/bus" dev="sda1" ino=1968 res=1 errno=0 09:02:40 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r3, 0xffffffffffffffff, 0x0, 0x1ffff) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r4}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r4, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff]}, 0x80) 09:02:40 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:41 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB, @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:41 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:41 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r3, 0xffffffffffffffff, 0x0, 0x1ffff) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r4}, 0x10) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r5, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r4, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff]}, 0x80) [ 2853.479438][ T38] audit: type=1804 audit(1682672561.776:1786): pid=12759 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3028/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2853.521717][ T38] audit: type=1804 audit(1682672561.786:1787): pid=12755 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1633/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2853.558800][T12761] fuse: Bad value for 'fd' [ 2853.568675][T12762] fuse: Bad value for 'fd' [ 2853.622139][ T38] audit: type=1804 audit(1682672561.786:1788): pid=12755 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1633/bus" dev="sda1" ino=1971 res=1 errno=0 [ 2853.709636][ T38] audit: type=1804 audit(1682672561.796:1789): pid=12759 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3028/bus" dev="sda1" ino=1966 res=1 errno=0 09:02:43 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:43 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705d", @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:43 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:43 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2855.144848][ T38] audit: type=1804 audit(1682672563.446:1790): pid=12767 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3029/bus" dev="sda1" ino=1970 res=1 errno=0 [ 2855.170531][ T38] audit: type=1804 audit(1682672563.446:1791): pid=12767 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3029/bus" dev="sda1" ino=1970 res=1 errno=0 [ 2855.210713][T12771] fuse: Bad value for 'fd' [ 2855.222155][T12772] fuse: Bad value for 'fd' 09:02:45 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) 09:02:45 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)=0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r5, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r5, r4, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:45 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705d", @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2856.927449][ T38] kauditd_printk_skb: 2 callbacks suppressed [ 2856.927463][ T38] audit: type=1804 audit(1682672565.226:1794): pid=12778 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1635/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2857.017054][T12780] fuse: Bad value for 'fd' [ 2857.018668][ T38] audit: type=1804 audit(1682672565.236:1795): pid=12778 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1635/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2857.349474][ T38] audit: type=1804 audit(1682672565.646:1796): pid=12783 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6732/bus" dev="sda1" ino=1967 res=1 errno=0 09:02:45 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:45 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240)=0x0, &(0x7f0000000140)) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=r2]) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r4, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r4, r3, 0x0, 0x1ffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r5}, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r6, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r5, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff]}, 0x80) [ 2857.384250][ T38] audit: type=1804 audit(1682672565.666:1797): pid=12783 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6732/bus" dev="sda1" ino=1967 res=1 errno=0 [ 2857.443551][T12785] fuse: Bad value for 'fd' [ 2859.014594][ T38] audit: type=1804 audit(1682672567.316:1798): pid=12788 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3030/bus" dev="sda1" ino=1961 res=1 errno=0 09:02:47 executing program 3: dup(0xffffffffffffffff) getresgid(0x0, &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:47 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r3}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r4, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r3, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff]}, 0x80) [ 2859.060695][ T38] audit: type=1804 audit(1682672567.316:1799): pid=12788 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3030/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2859.077491][T12790] fuse: Bad value for 'fd' [ 2859.134099][ T38] audit: type=1804 audit(1682672567.326:1800): pid=12789 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2734/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2859.216121][ T38] audit: type=1804 audit(1682672567.326:1801): pid=12789 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2734/bus" dev="sda1" ino=1962 res=1 errno=0 09:02:47 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='f', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:47 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2860.646737][ T38] audit: type=1804 audit(1682672568.946:1802): pid=12795 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6733/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2860.688633][ T38] audit: type=1804 audit(1682672568.946:1803): pid=12795 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6733/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2860.732054][T12796] fuse: Bad value for 'fd' [ 2860.752286][T12797] fuse: Bad value for 'fd' 09:02:49 executing program 3: dup(0xffffffffffffffff) getresgid(0x0, &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:49 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r3}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r4, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r3, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff]}, 0x80) [ 2862.081223][ T38] kauditd_printk_skb: 2 callbacks suppressed [ 2862.081238][ T38] audit: type=1804 audit(1682672570.376:1806): pid=12800 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3031/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2862.169104][ T38] audit: type=1804 audit(1682672570.376:1807): pid=12800 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3031/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2862.174483][T12802] fuse: Bad value for 'fd' [ 2862.242212][ T38] audit: type=1804 audit(1682672570.406:1808): pid=12801 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2735/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2862.340599][ T38] audit: type=1804 audit(1682672570.406:1809): pid=12801 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2735/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2862.406379][ T38] audit: type=1804 audit(1682672570.686:1810): pid=12806 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1637/bus" dev="sda1" ino=1972 res=1 errno=0 09:02:50 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:50 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='f', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2862.472815][ T38] audit: type=1804 audit(1682672570.686:1811): pid=12806 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1637/bus" dev="sda1" ino=1972 res=1 errno=0 [ 2862.485890][T12809] fuse: Bad value for 'fd' [ 2862.525074][T12808] fuse: Bad value for 'fd' [ 2862.538032][ T38] audit: type=1804 audit(1682672570.696:1812): pid=12807 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6734/bus" dev="sda1" ino=1973 res=1 errno=0 [ 2862.600239][ T38] audit: type=1804 audit(1682672570.706:1813): pid=12807 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6734/bus" dev="sda1" ino=1973 res=1 errno=0 09:02:51 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r3}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r4, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r3, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff]}, 0x80) 09:02:51 executing program 3: dup(0xffffffffffffffff) getresgid(0x0, &(0x7f0000000240), &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2864.110713][ T38] audit: type=1804 audit(1682672572.406:1814): pid=12813 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3032/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2864.150980][ T38] audit: type=1804 audit(1682672572.416:1815): pid=12813 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3032/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2864.203691][T12815] fuse: Bad value for 'fd' 09:02:52 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='f', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2864.387551][T12819] fuse: Bad value for 'fd' 09:02:52 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2865.093149][T12822] fuse: Bad value for 'fd' 09:02:54 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r3, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r3, r2, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:54 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, &(0x7f0000000140)=0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:54 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b052", @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:54 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r3}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r4, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r3, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff]}, 0x80) [ 2866.212609][T12831] fuse: Bad value for 'fd' [ 2866.216212][T12832] fuse: Bad value for 'fd' [ 2866.232303][T12833] fuse: Bad value for 'fd' [ 2867.014689][T12828] syz-executor.2 (12828) used greatest stack depth: 20816 bytes left 09:02:56 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='f', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:02:56 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r3}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r4, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r3, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff]}, 0x80) 09:02:56 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2868.163567][ T38] kauditd_printk_skb: 14 callbacks suppressed [ 2868.163580][ T38] audit: type=1804 audit(1682672576.466:1830): pid=12838 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6737/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2868.242859][T12841] fuse: Bad value for 'fd' [ 2868.248545][T12843] fuse: Bad value for 'fd' [ 2868.354685][ T38] audit: type=1804 audit(1682672576.466:1831): pid=12838 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6737/bus" dev="sda1" ino=1966 res=1 errno=0 [ 2868.483400][ T38] audit: type=1804 audit(1682672576.466:1832): pid=12839 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1640/bus" dev="sda1" ino=1967 res=1 errno=0 [ 2868.578260][ T38] audit: type=1804 audit(1682672576.476:1833): pid=12839 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1640/bus" dev="sda1" ino=1967 res=1 errno=0 [ 2868.653005][ T38] audit: type=1804 audit(1682672576.486:1834): pid=12840 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2738/bus" dev="sda1" ino=1968 res=1 errno=0 [ 2868.746179][ T38] audit: type=1804 audit(1682672576.486:1835): pid=12840 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2738/bus" dev="sda1" ino=1968 res=1 errno=0 09:02:58 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:02:58 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='f', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2870.100749][ T38] audit: type=1804 audit(1682672578.396:1836): pid=12845 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1641/bus" dev="sda1" ino=1957 res=1 errno=0 [ 2870.122829][ T38] audit: type=1804 audit(1682672578.406:1837): pid=12845 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1641/bus" dev="sda1" ino=1957 res=1 errno=0 [ 2870.171590][T12846] fuse: Bad value for 'fd' 09:02:58 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r3}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r4, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r3, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r4, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff]}, 0x80) [ 2870.397918][ T38] audit: type=1804 audit(1682672578.696:1838): pid=12848 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3034/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2870.473451][ T38] audit: type=1804 audit(1682672578.736:1839): pid=12848 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/syzkaller-testdir4071056483/syzkaller.C72K5C/3034/bus" dev="sda1" ino=1962 res=1 errno=0 [ 2870.687288][T12849] fuse: Bad value for 'fd' [ 2870.767236][ T4620] udevd invoked oom-killer: gfp_mask=0x40cc0(GFP_KERNEL|__GFP_COMP), order=1, oom_score_adj=-1000 [ 2870.828325][ T4620] CPU: 0 PID: 4620 Comm: udevd Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0 [ 2870.836959][ T4620] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 2870.840487][ T4620] Call Trace: [ 2870.841790][ T4620] [ 2870.842913][ T4620] dump_stack_lvl+0x136/0x150 [ 2870.844758][ T4620] dump_header+0x10a/0xd70 [ 2870.846737][ T4620] oom_kill_process+0x25d/0x600 [ 2870.849003][ T4620] out_of_memory+0x35c/0x1660 [ 2870.851661][ T4620] ? oom_killer_disable+0x2b0/0x2b0 [ 2870.853777][ T4620] __alloc_pages_slowpath.constprop.0+0x1b25/0x2170 [ 2870.856565][ T4620] ? warn_alloc+0x360/0x360 [ 2870.858530][ T4620] ? prepare_alloc_pages+0x417/0x570 [ 2870.860837][ T4620] ? prepare_alloc_pages+0x417/0x570 [ 2870.863234][ T4620] __alloc_pages+0x408/0x4a0 [ 2870.879937][ T4620] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 2870.883108][ T4620] ? kmem_cache_alloc+0x2ae/0x3f0 [ 2870.885369][ T4620] cache_grow_begin+0x9b/0x3b0 [ 2870.887531][ T4620] fallback_alloc+0x1e2/0x2d0 [ 2870.889648][ T4620] kmem_cache_alloc+0x2ae/0x3f0 [ 2870.892743][ T4620] getname_flags.part.0+0x50/0x4f0 [ 2870.895435][ T4620] ? syscall_enter_from_user_mode+0x26/0x80 [ 2870.899038][ T4620] __x64_sys_unlink+0xb5/0x110 [ 2870.901315][ T4620] do_syscall_64+0x39/0xb0 [ 2870.902792][ T4620] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 2870.905393][ T4620] RIP: 0033:0x7f41f1d17da7 [ 2870.907182][ T4620] Code: Unable to access opcode bytes at 0x7f41f1d17d7d. [ 2870.909722][ T4620] RSP: 002b:00007ffeadd3fa58 EFLAGS: 00000202 ORIG_RAX: 0000000000000057 [ 2870.913485][ T4620] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f41f1d17da7 [ 2870.916860][ T4620] RDX: 0000000000000000 RSI: 00000000ab017740 RDI: 000055655d4650d8 [ 2870.919652][ T4620] RBP: 000055655ef3ef90 R08: 00000000ab05a1a2 R09: 00007ffeadd55080 [ 2870.923065][ T4620] R10: 00007ffeadd55090 R11: 0000000000000202 R12: 0000000000000bb8 [ 2870.925882][ T4620] R13: 000055655ef3e740 R14: 0000000000000000 R15: 0000000000000000 [ 2870.928641][ T4620] [ 2871.345519][ T4620] Mem-Info: [ 2871.347306][ T4620] active_anon:32429 inactive_anon:117867 isolated_anon:0 [ 2871.347306][ T4620] active_file:361 inactive_file:292 isolated_file:0 [ 2871.347306][ T4620] unevictable:1536 dirty:14 writeback:0 [ 2871.347306][ T4620] slab_reclaimable:17998 slab_unreclaimable:58582 [ 2871.347306][ T4620] mapped:12184 shmem:7089 pagetables:1015 [ 2871.347306][ T4620] sec_pagetables:0 bounce:0 [ 2871.347306][ T4620] kernel_misc_reclaimable:0 [ 2871.347306][ T4620] free:18705 free_pcp:108 free_cma:0 [ 2871.463028][ T4620] Node 0 active_anon:37572kB inactive_anon:6880kB active_file:1612kB inactive_file:1916kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:2896kB dirty:12kB writeback:0kB shmem:4960kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:8388kB pagetables:984kB sec_pagetables:0kB all_unreclaimable? no [ 2871.533584][ T4620] Node 1 active_anon:159208kB inactive_anon:397528kB active_file:140kB inactive_file:2256kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:48872kB dirty:52kB writeback:0kB shmem:23396kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:4276kB pagetables:3052kB sec_pagetables:0kB all_unreclaimable? no 09:02:59 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2871.643349][ T4620] Node 0 DMA free:3636kB boost:0kB min:736kB low:920kB high:1104kB reserved_highatomic:2048KB active_anon:6520kB inactive_anon:220kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2871.711230][ T4620] lowmem_reserve[]: 0 425 425 425 425 [ 2871.736146][ T4620] Node 0 DMA32 free:24184kB boost:0kB min:20956kB low:26192kB high:31428kB reserved_highatomic:2048KB active_anon:6556kB inactive_anon:31160kB active_file:272kB inactive_file:1500kB unevictable:3072kB writepending:28kB present:1032192kB managed:440768kB mlocked:0kB bounce:0kB free_pcp:308kB local_pcp:148kB free_cma:0kB 09:03:00 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='f', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:03:00 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2871.847420][ T4620] lowmem_reserve[]: 0 0 0 0 0 [ 2871.859985][T12855] fuse: Bad value for 'fd' [ 2871.884408][ T4620] Node 1 DMA32 free:48544kB boost:0kB min:45884kB low:57352kB high:68820kB reserved_highatomic:2048KB active_anon:87588kB inactive_anon:469260kB active_file:1328kB inactive_file:1496kB unevictable:3072kB writepending:52kB present:1048436kB managed:954724kB mlocked:0kB bounce:0kB free_pcp:1736kB local_pcp:160kB free_cma:0kB [ 2871.960809][ T4620] lowmem_reserve[]: 0 0 0 0 0 [ 2871.978658][ T4620] Node 0 DMA: 144*4kB (UMH) 146*8kB (MH) 68*16kB (UMH) 32*32kB (UMH) 8*64kB (M) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4368kB [ 2872.003738][T12858] fuse: Bad value for 'fd' [ 2872.035212][ T4620] Node 0 DMA32: 1982*4kB (UMEH) 1384*8kB (UME) 256*16kB (UMH) 2*32kB (UH) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 23160kB [ 2872.100907][ T4620] Node 1 DMA32: 415*4kB (UME) 904*8kB (UME) 349*16kB (UME) 168*32kB (UME) 147*64kB (UM) 59*128kB (UM) 26*256kB (UM) 6*512kB (UM) 0*1024kB 1*2048kB (H) 0*4096kB = 48588kB [ 2872.116089][T12861] fuse: Bad value for 'fd' [ 2872.155891][ T4620] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2872.190650][ T4620] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2872.337197][ T4620] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2872.376919][ T4620] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB 09:03:00 executing program 1: syz_init_net_socket$llc(0x1a, 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r2}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r3, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r2, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) [ 2872.417039][ T4620] 8145 total pagecache pages [ 2872.439916][ T4620] 0 pages in swap cache [ 2872.452582][ T4620] Free swap = 0kB [ 2872.470826][ T4620] Total swap = 0kB [ 2872.484534][ T4620] 524155 pages RAM [ 2872.504574][ T4620] 0 pages HighMem/MovableOnly [ 2872.523575][ T4620] 171442 pages reserved [ 2872.540091][ T4620] 0 pages cma reserved [ 2872.566098][ T4620] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0-1,global_oom,task_memcg=/syz1,task=syz-executor.1,pid=464,uid=0 [ 2872.655365][ T4620] Out of memory: Killed process 464 (syz-executor.1) total-vm:54680kB, anon-rss:520kB, file-rss:12288kB, shmem-rss:0kB, UID:0 pgtables:80kB oom_score_adj:1000 09:03:01 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) dup(r0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r2, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r2, r1, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:03:01 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:03:01 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54", @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2873.049528][T12871] fuse: Bad value for 'fd' [ 2873.059237][T12872] fuse: Bad value for 'fd' 09:03:01 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:03:01 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:03:01 executing program 1: openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r2}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r3, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r2, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 09:03:01 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2873.719428][ T38] kauditd_printk_skb: 14 callbacks suppressed [ 2873.719441][ T38] audit: type=1804 audit(1682672582.016:1854): pid=12879 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2741/bus" dev="sda1" ino=1967 res=1 errno=0 [ 2873.764935][T12880] fuse: Bad value for 'fd' [ 2873.788445][ T38] audit: type=1804 audit(1682672582.086:1855): pid=12879 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2741/bus" dev="sda1" ino=1967 res=1 errno=0 09:03:02 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:03:02 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='f', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2874.729926][ T38] audit: type=1804 audit(1682672583.026:1856): pid=12884 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1644/bus" dev="sda1" ino=1960 res=1 errno=0 [ 2874.829836][T12887] fuse: Bad value for 'fd' [ 2874.834658][T12888] fuse: Bad value for 'fd' [ 2874.849603][ T38] audit: type=1804 audit(1682672583.026:1857): pid=12884 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1644/bus" dev="sda1" ino=1960 res=1 errno=0 [ 2875.134187][ T38] audit: type=1804 audit(1682672583.436:1858): pid=12891 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1645/bus" dev="sda1" ino=1955 res=1 errno=0 09:03:03 executing program 2: syz_init_net_socket$llc(0x1a, 0x1, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:03:03 executing program 1: openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r2}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r3, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r2, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) 09:03:03 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:03:03 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='f', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 2875.161451][T12892] fuse: Bad value for 'fd' [ 2875.197803][ T38] audit: type=1804 audit(1682672583.436:1859): pid=12891 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/syzkaller-testdir933942510/syzkaller.7lbYti/1645/bus" dev="sda1" ino=1955 res=1 errno=0 [ 2875.213092][T12893] fuse: Bad value for 'fd' [ 2875.298356][ T38] audit: type=1804 audit(1682672583.596:1860): pid=12895 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6740/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2875.353848][ T38] audit: type=1804 audit(1682672583.616:1861): pid=12897 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2742/bus" dev="sda1" ino=1967 res=1 errno=0 [ 2875.432025][ T38] audit: type=1804 audit(1682672583.616:1862): pid=12895 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/syzkaller-testdir2679662594/syzkaller.viHtrx/6740/bus" dev="sda1" ino=1961 res=1 errno=0 [ 2875.453127][T12899] fuse: Bad value for 'fd' [ 2875.494127][ T38] audit: type=1804 audit(1682672583.616:1863): pid=12897 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/syzkaller-testdir1380956497/syzkaller.Y59YlH/2742/bus" dev="sda1" ino=1967 res=1 errno=0 09:03:03 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2875.796032][T12902] fuse: Bad value for 'fd' 09:03:05 executing program 0: mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='f', @ANYBLOB]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) socket$can_bcm(0x1d, 0x2, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) 09:03:05 executing program 2: syz_init_net_socket$llc(0x1a, 0x1, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="66643d106a809ef088158f6739b47e0f54c32b4e36ca5dbcd88afd7b643806b0521451307f7215c57cdf144b8a3a61326bbdb7b7fa9201a9a08e4d62c2ad3d705de74c6a7d145eac48ab53892f53df620f27601549deb32bfb9ca33fdfcf423494ee4a43954d3d4ecbe78bcd80c2e373f7d84420764eb9ba17e398e6789dc43b1b", @ANYRESHEX, @ANYBLOB=',rootmode=000000000000100040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC]) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) 09:03:05 executing program 1: openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280), 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xfffffffffffffffc) sendfile(r1, r0, 0x0, 0x1ffff) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000f300080000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00', r2}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) write$cgroup_int(r3, &(0x7f00000001c0), 0xfffffdef) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0xa, 0x5, &(0x7f0000000a80)=ANY=[@ANYRES64, @ANYBLOB="132cc099f007764d1c4eac7b272b07a4dc94574cea4c3408cfd8a03441ed54ed48ebc94acb5b8337e72a6cf307c1553321be2fb48db42207ef7901db3a90949a0b59c35c4b7aa85f00f83d6e8227f0e1c703016ca7615a91221b50b692960e5c02e83e84575b4e8392098e"], &(0x7f0000000780)='syzkaller\x00', 0x8, 0xbb, &(0x7f0000000800)=""/187, 0x41100, 0x4, '\x00', 0x0, 0x10, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000980)={0x22, 0x0, 0x1, 0x5}, 0x10, 0x0, r2, 0x0, &(0x7f00000009c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff, 0xffffffffffffffff, r2, 0xffffffffffffffff]}, 0x80) [ 2877.071152][T12907] fuse: Bad value for 'fd' [ 2877.111661][T12908] fuse: Bad value for 'fd' 09:03:05 executing program 3: dup(0xffffffffffffffff) getresgid(&(0x7f0000000040), 0x0, 0x0) creat(&(0x7f00000000c0)='./bus\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000480)=@known='security.selinux\x00', &(0x7f00000004c0)='$\x00', 0x2, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x141002, 0x0) write(r1, &(0x7f0000004200)='t', 0x1) sendfile(r1, r0, 0x0, 0x1ffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='rcu_utilization\x00'}, 0x10) mount$fuse(0x0, &(0x7f00000005c0)='./bus\x00', &(0x7f0000000600), 0x0, &(0x7f0000000bc0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}, {@allow_other}, {@blksize}], [{@obj_user={'obj_user', 0x3d, 'syzkaller\x00'}}]}}) [ 2880.537542][ C1] ksoftirqd/1: page allocation failure: order:0, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2880.543611][ C1] CPU: 1 PID: 22 Comm: ksoftirqd/1 Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0 [ 2880.547737][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 2880.551953][ C1] Call Trace: [ 2880.553480][ C1] [ 2880.554819][ C1] dump_stack_lvl+0xd9/0x150 [ 2880.556787][ C1] warn_alloc+0x213/0x360 [ 2880.558612][ C1] ? zone_watermark_ok_safe+0x2e0/0x2e0 [ 2880.560920][ C1] ? find_held_lock+0x2d/0x110 [ 2880.562951][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2880.565312][ C1] ? wake_all_kswapds+0x182/0x2d0 [ 2880.567611][ C1] __alloc_pages_slowpath.constprop.0+0x1bf6/0x2170 [ 2880.570610][ C1] ? get_page_from_freelist+0x3c9/0x2c00 [ 2880.573145][ C1] ? warn_alloc+0x360/0x360 [ 2880.575214][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2880.577636][ C1] ? prepare_alloc_pages+0x178/0x570 [ 2880.580042][ C1] ? prepare_alloc_pages+0x178/0x570 [ 2880.582194][ C1] __alloc_pages+0x408/0x4a0 [ 2880.584331][ C1] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 2880.587313][ C1] ? kmem_cache_alloc_node+0x114/0x510 [ 2880.589872][ C1] ? lock_downgrade+0x690/0x690 [ 2880.592181][ C1] ? lock_downgrade+0x690/0x690 [ 2880.594457][ C1] cache_grow_begin+0x9b/0x3b0 [ 2880.596670][ C1] fallback_alloc+0x1e2/0x2d0 [ 2880.598776][ C1] kmem_cache_alloc_node+0x114/0x510 [ 2880.601161][ C1] __alloc_skb+0x288/0x330 [ 2880.603253][ C1] ? __napi_build_skb+0x50/0x50 [ 2880.605470][ C1] bcm_can_tx+0x259/0x840 [ 2880.607485][ C1] ? bcm_release+0xa40/0xa40 [ 2880.609731][ C1] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2880.612491][ C1] bcm_tx_timeout_handler+0x230/0x5b0 [ 2880.614984][ C1] ? bcm_rx_handler+0x7a0/0x7a0 [ 2880.617226][ C1] ? lock_downgrade+0x690/0x690 [ 2880.619492][ C1] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 2880.622044][ C1] ? bcm_rx_handler+0x7a0/0x7a0 [ 2880.624272][ C1] __hrtimer_run_queues+0x5fa/0xbe0 [ 2880.626684][ C1] ? enqueue_hrtimer+0x320/0x320 [ 2880.628934][ C1] ? ktime_get_update_offsets_now+0x3ef/0x5c0 [ 2880.631594][ C1] hrtimer_run_softirq+0x17f/0x360 [ 2880.633579][ C1] __do_softirq+0x1d4/0x905 [ 2880.635503][ C1] ? __irq_exit_rcu+0x190/0x190 [ 2880.637623][ C1] run_ksoftirqd+0x31/0x60 [ 2880.639604][ C1] smpboot_thread_fn+0x659/0x9e0 [ 2880.641586][ C1] ? sort_range+0x30/0x30 [ 2880.643321][ C1] kthread+0x344/0x440 [ 2880.645163][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 2880.647710][ C1] ret_from_fork+0x1f/0x30 [ 2880.649767][ C1] [ 2880.651213][ C1] Mem-Info: [ 2880.652553][ C1] active_anon:126384 inactive_anon:25018 isolated_anon:0 [ 2880.652553][ C1] active_file:0 inactive_file:47 isolated_file:0 [ 2880.652553][ C1] unevictable:1536 dirty:11 writeback:0 [ 2880.652553][ C1] slab_reclaimable:17923 slab_unreclaimable:71418 [ 2880.652553][ C1] mapped:10952 shmem:7092 pagetables:964 [ 2880.652553][ C1] sec_pagetables:0 bounce:0 [ 2880.652553][ C1] kernel_misc_reclaimable:0 [ 2880.652553][ C1] free:6611 free_pcp:238 free_cma:0 [ 2880.671381][ C1] Node 0 active_anon:7048kB inactive_anon:38144kB active_file:0kB inactive_file:72kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:8kB writeback:0kB shmem:4968kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:8368kB pagetables:932kB sec_pagetables:0kB all_unreclaimable? no [ 2880.684908][ C1] Node 1 active_anon:470116kB inactive_anon:90300kB active_file:0kB inactive_file:116kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:43676kB dirty:36kB writeback:0kB shmem:23400kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:4056kB pagetables:2924kB sec_pagetables:0kB all_unreclaimable? no [ 2880.699343][ C1] Node 0 DMA free:1896kB boost:0kB min:736kB low:920kB high:1104kB reserved_highatomic:2048KB active_anon:220kB inactive_anon:6520kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:0kB free_cma:0kB [ 2880.711283][ C1] lowmem_reserve[]: 0 425 425 425 425 [ 2880.713670][ C1] Node 0 DMA32 free:7704kB boost:0kB min:20956kB low:26192kB high:31428kB reserved_highatomic:2048KB active_anon:31572kB inactive_anon:6880kB active_file:0kB inactive_file:132kB unevictable:3072kB writepending:8kB present:1032192kB managed:440768kB mlocked:0kB bounce:0kB free_pcp:388kB local_pcp:100kB free_cma:0kB [ 2880.726410][ C1] lowmem_reserve[]: 0 0 0 0 0 [ 2880.728654][ C1] Node 1 DMA32 free:16844kB boost:0kB min:45884kB low:57352kB high:68820kB reserved_highatomic:2048KB active_anon:88380kB inactive_anon:472036kB active_file:0kB inactive_file:316kB unevictable:3072kB writepending:36kB present:1048436kB managed:954724kB mlocked:0kB bounce:0kB free_pcp:524kB local_pcp:8kB free_cma:0kB [ 2880.741673][ C1] lowmem_reserve[]: 0 0 0 0 0 [ 2880.743827][ C1] Node 0 DMA: 56*4kB (M) 75*8kB (MH) 25*16kB (UMH) 7*32kB (MH) 5*64kB (U) 1*128kB (U) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 1896kB [ 2880.750130][ C1] Node 0 DMA32: 883*4kB (MEH) 414*8kB (UME) 46*16kB (UMH) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 7580kB [ 2880.756181][ C1] Node 1 DMA32: 419*4kB (ME) 201*8kB (ME) 94*16kB (UME) 33*32kB (ME) 10*64kB (UM) 5*128kB (UM) 24*256kB (UM) 2*512kB (UM) 0*1024kB 1*2048kB (H) 0*4096kB = 16340kB [ 2880.763382][ C1] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2880.767625][ C1] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2880.771717][ C1] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2880.775875][ C1] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2880.779989][ C1] 7120 total pagecache pages [ 2880.782048][ C1] 0 pages in swap cache [ 2880.783954][ C1] Free swap = 0kB [ 2880.785667][ C1] Total swap = 0kB [ 2880.787371][ C1] 524155 pages RAM [ 2880.789070][ C1] 0 pages HighMem/MovableOnly [ 2880.791189][ C1] 171442 pages reserved [ 2880.793105][ C1] 0 pages cma reserved [ 2883.015817][ T5715] kworker/dying (5715) used greatest stack depth: 18560 bytes left [ 2890.541983][ C1] warn_alloc: 409721 callbacks suppressed [ 2890.541997][ C1] ksoftirqd/1: page allocation failure: order:0, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2890.550505][ C1] CPU: 1 PID: 22 Comm: ksoftirqd/1 Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0 [ 2890.555062][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 2890.559046][ C1] Call Trace: [ 2890.560516][ C1] [ 2890.561831][ C1] dump_stack_lvl+0xd9/0x150 [ 2890.563991][ C1] warn_alloc+0x213/0x360 [ 2890.566012][ C1] ? zone_watermark_ok_safe+0x2e0/0x2e0 [ 2890.568547][ C1] ? find_held_lock+0x2d/0x110 [ 2890.570675][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2890.572905][ C1] ? wake_all_kswapds+0x182/0x2d0 [ 2890.575115][ C1] __alloc_pages_slowpath.constprop.0+0x1bf6/0x2170 [ 2890.577839][ C1] ? get_page_from_freelist+0x3c9/0x2c00 [ 2890.580261][ C1] ? warn_alloc+0x360/0x360 [ 2890.582280][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2890.584678][ C1] ? prepare_alloc_pages+0x178/0x570 [ 2890.586992][ C1] ? prepare_alloc_pages+0x178/0x570 [ 2890.589476][ C1] __alloc_pages+0x408/0x4a0 [ 2890.591486][ C1] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 2890.594396][ C1] ? kmem_cache_alloc_node+0x114/0x510 [ 2890.596546][ C1] ? lock_downgrade+0x690/0x690 [ 2890.598531][ C1] ? lock_downgrade+0x690/0x690 [ 2890.600715][ C1] cache_grow_begin+0x9b/0x3b0 [ 2890.602748][ C1] fallback_alloc+0x1e2/0x2d0 [ 2890.604894][ C1] kmem_cache_alloc_node+0x114/0x510 [ 2890.607405][ C1] __alloc_skb+0x288/0x330 [ 2890.609480][ C1] ? __napi_build_skb+0x50/0x50 [ 2890.611746][ C1] bcm_can_tx+0x259/0x840 [ 2890.613710][ C1] ? bcm_release+0xa40/0xa40 [ 2890.615864][ C1] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2890.618577][ C1] bcm_tx_timeout_handler+0x230/0x5b0 [ 2890.621097][ C1] ? bcm_rx_handler+0x7a0/0x7a0 [ 2890.623385][ C1] ? lock_downgrade+0x690/0x690 [ 2890.625595][ C1] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 2890.628265][ C1] ? bcm_rx_handler+0x7a0/0x7a0 [ 2890.630485][ C1] __hrtimer_run_queues+0x5fa/0xbe0 [ 2890.632848][ C1] ? enqueue_hrtimer+0x320/0x320 [ 2890.635142][ C1] ? ktime_get_update_offsets_now+0x3ef/0x5c0 [ 2890.637968][ C1] hrtimer_run_softirq+0x17f/0x360 [ 2890.640334][ C1] __do_softirq+0x1d4/0x905 [ 2890.642395][ C1] ? __irq_exit_rcu+0x190/0x190 [ 2890.644628][ C1] run_ksoftirqd+0x31/0x60 [ 2890.646557][ C1] smpboot_thread_fn+0x659/0x9e0 [ 2890.648778][ C1] ? sort_range+0x30/0x30 [ 2890.650762][ C1] kthread+0x344/0x440 [ 2890.652497][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 2890.654669][ C1] ret_from_fork+0x1f/0x30 [ 2890.656551][ C1] [ 2890.657803][ C1] Mem-Info: [ 2890.659249][ C1] active_anon:32692 inactive_anon:118710 isolated_anon:0 [ 2890.659249][ C1] active_file:14 inactive_file:2 isolated_file:0 [ 2890.659249][ C1] unevictable:1536 dirty:0 writeback:0 [ 2890.659249][ C1] slab_reclaimable:17834 slab_unreclaimable:72037 [ 2890.659249][ C1] mapped:10952 shmem:7092 pagetables:964 [ 2890.659249][ C1] sec_pagetables:0 bounce:0 [ 2890.659249][ C1] kernel_misc_reclaimable:0 [ 2890.659249][ C1] free:5761 free_pcp:623 free_cma:0 [ 2890.678162][ C1] Node 0 active_anon:7048kB inactive_anon:38144kB active_file:0kB inactive_file:8kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:0kB writeback:0kB shmem:4968kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:8336kB pagetables:932kB sec_pagetables:0kB all_unreclaimable? no [ 2890.690418][ C1] Node 1 active_anon:94476kB inactive_anon:465940kB active_file:56kB inactive_file:0kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:43676kB dirty:0kB writeback:0kB shmem:23400kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:3088kB pagetables:2924kB sec_pagetables:0kB all_unreclaimable? no [ 2890.704346][ C1] Node 0 DMA free:1844kB boost:0kB min:736kB low:920kB high:1104kB reserved_highatomic:2048KB active_anon:220kB inactive_anon:6520kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:188kB local_pcp:144kB free_cma:0kB [ 2890.715829][ C1] lowmem_reserve[]: 0 425 425 425 425 [ 2890.718341][ C1] Node 0 DMA32 free:4848kB boost:0kB min:20956kB low:26192kB high:31428kB reserved_highatomic:2048KB active_anon:6752kB inactive_anon:31700kB active_file:0kB inactive_file:8kB unevictable:3072kB writepending:0kB present:1032192kB managed:440768kB mlocked:0kB bounce:0kB free_pcp:916kB local_pcp:564kB free_cma:0kB [ 2890.731344][ C1] lowmem_reserve[]: 0 0 0 0 0 [ 2890.733283][ C1] Node 1 DMA32 free:16352kB boost:0kB min:45884kB low:57352kB high:68820kB reserved_highatomic:2048KB active_anon:97440kB inactive_anon:462976kB active_file:56kB inactive_file:0kB unevictable:3072kB writepending:0kB present:1048436kB managed:954724kB mlocked:0kB bounce:0kB free_pcp:1376kB local_pcp:200kB free_cma:0kB [ 2890.746455][ C1] lowmem_reserve[]: 0 0 0 0 0 [ 2890.748729][ C1] Node 0 DMA: 59*4kB (MH) 75*8kB (MH) 25*16kB (UMH) 7*32kB (MH) 4*64kB (U) 1*128kB (U) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 1844kB [ 2890.755243][ C1] Node 0 DMA32: 596*4kB (UMEH) 278*8kB (UME) 15*16kB (UMH) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4848kB [ 2890.761567][ C1] Node 1 DMA32: 420*4kB (UME) 202*8kB (UME) 94*16kB (UME) 33*32kB (ME) 10*64kB (UM) 5*128kB (UM) 24*256kB (UM) 2*512kB (UM) 0*1024kB 1*2048kB (H) 0*4096kB = 16352kB [ 2890.769067][ C1] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2890.772804][ C1] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2890.776925][ C1] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2890.781239][ C1] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2890.785439][ C1] 7108 total pagecache pages [ 2890.787594][ C1] 0 pages in swap cache [ 2890.789525][ C1] Free swap = 0kB [ 2890.791376][ C1] Total swap = 0kB [ 2890.793141][ C1] 524155 pages RAM [ 2890.794871][ C1] 0 pages HighMem/MovableOnly [ 2890.797029][ C1] 171442 pages reserved [ 2890.798963][ C1] 0 pages cma reserved [ 2897.332028][ C2] aoe: skb alloc failure [ 2897.335943][ C2] aoe: skb alloc failure [ 2897.338203][ C2] aoe: skb alloc failure [ 2897.340100][ C2] aoe: skb alloc failure [ 2897.342009][ C2] aoe: skb alloc failure [ 2897.343955][ C2] aoe: skb alloc failure [ 2897.345990][ C2] aoe: skb alloc failure [ 2897.347960][ C2] aoe: skb alloc failure [ 2897.349904][ C2] aoe: skb alloc failure [ 2897.351866][ C2] aoe: skb alloc failure [ 2897.353925][ C2] aoe: skb alloc failure [ 2897.355942][ C2] aoe: skb alloc failure [ 2897.357935][ C2] aoe: skb alloc failure [ 2897.359970][ C2] aoe: skb alloc failure [ 2897.362050][ C2] aoe: skb alloc failure [ 2897.364100][ C2] aoe: skb alloc failure [ 2897.366104][ C2] aoe: skb alloc failure [ 2897.368044][ C2] aoe: skb alloc failure [ 2897.369996][ C2] aoe: skb alloc failure [ 2897.372079][ C2] aoe: skb alloc failure [ 2897.374112][ C2] aoe: skb alloc failure [ 2897.376164][ C2] aoe: skb alloc failure [ 2897.378718][ C2] aoe: skb alloc failure [ 2897.380777][ C2] aoe: skb alloc failure [ 2897.382867][ C2] aoe: skb alloc failure [ 2897.384912][ C2] aoe: skb alloc failure [ 2897.386986][ C2] aoe: skb alloc failure [ 2897.388877][ C2] aoe: skb alloc failure [ 2897.390758][ C2] aoe: skb alloc failure [ 2897.392573][ C2] aoe: skb alloc failure [ 2897.394306][ C2] aoe: skb alloc failure [ 2897.396009][ C2] aoe: skb alloc failure [ 2897.397477][ C2] aoe: skb alloc failure [ 2897.399149][ C2] aoe: skb alloc failure [ 2897.400894][ C2] aoe: skb alloc failure [ 2897.402716][ C2] aoe: skb alloc failure [ 2897.404462][ C2] aoe: skb alloc failure [ 2897.406138][ C2] aoe: skb alloc failure [ 2897.407684][ C2] aoe: skb alloc failure [ 2897.409365][ C2] aoe: skb alloc failure [ 2897.411206][ C2] aoe: skb alloc failure [ 2897.413228][ C2] aoe: skb alloc failure [ 2897.415073][ C2] aoe: skb alloc failure [ 2897.417053][ C2] aoe: skb alloc failure [ 2897.418930][ C2] aoe: skb alloc failure [ 2897.420860][ C2] aoe: skb alloc failure [ 2897.422913][ C2] aoe: skb alloc failure [ 2897.424803][ C2] aoe: skb alloc failure [ 2897.426801][ C2] aoe: skb alloc failure [ 2897.428796][ C2] aoe: skb alloc failure [ 2897.430735][ C2] aoe: skb alloc failure [ 2897.432970][ C2] aoe: skb alloc failure [ 2897.434876][ C2] aoe: skb alloc failure [ 2897.436862][ C2] aoe: skb alloc failure [ 2897.438897][ C2] aoe: skb alloc failure [ 2897.441050][ C2] aoe: skb alloc failure [ 2897.443173][ C2] aoe: skb alloc failure [ 2897.445264][ C2] aoe: skb alloc failure [ 2897.447491][ C2] aoe: skb alloc failure [ 2897.449478][ C2] aoe: skb alloc failure [ 2897.451425][ C2] aoe: skb alloc failure [ 2897.453453][ C2] aoe: skb alloc failure [ 2897.455445][ C2] aoe: skb alloc failure [ 2897.457413][ C2] aoe: skb alloc failure [ 2897.459426][ C2] aoe: skb alloc failure [ 2897.461372][ C2] aoe: skb alloc failure [ 2897.463423][ C2] aoe: skb alloc failure [ 2897.465412][ C2] aoe: skb alloc failure [ 2897.467428][ C2] aoe: skb alloc failure [ 2897.469426][ C2] aoe: skb alloc failure [ 2897.471451][ C2] aoe: skb alloc failure [ 2900.551989][ C3] warn_alloc: 416353 callbacks suppressed [ 2900.552002][ C3] ksoftirqd/3: page allocation failure: order:0, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2900.559668][ C3] CPU: 3 PID: 32 Comm: ksoftirqd/3 Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0 [ 2900.563596][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 2900.566733][ C3] Call Trace: [ 2900.567981][ C3] [ 2900.569027][ C3] dump_stack_lvl+0xd9/0x150 [ 2900.570697][ C3] warn_alloc+0x213/0x360 [ 2900.572622][ C3] ? zone_watermark_ok_safe+0x2e0/0x2e0 [ 2900.575042][ C3] ? find_held_lock+0x2d/0x110 [ 2900.577035][ C3] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2900.579109][ C3] ? wake_all_kswapds+0x182/0x2d0 [ 2900.581320][ C3] __alloc_pages_slowpath.constprop.0+0x1bf6/0x2170 [ 2900.584234][ C3] ? get_page_from_freelist+0x3c9/0x2c00 [ 2900.586629][ C3] ? warn_alloc+0x360/0x360 [ 2900.588584][ C3] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2900.590668][ C3] ? prepare_alloc_pages+0x178/0x570 [ 2900.593195][ C3] ? prepare_alloc_pages+0x178/0x570 [ 2900.595596][ C3] __alloc_pages+0x408/0x4a0 [ 2900.597695][ C3] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 2900.600875][ C3] ? kmem_cache_alloc_node+0x114/0x510 [ 2900.603544][ C3] ? lock_downgrade+0x690/0x690 [ 2900.605868][ C3] ? lock_downgrade+0x690/0x690 [ 2900.608307][ C3] cache_grow_begin+0x9b/0x3b0 [ 2900.610610][ C3] fallback_alloc+0x1e2/0x2d0 [ 2900.612967][ C3] kmem_cache_alloc_node+0x114/0x510 [ 2900.615531][ C3] __alloc_skb+0x288/0x330 [ 2900.617564][ C3] ? __napi_build_skb+0x50/0x50 [ 2900.619806][ C3] bcm_can_tx+0x259/0x840 [ 2900.621873][ C3] ? bcm_release+0xa40/0xa40 [ 2900.624074][ C3] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2900.626950][ C3] bcm_tx_timeout_handler+0x230/0x5b0 [ 2900.629424][ C3] ? bcm_rx_handler+0x7a0/0x7a0 [ 2900.631641][ C3] ? lock_downgrade+0x690/0x690 [ 2900.633870][ C3] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 2900.636577][ C3] ? bcm_rx_handler+0x7a0/0x7a0 [ 2900.638841][ C3] __hrtimer_run_queues+0x5fa/0xbe0 [ 2900.641293][ C3] ? enqueue_hrtimer+0x320/0x320 [ 2900.643574][ C3] ? ktime_get_update_offsets_now+0x3ef/0x5c0 [ 2900.646313][ C3] hrtimer_run_softirq+0x17f/0x360 [ 2900.648773][ C3] __do_softirq+0x1d4/0x905 [ 2900.650994][ C3] ? __irq_exit_rcu+0x190/0x190 [ 2900.653320][ C3] run_ksoftirqd+0x31/0x60 [ 2900.655376][ C3] smpboot_thread_fn+0x659/0x9e0 [ 2900.657630][ C3] ? sort_range+0x30/0x30 [ 2900.659618][ C3] kthread+0x344/0x440 [ 2900.661583][ C3] ? kthread_complete_and_exit+0x40/0x40 [ 2900.664245][ C3] ret_from_fork+0x1f/0x30 [ 2900.666364][ C3] [ 2900.667955][ C3] Mem-Info: [ 2900.669660][ C3] active_anon:31615 inactive_anon:119787 isolated_anon:0 [ 2900.669660][ C3] active_file:9 inactive_file:2 isolated_file:0 [ 2900.669660][ C3] unevictable:1536 dirty:0 writeback:0 [ 2900.669660][ C3] slab_reclaimable:17767 slab_unreclaimable:72717 [ 2900.669660][ C3] mapped:10952 shmem:7092 pagetables:964 [ 2900.669660][ C3] sec_pagetables:0 bounce:0 [ 2900.669660][ C3] kernel_misc_reclaimable:0 [ 2900.669660][ C3] free:5211 free_pcp:571 free_cma:0 [ 2900.691728][ C3] Node 0 active_anon:37856kB inactive_anon:7336kB active_file:4kB inactive_file:4kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:0kB writeback:0kB shmem:4968kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:8336kB pagetables:932kB sec_pagetables:0kB all_unreclaimable? no [ 2900.706507][ C3] Node 1 active_anon:476068kB inactive_anon:84348kB active_file:32kB inactive_file:104kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:43676kB dirty:0kB writeback:0kB shmem:23400kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:2896kB pagetables:2924kB sec_pagetables:0kB all_unreclaimable? no [ 2900.721412][ C3] Node 0 DMA free:1852kB boost:0kB min:736kB low:920kB high:1104kB reserved_highatomic:2048KB active_anon:6520kB inactive_anon:220kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:132kB local_pcp:0kB free_cma:0kB [ 2900.733539][ C3] lowmem_reserve[]: 0 425 425 425 425 [ 2900.736268][ C3] Node 0 DMA32 free:2640kB boost:0kB min:20956kB low:26192kB high:31428kB reserved_highatomic:2048KB active_anon:6516kB inactive_anon:31936kB active_file:4kB inactive_file:4kB unevictable:3072kB writepending:0kB present:1032192kB managed:440768kB mlocked:0kB bounce:0kB free_pcp:836kB local_pcp:108kB free_cma:0kB [ 2900.749616][ C3] lowmem_reserve[]: 0 0 0 0 0 [ 2900.751857][ C3] Node 1 DMA32 free:16352kB boost:0kB min:45884kB low:57352kB high:68820kB reserved_highatomic:2048KB active_anon:475352kB inactive_anon:85064kB active_file:0kB inactive_file:104kB unevictable:3072kB writepending:0kB present:1048436kB managed:954724kB mlocked:0kB bounce:0kB free_pcp:1316kB local_pcp:160kB free_cma:0kB [ 2900.764311][ C3] lowmem_reserve[]: 0 0 0 0 0 [ 2900.766512][ C3] Node 0 DMA: 73*4kB (MH) 77*8kB (UMH) 25*16kB (MH) 7*32kB (MH) 3*64kB (U) 1*128kB (U) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 1852kB [ 2900.773301][ C3] Node 0 DMA32: 329*4kB (UMEH) 146*8kB (UM) 2*16kB (H) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2516kB [ 2900.779461][ C3] Node 1 DMA32: 469*4kB (UME) 207*8kB (UME) 95*16kB (UME) 33*32kB (ME) 10*64kB (UM) 5*128kB (UM) 24*256kB (UM) 2*512kB (UM) 0*1024kB 1*2048kB (H) 0*4096kB = 16604kB [ 2900.787511][ C3] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2900.792116][ C3] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2900.796352][ C3] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2900.800716][ C3] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2900.804953][ C3] 7108 total pagecache pages [ 2900.807167][ C3] 0 pages in swap cache [ 2900.809133][ C3] Free swap = 0kB [ 2900.810935][ C3] Total swap = 0kB [ 2900.812701][ C3] 524155 pages RAM [ 2900.814442][ C3] 0 pages HighMem/MovableOnly [ 2900.816653][ C3] 171442 pages reserved [ 2900.818584][ C3] 0 pages cma reserved [ 2910.561985][ C2] warn_alloc: 417914 callbacks suppressed [ 2910.562001][ C2] ksoftirqd/2: page allocation failure: order:0, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2910.572683][ C2] CPU: 2 PID: 27 Comm: ksoftirqd/2 Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0 [ 2910.577656][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 2910.581956][ C2] Call Trace: [ 2910.583636][ C2] [ 2910.585017][ C2] dump_stack_lvl+0xd9/0x150 [ 2910.587298][ C2] warn_alloc+0x213/0x360 [ 2910.589500][ C2] ? zone_watermark_ok_safe+0x2e0/0x2e0 [ 2910.592087][ C2] ? find_held_lock+0x2d/0x110 [ 2910.594285][ C2] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2910.596624][ C2] ? wake_all_kswapds+0x182/0x2d0 [ 2910.598932][ C2] __alloc_pages_slowpath.constprop.0+0x1bf6/0x2170 [ 2910.601924][ C2] ? get_page_from_freelist+0x3c9/0x2c00 [ 2910.604791][ C2] ? warn_alloc+0x360/0x360 [ 2910.607162][ C2] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2910.610546][ C2] ? prepare_alloc_pages+0x178/0x570 [ 2910.614015][ C2] ? prepare_alloc_pages+0x178/0x570 [ 2910.617188][ C2] __alloc_pages+0x408/0x4a0 [ 2910.619676][ C2] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 2910.623541][ C2] ? kmem_cache_alloc_node+0x114/0x510 [ 2910.626640][ C2] ? lock_downgrade+0x690/0x690 [ 2910.629041][ C2] ? lock_downgrade+0x690/0x690 [ 2910.631597][ C2] cache_grow_begin+0x9b/0x3b0 [ 2910.633893][ C2] fallback_alloc+0x1e2/0x2d0 [ 2910.636340][ C2] kmem_cache_alloc_node+0x114/0x510 [ 2910.639125][ C2] __alloc_skb+0x288/0x330 [ 2910.641407][ C2] ? __napi_build_skb+0x50/0x50 [ 2910.643647][ C2] bcm_can_tx+0x259/0x840 [ 2910.645686][ C2] ? bcm_release+0xa40/0xa40 [ 2910.647787][ C2] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2910.650491][ C2] bcm_tx_timeout_handler+0x230/0x5b0 [ 2910.653162][ C2] ? bcm_rx_handler+0x7a0/0x7a0 [ 2910.655612][ C2] ? lock_downgrade+0x690/0x690 [ 2910.658439][ C2] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 2910.662718][ C2] ? bcm_rx_handler+0x7a0/0x7a0 [ 2910.665324][ C2] __hrtimer_run_queues+0x5fa/0xbe0 [ 2910.668340][ C2] ? enqueue_hrtimer+0x320/0x320 [ 2910.671215][ C2] ? ktime_get_update_offsets_now+0x3ef/0x5c0 [ 2910.674000][ C2] hrtimer_run_softirq+0x17f/0x360 [ 2910.676398][ C2] __do_softirq+0x1d4/0x905 [ 2910.678510][ C2] ? __irq_exit_rcu+0x190/0x190 [ 2910.680903][ C2] run_ksoftirqd+0x31/0x60 [ 2910.682960][ C2] smpboot_thread_fn+0x659/0x9e0 [ 2910.685309][ C2] ? sort_range+0x30/0x30 [ 2910.687331][ C2] kthread+0x344/0x440 [ 2910.689270][ C2] ? kthread_complete_and_exit+0x40/0x40 [ 2910.691840][ C2] ret_from_fork+0x1f/0x30 [ 2910.693951][ C2] [ 2910.695420][ C2] Mem-Info: [ 2910.696927][ C2] active_anon:33126 inactive_anon:118276 isolated_anon:0 [ 2910.696927][ C2] active_file:1 inactive_file:15 isolated_file:0 [ 2910.696927][ C2] unevictable:1536 dirty:0 writeback:0 [ 2910.696927][ C2] slab_reclaimable:17757 slab_unreclaimable:73538 [ 2910.696927][ C2] mapped:10952 shmem:7092 pagetables:964 [ 2910.696927][ C2] sec_pagetables:0 bounce:0 [ 2910.696927][ C2] kernel_misc_reclaimable:0 [ 2910.696927][ C2] free:4485 free_pcp:527 free_cma:0 [ 2910.718258][ C2] Node 0 active_anon:7208kB inactive_anon:37984kB active_file:8kB inactive_file:0kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:0kB writeback:0kB shmem:4968kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:8336kB pagetables:932kB sec_pagetables:0kB all_unreclaimable? no [ 2910.736209][ C2] Node 1 active_anon:467440kB inactive_anon:92976kB active_file:0kB inactive_file:60kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:43676kB dirty:0kB writeback:0kB shmem:23400kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:2896kB pagetables:2924kB sec_pagetables:0kB all_unreclaimable? no [ 2910.753439][ C2] Node 0 DMA free:1280kB boost:0kB min:736kB low:920kB high:1104kB reserved_highatomic:2048KB active_anon:6520kB inactive_anon:220kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:152kB local_pcp:44kB free_cma:0kB [ 2910.765426][ C2] lowmem_reserve[]: 0 425 425 425 425 [ 2910.767950][ C2] Node 0 DMA32 free:56kB boost:0kB min:20956kB low:26192kB high:31428kB reserved_highatomic:2048KB active_anon:6988kB inactive_anon:31464kB active_file:8kB inactive_file:0kB unevictable:3072kB writepending:0kB present:1032192kB managed:440768kB mlocked:0kB bounce:0kB free_pcp:640kB local_pcp:108kB free_cma:0kB [ 2910.780767][ C2] lowmem_reserve[]: 0 0 0 0 0 [ 2910.783048][ C2] Node 1 DMA32 free:16604kB boost:0kB min:45884kB low:57352kB high:68820kB reserved_highatomic:2048KB active_anon:93124kB inactive_anon:467292kB active_file:0kB inactive_file:60kB unevictable:3072kB writepending:0kB present:1048436kB managed:954724kB mlocked:0kB bounce:0kB free_pcp:1316kB local_pcp:576kB free_cma:0kB [ 2910.796805][ C2] lowmem_reserve[]: 0 0 0 0 0 [ 2910.798960][ C2] Node 0 DMA: 43*4kB (UMH) 65*8kB (UMH) 22*16kB (UMH) 6*32kB (UH) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 1236kB [ 2910.805704][ C2] Node 0 DMA32: 6*4kB (H) 0*8kB 2*16kB (H) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 56kB [ 2910.811197][ C2] Node 1 DMA32: 469*4kB (UME) 207*8kB (UME) 95*16kB (UME) 33*32kB (ME) 10*64kB (UM) 5*128kB (UM) 24*256kB (UM) 2*512kB (UM) 0*1024kB 1*2048kB (H) 0*4096kB = 16604kB [ 2910.819103][ C2] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2910.823378][ C2] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2910.827552][ C2] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2910.831895][ C2] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2910.836129][ C2] 7108 total pagecache pages [ 2910.838342][ C2] 0 pages in swap cache [ 2910.840399][ C2] Free swap = 0kB [ 2910.842163][ C2] Total swap = 0kB [ 2910.843934][ C2] 524155 pages RAM [ 2910.845641][ C2] 0 pages HighMem/MovableOnly [ 2910.848248][ C2] 171442 pages reserved [ 2910.850327][ C2] 0 pages cma reserved [ 2920.572034][ C3] warn_alloc: 408669 callbacks suppressed [ 2920.572051][ C3] ksoftirqd/3: page allocation failure: order:0, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2920.581000][ C3] CPU: 3 PID: 32 Comm: ksoftirqd/3 Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0 [ 2920.585550][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 2920.589694][ C3] Call Trace: [ 2920.591246][ C3] [ 2920.592625][ C3] dump_stack_lvl+0xd9/0x150 [ 2920.594772][ C3] warn_alloc+0x213/0x360 [ 2920.596827][ C3] ? zone_watermark_ok_safe+0x2e0/0x2e0 [ 2920.599392][ C3] ? find_held_lock+0x2d/0x110 [ 2920.601577][ C3] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2920.604002][ C3] ? wake_all_kswapds+0x182/0x2d0 [ 2920.606336][ C3] __alloc_pages_slowpath.constprop.0+0x1bf6/0x2170 [ 2920.609460][ C3] ? get_page_from_freelist+0x3c9/0x2c00 [ 2920.612061][ C3] ? warn_alloc+0x360/0x360 [ 2920.614199][ C3] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2920.616415][ C3] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2920.618604][ C3] ? prepare_alloc_pages+0x178/0x570 [ 2920.620766][ C3] ? __alloc_pages+0x3b1/0x4a0 [ 2920.622730][ C3] __alloc_pages+0x408/0x4a0 [ 2920.624866][ C3] ? find_held_lock+0x2d/0x110 [ 2920.627049][ C3] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 2920.630446][ C3] ? cache_grow_begin+0x9b/0x3b0 [ 2920.632570][ C3] cache_grow_begin+0x9b/0x3b0 [ 2920.634721][ C3] fallback_alloc+0x1e2/0x2d0 [ 2920.637005][ C3] kmem_cache_alloc_node+0x114/0x510 [ 2920.639625][ C3] __alloc_skb+0x288/0x330 [ 2920.641703][ C3] ? __napi_build_skb+0x50/0x50 [ 2920.644104][ C3] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2920.647985][ C3] bcm_can_tx+0x259/0x840 [ 2920.649977][ C3] ? bcm_release+0xa40/0xa40 [ 2920.652208][ C3] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2920.654961][ C3] bcm_tx_timeout_handler+0x230/0x5b0 [ 2920.657676][ C3] ? bcm_rx_handler+0x7a0/0x7a0 [ 2920.659931][ C3] ? lock_downgrade+0x690/0x690 [ 2920.662278][ C3] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 2920.665449][ C3] ? bcm_rx_handler+0x7a0/0x7a0 [ 2920.667848][ C3] __hrtimer_run_queues+0x5fa/0xbe0 [ 2920.670348][ C3] ? enqueue_hrtimer+0x320/0x320 [ 2920.673021][ C3] ? ktime_get_update_offsets_now+0x3ef/0x5c0 [ 2920.676371][ C3] hrtimer_run_softirq+0x17f/0x360 [ 2920.679039][ C3] __do_softirq+0x1d4/0x905 [ 2920.681612][ C3] ? __irq_exit_rcu+0x190/0x190 [ 2920.684309][ C3] run_ksoftirqd+0x31/0x60 [ 2920.686671][ C3] smpboot_thread_fn+0x659/0x9e0 [ 2920.689270][ C3] ? sort_range+0x30/0x30 [ 2920.691279][ C3] kthread+0x344/0x440 [ 2920.693260][ C3] ? kthread_complete_and_exit+0x40/0x40 [ 2920.695883][ C3] ret_from_fork+0x1f/0x30 [ 2920.698115][ C3] [ 2920.699687][ C3] Mem-Info: [ 2920.701513][ C3] active_anon:124810 inactive_anon:26592 isolated_anon:0 [ 2920.701513][ C3] active_file:15 inactive_file:1 isolated_file:0 [ 2920.701513][ C3] unevictable:1536 dirty:0 writeback:0 [ 2920.701513][ C3] slab_reclaimable:17757 slab_unreclaimable:74529 [ 2920.701513][ C3] mapped:10952 shmem:7092 pagetables:964 [ 2920.701513][ C3] sec_pagetables:0 bounce:0 [ 2920.701513][ C3] kernel_misc_reclaimable:0 [ 2920.701513][ C3] free:3636 free_pcp:378 free_cma:0 [ 2920.723560][ C3] Node 0 active_anon:37856kB inactive_anon:7336kB active_file:12kB inactive_file:0kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:0kB writeback:0kB shmem:4968kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:8336kB pagetables:932kB sec_pagetables:0kB all_unreclaimable? no [ 2920.740693][ C3] Node 1 active_anon:394396kB inactive_anon:166020kB active_file:48kB inactive_file:8kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:43676kB dirty:0kB writeback:0kB shmem:23400kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:2864kB pagetables:2924kB sec_pagetables:0kB all_unreclaimable? no [ 2920.756386][ C3] Node 0 DMA free:516kB boost:0kB min:736kB low:920kB high:1104kB reserved_highatomic:2048KB active_anon:220kB inactive_anon:6520kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:156kB local_pcp:0kB free_cma:0kB [ 2920.769079][ C3] lowmem_reserve[]: 0 425 425 425 425 [ 2920.771779][ C3] Node 0 DMA32 free:56kB boost:0kB min:20956kB low:26192kB high:31428kB reserved_highatomic:2048KB active_anon:31572kB inactive_anon:6880kB active_file:12kB inactive_file:0kB unevictable:3072kB writepending:0kB present:1032192kB managed:440768kB mlocked:0kB bounce:0kB free_pcp:616kB local_pcp:104kB free_cma:0kB [ 2920.786378][ C3] lowmem_reserve[]: 0 0 0 0 0 [ 2920.789092][ C3] Node 1 DMA32 free:13972kB boost:0kB min:45884kB low:57352kB high:68820kB reserved_highatomic:2048KB active_anon:462504kB inactive_anon:97912kB active_file:48kB inactive_file:8kB unevictable:3072kB writepending:0kB present:1048436kB managed:954724kB mlocked:0kB bounce:0kB free_pcp:956kB local_pcp:192kB free_cma:0kB [ 2920.803278][ C3] lowmem_reserve[]: 0 0 0 0 0 [ 2920.806006][ C3] Node 0 DMA: 5*4kB (H) 30*8kB (H) 10*16kB (H) 3*32kB (H) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 516kB [ 2920.813591][ C3] Node 0 DMA32: 6*4kB (H) 0*8kB 2*16kB (H) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 56kB [ 2920.819367][ C3] Node 1 DMA32: 426*4kB (UME) 202*8kB (UME) 94*16kB (ME) 34*32kB (UME) 10*64kB (UM) 4*128kB (UM) 14*256kB (UM) 2*512kB (UM) 0*1024kB 1*2048kB (H) 0*4096kB = 13720kB [ 2920.827593][ C3] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2920.831953][ C3] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2920.836570][ C3] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2920.840937][ C3] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2920.844516][ C3] 7108 total pagecache pages [ 2920.846653][ C3] 0 pages in swap cache [ 2920.848551][ C3] Free swap = 0kB [ 2920.850219][ C3] Total swap = 0kB [ 2920.851738][ C3] 524155 pages RAM [ 2920.853193][ C3] 0 pages HighMem/MovableOnly [ 2920.855222][ C3] 171442 pages reserved [ 2920.857170][ C3] 0 pages cma reserved [ 2930.582004][ C1] warn_alloc: 391224 callbacks suppressed [ 2930.582018][ C1] ksoftirqd/1: page allocation failure: order:0, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2930.590344][ C1] CPU: 1 PID: 22 Comm: ksoftirqd/1 Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0 [ 2930.596174][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 2930.600296][ C1] Call Trace: [ 2930.601809][ C1] [ 2930.603166][ C1] dump_stack_lvl+0xd9/0x150 [ 2930.605326][ C1] warn_alloc+0x213/0x360 [ 2930.607430][ C1] ? zone_watermark_ok_safe+0x2e0/0x2e0 [ 2930.609957][ C1] ? find_held_lock+0x2d/0x110 [ 2930.612134][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2930.614470][ C1] ? wake_all_kswapds+0x182/0x2d0 [ 2930.617158][ C1] __alloc_pages_slowpath.constprop.0+0x1bf6/0x2170 [ 2930.620482][ C1] ? get_page_from_freelist+0x3c9/0x2c00 [ 2930.623033][ C1] ? warn_alloc+0x360/0x360 [ 2930.625151][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2930.628230][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2930.630644][ C1] ? prepare_alloc_pages+0x178/0x570 [ 2930.633107][ C1] ? __alloc_pages+0x3b1/0x4a0 [ 2930.635346][ C1] __alloc_pages+0x408/0x4a0 [ 2930.637495][ C1] ? find_held_lock+0x2d/0x110 [ 2930.639660][ C1] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 2930.642695][ C1] ? cache_grow_begin+0x9b/0x3b0 [ 2930.644698][ C1] cache_grow_begin+0x9b/0x3b0 [ 2930.646655][ C1] fallback_alloc+0x1e2/0x2d0 [ 2930.648594][ C1] kmem_cache_alloc_node+0x114/0x510 [ 2930.650572][ C1] __alloc_skb+0x288/0x330 [ 2930.652418][ C1] ? __napi_build_skb+0x50/0x50 [ 2930.654657][ C1] bcm_can_tx+0x259/0x840 [ 2930.656658][ C1] ? bcm_release+0xa40/0xa40 [ 2930.658806][ C1] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2930.661521][ C1] bcm_tx_timeout_handler+0x230/0x5b0 [ 2930.663975][ C1] ? bcm_rx_handler+0x7a0/0x7a0 [ 2930.666224][ C1] ? lock_downgrade+0x690/0x690 [ 2930.668473][ C1] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 2930.671289][ C1] ? bcm_rx_handler+0x7a0/0x7a0 [ 2930.673261][ C1] __hrtimer_run_queues+0x5fa/0xbe0 [ 2930.675364][ C1] ? enqueue_hrtimer+0x320/0x320 [ 2930.677349][ C1] ? ktime_get_update_offsets_now+0x3ef/0x5c0 [ 2930.684603][ C1] hrtimer_run_softirq+0x17f/0x360 [ 2930.687041][ C1] __do_softirq+0x1d4/0x905 [ 2930.689267][ C1] ? __irq_exit_rcu+0x190/0x190 [ 2930.691593][ C1] run_ksoftirqd+0x31/0x60 [ 2930.693714][ C1] smpboot_thread_fn+0x659/0x9e0 [ 2930.696109][ C1] ? sort_range+0x30/0x30 [ 2930.698138][ C1] kthread+0x344/0x440 [ 2930.700166][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 2930.703143][ C1] ret_from_fork+0x1f/0x30 [ 2930.705833][ C1] [ 2930.707404][ C1] Mem-Info: [ 2930.709013][ C1] active_anon:125101 inactive_anon:26301 isolated_anon:0 [ 2930.709013][ C1] active_file:0 inactive_file:22 isolated_file:0 [ 2930.709013][ C1] unevictable:1536 dirty:0 writeback:0 [ 2930.709013][ C1] slab_reclaimable:17757 slab_unreclaimable:75581 [ 2930.709013][ C1] mapped:10952 shmem:7092 pagetables:964 [ 2930.709013][ C1] sec_pagetables:0 bounce:0 [ 2930.709013][ C1] kernel_misc_reclaimable:0 [ 2930.709013][ C1] free:2566 free_pcp:402 free_cma:0 [ 2930.731075][ C1] Node 0 active_anon:38016kB inactive_anon:7176kB active_file:0kB inactive_file:12kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:0kB writeback:0kB shmem:4968kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:8336kB pagetables:932kB sec_pagetables:0kB all_unreclaimable? no [ 2930.744851][ C1] Node 1 active_anon:83636kB inactive_anon:476780kB active_file:0kB inactive_file:76kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:43676kB dirty:0kB writeback:0kB shmem:23400kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:2864kB pagetables:2924kB sec_pagetables:0kB all_unreclaimable? no [ 2930.758781][ C1] Node 0 DMA free:516kB boost:0kB min:736kB low:920kB high:1104kB reserved_highatomic:2048KB active_anon:220kB inactive_anon:6520kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:156kB local_pcp:28kB free_cma:0kB [ 2930.771074][ C1] lowmem_reserve[]: 0 425 425 425 425 [ 2930.773546][ C1] Node 0 DMA32 free:56kB boost:0kB min:20956kB low:26192kB high:31428kB reserved_highatomic:2048KB active_anon:6516kB inactive_anon:31936kB active_file:0kB inactive_file:12kB unevictable:3072kB writepending:0kB present:1032192kB managed:440768kB mlocked:0kB bounce:0kB free_pcp:612kB local_pcp:36kB free_cma:0kB [ 2930.786533][ C1] lowmem_reserve[]: 0 0 0 0 0 [ 2930.788406][ C1] Node 1 DMA32 free:9692kB boost:0kB min:45884kB low:57352kB high:68820kB reserved_highatomic:2048KB active_anon:476836kB inactive_anon:83580kB active_file:0kB inactive_file:76kB unevictable:3072kB writepending:0kB present:1048436kB managed:954724kB mlocked:0kB bounce:0kB free_pcp:820kB local_pcp:204kB free_cma:0kB [ 2930.801012][ C1] lowmem_reserve[]: 0 0 0 0 0 [ 2930.803718][ C1] Node 0 DMA: 5*4kB (H) 30*8kB (H) 10*16kB (H) 3*32kB (H) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 516kB [ 2930.811511][ C1] Node 0 DMA32: 6*4kB (H) 0*8kB 2*16kB (H) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 56kB [ 2930.818371][ C1] Node 1 DMA32: 421*4kB (UME) 195*8kB (UME) 91*16kB (UME) 30*32kB (UME) 9*64kB (UM) 3*128kB (UM) 2*256kB (UM) 1*512kB (U) 0*1024kB 1*2048kB (H) 0*4096kB = 9692kB [ 2930.825849][ C1] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2930.830226][ C1] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2930.834432][ C1] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2930.838995][ C1] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2930.843030][ C1] 7108 total pagecache pages [ 2930.845214][ C1] 0 pages in swap cache [ 2930.847132][ C1] Free swap = 0kB [ 2930.849078][ C1] Total swap = 0kB [ 2930.850810][ C1] 524155 pages RAM [ 2930.852549][ C1] 0 pages HighMem/MovableOnly [ 2930.854650][ C1] 171442 pages reserved [ 2930.856459][ C1] 0 pages cma reserved [ 2940.591987][ C2] warn_alloc: 384176 callbacks suppressed [ 2940.591998][ C2] ksoftirqd/2: page allocation failure: order:0, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2940.600241][ C2] CPU: 2 PID: 27 Comm: ksoftirqd/2 Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0 [ 2940.604472][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 2940.608302][ C2] Call Trace: [ 2940.609798][ C2] [ 2940.611062][ C2] dump_stack_lvl+0xd9/0x150 [ 2940.613061][ C2] warn_alloc+0x213/0x360 [ 2940.614887][ C2] ? zone_watermark_ok_safe+0x2e0/0x2e0 [ 2940.617170][ C2] ? find_held_lock+0x2d/0x110 [ 2940.619186][ C2] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2940.621598][ C2] ? wake_all_kswapds+0x182/0x2d0 [ 2940.623853][ C2] __alloc_pages_slowpath.constprop.0+0x1bf6/0x2170 [ 2940.626812][ C2] ? get_page_from_freelist+0x3c9/0x2c00 [ 2940.629212][ C2] ? warn_alloc+0x360/0x360 [ 2940.631312][ C2] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2940.633833][ C2] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2940.636245][ C2] ? prepare_alloc_pages+0x178/0x570 [ 2940.638859][ C2] ? __alloc_pages+0x3b1/0x4a0 [ 2940.641071][ C2] __alloc_pages+0x408/0x4a0 [ 2940.643200][ C2] ? find_held_lock+0x2d/0x110 [ 2940.645403][ C2] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 2940.648341][ C2] ? cache_grow_begin+0x9b/0x3b0 [ 2940.650570][ C2] cache_grow_begin+0x9b/0x3b0 [ 2940.652500][ C2] fallback_alloc+0x1e2/0x2d0 [ 2940.654327][ C2] kmem_cache_alloc_node+0x114/0x510 [ 2940.656555][ C2] __alloc_skb+0x288/0x330 [ 2940.658418][ C2] ? __napi_build_skb+0x50/0x50 [ 2940.660445][ C2] bcm_can_tx+0x259/0x840 [ 2940.662305][ C2] ? bcm_release+0xa40/0xa40 [ 2940.663943][ C2] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2940.666028][ C2] bcm_tx_timeout_handler+0x230/0x5b0 [ 2940.668240][ C2] ? bcm_rx_handler+0x7a0/0x7a0 [ 2940.670144][ C2] ? lock_downgrade+0x690/0x690 [ 2940.672230][ C2] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 2940.674691][ C2] ? bcm_rx_handler+0x7a0/0x7a0 [ 2940.676938][ C2] __hrtimer_run_queues+0x5fa/0xbe0 [ 2940.679196][ C2] ? enqueue_hrtimer+0x320/0x320 [ 2940.681373][ C2] ? ktime_get_update_offsets_now+0x3ef/0x5c0 [ 2940.683936][ C2] hrtimer_run_softirq+0x17f/0x360 [ 2940.685941][ C2] __do_softirq+0x1d4/0x905 [ 2940.687862][ C2] ? __irq_exit_rcu+0x190/0x190 [ 2940.689853][ C2] run_ksoftirqd+0x31/0x60 [ 2940.691849][ C2] smpboot_thread_fn+0x659/0x9e0 [ 2940.694060][ C2] ? sort_range+0x30/0x30 [ 2940.696146][ C2] kthread+0x344/0x440 [ 2940.697999][ C2] ? kthread_complete_and_exit+0x40/0x40 [ 2940.700432][ C2] ret_from_fork+0x1f/0x30 [ 2940.702452][ C2] [ 2940.703851][ C2] Mem-Info: [ 2940.705394][ C2] active_anon:50955 inactive_anon:100447 isolated_anon:0 [ 2940.705394][ C2] active_file:10 inactive_file:6 isolated_file:0 [ 2940.705394][ C2] unevictable:1536 dirty:0 writeback:0 [ 2940.705394][ C2] slab_reclaimable:17757 slab_unreclaimable:76620 [ 2940.705394][ C2] mapped:10952 shmem:7092 pagetables:964 [ 2940.705394][ C2] sec_pagetables:0 bounce:0 [ 2940.705394][ C2] kernel_misc_reclaimable:0 [ 2940.705394][ C2] free:1558 free_pcp:431 free_cma:0 [ 2940.723376][ C2] Node 0 active_anon:7208kB inactive_anon:37984kB active_file:8kB inactive_file:0kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:0kB writeback:0kB shmem:4968kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:8336kB pagetables:932kB sec_pagetables:0kB all_unreclaimable? no [ 2940.736608][ C2] Node 1 active_anon:165920kB inactive_anon:394496kB active_file:32kB inactive_file:24kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:43676kB dirty:0kB writeback:0kB shmem:23400kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:2864kB pagetables:2924kB sec_pagetables:0kB all_unreclaimable? no [ 2940.750913][ C2] Node 0 DMA free:516kB boost:0kB min:736kB low:920kB high:1104kB reserved_highatomic:2048KB active_anon:6520kB inactive_anon:220kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:156kB local_pcp:44kB free_cma:0kB [ 2940.762899][ C2] lowmem_reserve[]: 0 425 425 425 425 [ 2940.765538][ C2] Node 0 DMA32 free:56kB boost:0kB min:20956kB low:26192kB high:31428kB reserved_highatomic:2048KB active_anon:6988kB inactive_anon:31464kB active_file:8kB inactive_file:0kB unevictable:3072kB writepending:0kB present:1032192kB managed:440768kB mlocked:0kB bounce:0kB free_pcp:612kB local_pcp:108kB free_cma:0kB [ 2940.780141][ C2] lowmem_reserve[]: 0 0 0 0 0 [ 2940.782721][ C2] Node 1 DMA32 free:5660kB boost:0kB min:45884kB low:57352kB high:68820kB reserved_highatomic:2048KB active_anon:167104kB inactive_anon:393312kB active_file:32kB inactive_file:24kB unevictable:3072kB writepending:0kB present:1048436kB managed:954724kB mlocked:0kB bounce:0kB free_pcp:956kB local_pcp:432kB free_cma:0kB [ 2940.796926][ C2] lowmem_reserve[]: 0 0 0 0 0 [ 2940.799236][ C2] Node 0 DMA: 5*4kB (H) 30*8kB (H) 10*16kB (H) 3*32kB (H) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 516kB [ 2940.806502][ C2] Node 0 DMA32: 6*4kB (H) 0*8kB 2*16kB (H) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 56kB [ 2940.812465][ C2] Node 1 DMA32: 350*4kB (UME) 131*8kB (UME) 35*16kB (UME) 9*32kB (UME) 1*64kB (U) 0*128kB 0*256kB 0*512kB 0*1024kB 1*2048kB (H) 0*4096kB = 5408kB [ 2940.819399][ C2] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2940.824276][ C2] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2940.828770][ C2] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2940.832839][ C2] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2940.836948][ C2] 7108 total pagecache pages [ 2940.839071][ C2] 0 pages in swap cache [ 2940.840957][ C2] Free swap = 0kB [ 2940.842722][ C2] Total swap = 0kB [ 2940.844418][ C2] 524155 pages RAM [ 2940.846154][ C2] 0 pages HighMem/MovableOnly [ 2940.848503][ C2] 171442 pages reserved [ 2940.850426][ C2] 0 pages cma reserved [ 2950.602016][ C1] warn_alloc: 399514 callbacks suppressed [ 2950.602032][ C1] ksoftirqd/1: page allocation failure: order:0, mode:0x40820(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2950.610782][ C1] CPU: 1 PID: 22 Comm: ksoftirqd/1 Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0 [ 2950.614756][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 [ 2950.618553][ C1] Call Trace: [ 2950.620060][ C1] [ 2950.621322][ C1] dump_stack_lvl+0xd9/0x150 [ 2950.623413][ C1] warn_alloc+0x213/0x360 [ 2950.625551][ C1] ? zone_watermark_ok_safe+0x2e0/0x2e0 [ 2950.628005][ C1] ? find_held_lock+0x2d/0x110 [ 2950.629965][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2950.632384][ C1] ? wake_all_kswapds+0x182/0x2d0 [ 2950.634976][ C1] __alloc_pages_slowpath.constprop.0+0x1bf6/0x2170 [ 2950.637616][ C1] ? get_page_from_freelist+0x3c9/0x2c00 [ 2950.639650][ C1] ? warn_alloc+0x360/0x360 [ 2950.641300][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2950.643255][ C1] ? __zone_watermark_ok+0x4d0/0x4d0 [ 2950.645610][ C1] ? prepare_alloc_pages+0x178/0x570 [ 2950.648321][ C1] ? __alloc_pages+0x3b1/0x4a0 [ 2950.650437][ C1] __alloc_pages+0x408/0x4a0 [ 2950.652444][ C1] ? find_held_lock+0x2d/0x110 [ 2950.654277][ C1] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 2950.656814][ C1] ? cache_grow_begin+0x9b/0x3b0 [ 2950.658759][ C1] cache_grow_begin+0x9b/0x3b0 [ 2950.660580][ C1] fallback_alloc+0x1e2/0x2d0 [ 2950.662743][ C1] kmem_cache_alloc_node+0x114/0x510 [ 2950.664741][ C1] __alloc_skb+0x288/0x330 [ 2950.666472][ C1] ? __napi_build_skb+0x50/0x50 [ 2950.668677][ C1] bcm_can_tx+0x259/0x840 [ 2950.670591][ C1] ? bcm_release+0xa40/0xa40 [ 2950.672534][ C1] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 2950.675146][ C1] bcm_tx_timeout_handler+0x230/0x5b0 [ 2950.677389][ C1] ? bcm_rx_handler+0x7a0/0x7a0 [ 2950.679411][ C1] ? lock_downgrade+0x690/0x690 [ 2950.681914][ C1] ? _raw_spin_unlock_irqrestore+0x54/0x70 [ 2950.684518][ C1] ? bcm_rx_handler+0x7a0/0x7a0 [ 2950.686785][ C1] __hrtimer_run_queues+0x5fa/0xbe0 [ 2950.689015][ C1] ? enqueue_hrtimer+0x320/0x320 [ 2950.691153][ C1] ? ktime_get_update_offsets_now+0x3ef/0x5c0 [ 2950.693765][ C1] hrtimer_run_softirq+0x17f/0x360 [ 2950.696064][ C1] __do_softirq+0x1d4/0x905 [ 2950.698154][ C1] ? __irq_exit_rcu+0x190/0x190 [ 2950.700382][ C1] run_ksoftirqd+0x31/0x60 [ 2950.702530][ C1] smpboot_thread_fn+0x659/0x9e0 [ 2950.704912][ C1] ? sort_range+0x30/0x30 [ 2950.706978][ C1] kthread+0x344/0x440 [ 2950.708930][ C1] ? kthread_complete_and_exit+0x40/0x40 [ 2950.711471][ C1] ret_from_fork+0x1f/0x30 [ 2950.713708][ C1] [ 2950.715454][ C1] Mem-Info: [ 2950.716838][ C1] active_anon:126993 inactive_anon:24409 isolated_anon:0 [ 2950.716838][ C1] active_file:0 inactive_file:24 isolated_file:0 [ 2950.716838][ C1] unevictable:1536 dirty:0 writeback:0 [ 2950.716838][ C1] slab_reclaimable:17757 slab_unreclaimable:77620 [ 2950.716838][ C1] mapped:10952 shmem:7092 pagetables:964 [ 2950.716838][ C1] sec_pagetables:0 bounce:0 [ 2950.716838][ C1] kernel_misc_reclaimable:0 [ 2950.716838][ C1] free:655 free_pcp:283 free_cma:0 [ 2950.734929][ C1] Node 0 active_anon:37856kB inactive_anon:7336kB active_file:0kB inactive_file:8kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:132kB dirty:0kB writeback:0kB shmem:4968kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:8336kB pagetables:932kB sec_pagetables:0kB all_unreclaimable? no [ 2950.747974][ C1] Node 1 active_anon:90056kB inactive_anon:470360kB active_file:0kB inactive_file:88kB unevictable:3072kB isolated(anon):0kB isolated(file):0kB mapped:43676kB dirty:0kB writeback:0kB shmem:23400kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 4096kB writeback_tmp:0kB kernel_stack:2864kB pagetables:2924kB sec_pagetables:0kB all_unreclaimable? no [ 2950.761549][ C1] Node 0 DMA free:516kB boost:0kB min:736kB low:920kB high:1104kB reserved_highatomic:2048KB active_anon:6520kB inactive_anon:220kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:156kB local_pcp:28kB free_cma:0kB [ 2950.772118][ C1] lowmem_reserve[]: 0 425 425 425 425 [ 2950.774738][ C1] Node 0 DMA32 free:56kB boost:0kB min:20956kB low:26192kB high:31428kB reserved_highatomic:2048KB active_anon:31336kB inactive_anon:7116kB active_file:0kB inactive_file:8kB unevictable:3072kB writepending:0kB present:1032192kB managed:440768kB mlocked:0kB bounce:0kB free_pcp:612kB local_pcp:36kB free_cma:0kB [ 2950.788140][ C1] lowmem_reserve[]: 0 0 0 0 0 [ 2950.790271][ C1] Node 1 DMA32 free:2048kB boost:0kB min:45884kB low:57352kB high:68820kB reserved_highatomic:2048KB active_anon:94924kB inactive_anon:465492kB active_file:72kB inactive_file:0kB unevictable:3072kB writepending:0kB present:1048436kB managed:954724kB mlocked:0kB bounce:0kB free_pcp:364kB local_pcp:24kB free_cma:0kB [ 2950.805577][ C1] lowmem_reserve[]: 0 0 0 0 0 [ 2950.807712][ C1] Node 0 DMA: 5*4kB (H) 30*8kB (H) 10*16kB (H) 3*32kB (H) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 516kB [ 2950.814037][ C1] Node 0 DMA32: 6*4kB (H) 0*8kB 2*16kB (H) 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 56kB [ 2950.820315][ C1] Node 1 DMA32: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 1*2048kB (H) 0*4096kB = 2048kB [ 2950.825760][ C1] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2950.829716][ C1] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2950.833582][ C1] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2950.837582][ C1] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2950.841817][ C1] 7108 total pagecache pages [ 2950.844035][ C1] 0 pages in swap cache [ 2950.845793][ C1] Free swap = 0kB [ 2950.847332][ C1] Total swap = 0kB [ 2950.848852][ C1] 524155 pages RAM [ 2950.850858][ C1] 0 pages HighMem/MovableOnly [ 2950.853052][ C1] 171442 pages reserved [ 2950.855118][ C1] 0 pages cma reserved [ 2951.412050][ C0] ------------[ cut here ]------------ [ 2951.414878][ C0] HSR: Could not send supervision frame