(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000010000000000003e"]) [ 1045.629024][T16039] ref_ctr_offset mismatch. inode: 0x3d84 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:27 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000004c0)=ANY=[@ANYBLOB="ffffffffffffffd231aa0f2821dbc0e37b972300d8a418193e91261bf9d1e763b1732ea705602e5796b052859bc687d0be5f74195d771a70c6522f55a8e5aa2dc3b8ceb2e979cdcf797393994d6496cb8dff5c3f5843d2503bf87218b2c9d540e1c484224392975dccfdbbf418b0a6671a7eb8800b0dfb5b0fcf9173b799e11fd8afde698874eb933e5dc87a71aac36a1d5ed08304753c7f815220f655fc3e22f1ddae2c8709b7ccc55a00c399dc64d6f07eddf81c9d60c3f85442d1b28af406b38c02bb23b55adbec90cbd98a6c8cc9b92def6cd00a0900"/226]) 23:08:27 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x1400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:28 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = semget$private(0x0, 0x20000000102, 0x0) semtimedop(r0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$SEM_INFO(r0, 0x0, 0x13, &(0x7f00000000c0)=""/115) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000300)=""/159) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1045.899217][T16054] ref_ctr_offset mismatch. inode: 0x3d84 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:28 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000020000000000003e"]) [ 1045.983451][T16052] overlayfs: './file0' not a directory [ 1045.998015][T16057] overlayfs: failed to resolve './file0': -2 [ 1046.009471][T16054] ref_ctr_offset mismatch. inode: 0x3d84 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:28 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x11, 0x800000003, 0x0) bind(r2, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba7000076e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800015775027edce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r2, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x30, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8, 0x1, 'drr\x00'}, @TCA_STAB={0x4}]}, 0x30}}, 0x0) sendmsg$xdp(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x2c, 0xc, r3, 0x39}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000100)="f2a434e1c0df3fb73e74a6a0ed1662fc3c46f8a6b9f60a329e7d29c4119b59783126309e684522daccacf8bd10cafea6e148408c934545fff16c26032b666f382c98104cd146a1d1b2e58224b3ff", 0x4e}], 0x1, 0x0, 0x0, 0x20000010}, 0x8001) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) 23:08:28 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x2000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:28 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000030000000000003e"]) [ 1046.229554][T16064] overlayfs: './file0' not a directory [ 1046.414037][T16072] ref_ctr_offset mismatch. inode: 0x3d49 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:28 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x68, 0x0, 0x100, 0xffffff4f, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x4, @media='ib\x00'}}}, [""]}, 0x68}, 0x1, 0x0, 0x0, 0x8000}, 0x1) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="07000000000000000000180000002a0eff07140002006970766c616e30000000000000000000"], 0x2c}}, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000300)='security.capability\x00', &(0x7f0000000340)=@v2={0x2000000, [{0x0, 0x101}, {0x6, 0xffffffff}]}, 0x14, 0x1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)={0x14, r5, 0xc8ef0a4335e6829f, 0x0, 0x0, {0x15}}, 0x14}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80001001}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x40, r5, 0x8, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8000}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x20}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x24000840) r6 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r6, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) [ 1046.501863][T16074] overlayfs: './file0' not a directory [ 1046.536466][T16045] overlayfs: './file0' not a directory 23:08:28 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000040000000000003e"]) [ 1046.552905][T16076] ref_ctr_offset mismatch. inode: 0x3d49 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1046.587011][T16079] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. 23:08:28 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x4000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1046.734633][T16082] overlayfs: './file0' not a directory 23:08:28 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000005c0)='./bus\x00') r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(0xffffffffffffffff, 0x40405514, &(0x7f0000000200)={0xa, 0x1, 0x7fa6, 0x1, 'syz1\x00', 0x10001}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) lstat(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000140)='9p\x00', 0x800, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_u='version=9p2000.u'}, {@aname={'aname', 0x3d, '^'}}, {@cache_loose='cache=loose'}, {@access_client='access=client'}, {@msize={'msize'}}, {@uname={'uname', 0x3d, '@GPL+'}}, {@version_9p2000='version=9p2000'}, {@access_any='access=any'}, {@nodevmap='nodevmap'}], [{@permit_directio='permit_directio'}, {@euid_lt={'euid<', r3}}, {@measure='measure'}, {@appraise_type='appraise_type=imasig'}]}}) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000008c0)={0x0, 'caif0\x00', {0x2}, 0x7ff}) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0x2, 0x0) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140)='NLBL_CIPSOv4\x00') sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000940)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000128bd7000ffdbdf25010000001c0108803c000780080006003f000000080005008327897508000600ea000000080006002a0000000800060097000000080006004400000008000600070000001c00078008000600f6000000080005002048b342080005009e5e6f1314000780080005002e5b616308000600070000002c00078008000600f9000000080005004655ff2c080006006a0000000800060061000000080006008900000014000780080006007a00000008000600120000000c00078008000600b400000034000780080005005fa63d0808000500afd4c006080006002f000000080006005a000000080006001600000008000600c90000002c000780080006006400000008000500393b7a51080005004e33a36208000500cc4b1701080005000a2d431110010c8014000b8008000a006cd1000008000900c42ba0480c000b80080009001a58140d44000b8008000a0085ba00000800090092fda75708000a0061360000080009001ca0973708000900a086847b0800090062143a6b08000900ab5c574d08000a00e3bc00003c000b8008000900517a6d43080009001493043108000a00b7d1000008000900251faf6508000a0064e7000008000900f16bdd1408000a00459e00004c000b8008000a00448f000008000900caef357d080009001159417e08000a0024ac000008000900bcd7955d080009008d89466408000900b03bdc0c0800090052e2c01308000a00d04b00000c000b8008000a007846000014000b8008000a00163f000008000a00bed4000008000200030000002c00048005000300060000000500030006000000050003000700000005000300000000000500030006000000c8000c8024000b8008000900bff7152d0800090031f2ce1608000a00d5f5000008000900a8c1c97d24000b8008000900986cc53b08000a00da83000008000a003bdb0000080009001ed2ae691c000b8008000a004d1f000008000a00bec6000008000900cffc50572c000b8008000900047921230800090083acf31f08000a0069a6000008000900d31e3c7408000a00f22b000034000b8008000a005e54000008000a00e213000008000900fd9e4e720800090084483e4708000a003e83000008000a006bb20000bd4785ee8e0222314ee0a535177e5c58ec78837bc4cf1219f919c7e73f8c569b28b7982bef27e3d56d0260f48431cbcbeaf65fc280fc2336a1b7ad8dda1951f627c1c6e5b89683"], 0x33c}, 0x1, 0x0, 0x0, 0x20000801}, 0x80) sendmsg$NLBL_CIPSOV4_C_LISTALL(r1, &(0x7f0000000580)={&(0x7f0000000480), 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x6c, r5, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x7}, {0x5}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0x1c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}, {0x5, 0x3, 0x7}, {0x5}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x1}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8000}, 0x24008081) 23:08:28 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f00000001c0)='./file1\x00', 0x0, 0x22) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KDFONTOP_COPY(r2, 0x4b72, &(0x7f00000000c0)={0x3, 0x0, 0x3, 0x7, 0xce, &(0x7f0000000400)}) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:28 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2b, &(0x7f0000000500)={0xfffffffc, {{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xe}}}, {{0x2, 0x4e24, @broadcast}}}, 0x108) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperDir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) setxattr$security_ima(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='security.ima\x00', &(0x7f0000000480)=@ng={0x4, 0x3, "aba3dc"}, 0x5, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x200, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000140), &(0x7f00000001c0)=0x14) openat$dlm_control(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/dlm-control\x00', 0x80, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'batadv_slave_0\x00', 0x1000}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000340)={0x7, &(0x7f0000000300)=[{0x0}, {}, {}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_SWITCH_CTX(r3, 0x40086424, &(0x7f0000000380)={r4, 0x3}) [ 1046.830209][T16087] ref_ctr_offset mismatch. inode: 0x3db4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:29 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = semget$private(0x0, 0x20000000102, 0x0) semtimedop(r0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$SEM_INFO(r0, 0x0, 0x13, &(0x7f00000000c0)=""/115) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000300)=""/159) chdir(&(0x7f00000002c0)='./bus\x00') [ 1046.962633][T16086] overlayfs: './file0' not a directory 23:08:29 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000050000000000003e"]) [ 1047.059703][T16090] overlayfs: './file0' not a directory [ 1047.105891][T16095] overlayfs: unrecognized mount option "upperDir=./file0" or missing value 23:08:29 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x4615c1f11dd6398b) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$kcm(0x29, 0x5, 0x0) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) 23:08:29 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x4800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1047.255774][T16095] overlayfs: unrecognized mount option "upperDir=./file0" or missing value 23:08:29 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) lremovexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@known='trusted.overlay.upper\x00') mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:29 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = semget$private(0x0, 0x20000000102, 0x0) semtimedop(r0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$SEM_INFO(r0, 0x0, 0x13, &(0x7f00000000c0)=""/115) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000300)=""/159) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1047.406112][T16110] ref_ctr_offset mismatch. inode: 0x3d85 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1047.458349][T16111] overlayfs: './file0' not a directory [ 1047.499035][T16115] ref_ctr_offset mismatch. inode: 0x3d85 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:29 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000060000000000003e"]) [ 1047.615891][T16116] overlayfs: './file0' not a directory 23:08:29 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x4c00}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1047.693657][T16122] overlayfs: './file0' not a directory 23:08:29 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private2}, 0x0, @in6}}, &(0x7f0000000600)=0xe8) syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000140)='./file1\x00', 0x2, 0x4, &(0x7f0000000480)=[{&(0x7f00000001c0)="d8bdfd7a207ffad5ab5efc49f2212565314452ebb95e23f598582e5ea75e36052eeaf37f74124679934ee8470748479ac4b5f46c9e63c40a8901826a4a2e19f3434d2f355a05f9e8d4cd812738e0dd5bfbd0c10cd87bb307", 0x58}, {&(0x7f0000000300)="fa22c39a83aa5cbe54be2b6d738715c00d4ef9f85395d7a17eaba77a74e8a0e1773be2eab83146544d35afaa34c13456cb538d28542963474be381a57c7efe784640664fa39b7990ac18e18756774c311729e28242d438923a380ff8a5f0cf05a351f50a93fd35f64d2f97392c128bf8d9d5027989a577ec1b", 0x79, 0xfff}, {&(0x7f0000000380), 0x0, 0x9}, {&(0x7f00000003c0)="19be13ec457e7310fe557a90c8c9ca6c772812039d64916518bab236a3f823a4d11b7df6d3b39c07727464280fa3a2389bf3c0a3a7b2126a37681523179091d12cb9741d9aaf7a486b27b3f6d2e5cf06557db1060f7572281bf081ca72d69ddf1c2c167c4ee03e581019a72be4f16f5ce361a0ef7a0bd73de800d2947565766f361975845465aa36030aa21f42f165f904b3cbb21865e80753b8cd34377ac19536f8", 0xa2, 0x16}], 0x1000000, &(0x7f0000000640)={[{@dots='dots'}], [{@obj_user={'obj_user', 0x3d, 'overlay\x00'}}, {@audit='audit'}, {@obj_type={'obj_type', 0x3d, ',trusted\'\xa6wlan0bdevself\'losecuritytrusted!\')'}}, {@fsuuid={'fsuuid', 0x3d, {[0xa28e55506da7a39, 0x64, 0x32, 0x38, 0x63, 0x33, 0x63, 0x39], 0x2d, [0x64, 0x31, 0x33, 0x33], 0x2d, [0x39, 0x37, 0x38, 0x32], 0x2d, [0x32, 0x39, 0x36, 0x38], 0x2d, [0x35, 0x6d, 0x63, 0x0, 0x36, 0x37, 0x61, 0x30]}}}, {@smackfsroot={'smackfsroot', 0x3d, '$'}}, {@fowner_eq={'fowner', 0x3d, r2}}]}) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r3, 0x2, 0x0) 23:08:29 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$KVM_S390_VCPU_FAULT(r1, 0x4008ae52, &(0x7f00000000c0)=0xe7) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ttyprintk\x00', 0x610341, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)={0x14, r4, 0xc8ef0a4335e6829f, 0x0, 0x0, {0x15}}, 0x14}}, 0x0) sendmsg$TIPC_NL_MON_SET(r2, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000400)={0x21c, r4, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x10, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}]}, @TIPC_NLA_NODE={0x3c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xe6}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x64, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x7}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x81}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfff}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xa548}]}, @TIPC_NLA_LINK={0x4}, @TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x10001}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x845}]}, @TIPC_NLA_BEARER={0xb8, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x3932, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x597, @private1={0xfc, 0x1, [], 0x1}, 0x9}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xe0000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7f}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xffff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9d}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7d4}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1f}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}]}]}, 0x21c}, 0x1, 0x0, 0x0, 0x8000}, 0x10) [ 1047.863165][T16127] ref_ctr_offset mismatch. inode: 0x3d9d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:30 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = semget$private(0x0, 0x20000000102, 0x0) semtimedop(r0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$SEM_INFO(r0, 0x0, 0x13, &(0x7f00000000c0)=""/115) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1047.993616][T16130] overlayfs: failed to resolve './file0': -2 23:08:30 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00>']) 23:08:30 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x6000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1048.104678][T16135] FAT-fs (loop2): Unrecognized mount option "obj_user=overlay" or missing value [ 1048.206045][ T26] kauditd_printk_skb: 43 callbacks suppressed [ 1048.206060][ T26] audit: type=1804 audit(1589065710.290:1856): pid=16142 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1801/bus/file0" dev="overlay" ino=15734 res=1 [ 1048.251069][ T26] audit: type=1804 audit(1589065710.330:1857): pid=16138 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir105873212/syzkaller.J7Vk0J/2107/bus/file0" dev="overlay" ino=15825 res=1 [ 1048.362634][T16142] FAT-fs (loop2): Unrecognized mount option "obj_user=overlay" or missing value 23:08:30 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x4) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, &(0x7f0000000140)={0xc, 0x1}) openat$audio1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio1\x00', 0xa2000, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r2 = open(&(0x7f0000000040)='./file2\x00', 0x1b1c40, 0x0) ioctl$FIDEDUPERANGE(r2, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_S390_UCAS_UNMAP(r4, 0x4018ae51, &(0x7f00000001c0)={0x5, 0x3}) [ 1048.417734][T16148] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:30 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='.\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, r3, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f00000000c0)=ANY=[@ANYRES16]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0x2, 0x0) 23:08:30 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f00000000c0)={0x4, 0x6, 0x79, &(0x7f00000001c0)="a9da7fedff1ef8b0a7d02ec86b59bc61cc5ca3307ea5ab4ec5222b38858eb0b775bf42bccefd160e3dbef122c5b0eec63a877ead3ef38d2073506f78e9fa5f574f7826089cc3b33d883eee241bdb2e3f74d4708de12cb829b0c72e705339e67bd3090c4b08e4cfc92f4189e4d58bdf832478d5770a4546605b"}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x45c1, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000000)={0x0, 0x0, 0x20}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) socket(0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000080000000d0001006d61746368616c6c000000"], 0x74}}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000200), 0x4924924924926d3, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='timers\x00') ioctl$TUNSETPERSIST(r2, 0x400454cb, 0x0) [ 1048.560022][ T26] audit: type=1804 audit(1589065710.460:1858): pid=16135 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1801/bus/bus/file0" dev="overlay" ino=15866 res=1 [ 1048.614918][T16154] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1048.638481][T16156] overlayfs: './file0' not a directory [ 1048.725292][ T26] audit: type=1804 audit(1589065710.680:1859): pid=16156 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2222/bus/file0" dev="overlay" ino=15805 res=1 23:08:30 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00>']) 23:08:30 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x6800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1048.864828][ T26] audit: type=1804 audit(1589065710.740:1860): pid=16159 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2222/bus/bus/file0" dev="overlay" ino=15747 res=1 [ 1048.949043][T16167] overlayfs: './file0' not a directory 23:08:31 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f00000000c0)={0x4, 0x6, 0x79, &(0x7f00000001c0)="a9da7fedff1ef8b0a7d02ec86b59bc61cc5ca3307ea5ab4ec5222b38858eb0b775bf42bccefd160e3dbef122c5b0eec63a877ead3ef38d2073506f78e9fa5f574f7826089cc3b33d883eee241bdb2e3f74d4708de12cb829b0c72e705339e67bd3090c4b08e4cfc92f4189e4d58bdf832478d5770a4546605b"}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x45c1, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000000)={0x0, 0x0, 0x20}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) socket(0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000080000000d0001006d61746368616c6c000000"], 0x74}}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000200), 0x4924924924926d3, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='timers\x00') ioctl$TUNSETPERSIST(r2, 0x400454cb, 0x0) 23:08:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = semget$private(0x0, 0x20000000102, 0x0) semtimedop(r0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1049.034105][T16169] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:31 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="6c6f7765726469723d2e66696c00312c7c36e96b002e2f66696c6507200000000000030000000000000000754b3e5a3f9ff3071d3a611d44d78466592236e8a326032537084da634dd9f2b2e67f695fe4507861daf47a4bfd29c79429fafc86bd7d44962a9d09f9963777e83cd04f37e18eff9d3c9f2b6460d3d6bd46a5725cdbba5bc4db30965113cf07e5791306821460e8de48179e3f7d5077f9e6b1b9634cf48ec1a865d8dbe637be501503124e8dc0ab3067dc5cd4f06d109311ec119cbfff1334492822a3acf99b19b9d1824e27071cbf100aa7d4445659441827d624900761b3ab288360ff3ba60cc08a2ae2b73acab36674904774c16e36e88f8b009354bceab2b52a28ed3a456122ab2b0c7"]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x2, 0x0) [ 1049.129044][T16173] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1049.235471][ T26] audit: type=1804 audit(1589065711.320:1861): pid=16171 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir105873212/syzkaller.J7Vk0J/2108/bus/file0" dev="overlay" ino=15792 res=1 [ 1049.323084][T16174] overlayfs: './file0' not a directory 23:08:31 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x6c00}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1049.410333][ T26] audit: type=1804 audit(1589065711.370:1862): pid=16166 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir105873212/syzkaller.J7Vk0J/2108/bus/file0" dev="overlay" ino=15792 res=1 23:08:31 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000ffffffcc0000000000003e"]) 23:08:31 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file1\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1049.551537][ T26] audit: type=1804 audit(1589065711.390:1863): pid=16178 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2223/bus/file0" dev="overlay" ino=15748 res=1 [ 1049.597336][T16187] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1049.634277][T16186] ref_ctr_offset mismatch. inode: 0x3d8f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1049.695236][ T26] audit: type=1804 audit(1589065711.430:1864): pid=16179 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2223/bus/bus/file0" dev="overlay" ino=15749 res=1 23:08:31 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6c6f7765726401070d9f301b52512c77ef726b6469723d2e2f66696c65312c75707065006469723d2e2f66696c6530"]) chdir(&(0x7f00000002c0)='./bus\x00') chdir(&(0x7f00000000c0)='./file0\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x2, 0x0) [ 1049.754452][T16192] ref_ctr_offset mismatch. inode: 0x3d8f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:31 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000002000000000000003e"]) [ 1049.870100][ T26] audit: type=1804 audit(1589065711.740:1865): pid=16187 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1803/bus/file0" dev="sda1" ino=15738 res=1 23:08:32 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x7400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1049.971262][T16196] overlayfs: './file0' not a directory 23:08:32 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000fffffdfd0000000000003e"]) [ 1050.077718][T16202] overlayfs: unrecognized mount option "lowerd Ÿ0RQ" or missing value 23:08:32 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x7fff}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000380)={0x15, 0x110, 0xfa00, {r2, 0x2, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e24, @loopback}}}, 0x118) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) [ 1050.153446][T16207] ref_ctr_offset mismatch. inode: 0x3e71 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:32 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = semget$private(0x0, 0x20000000102, 0x0) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:32 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,wor+dir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x2, 0x0) [ 1050.375451][T16209] ref_ctr_offset mismatch. inode: 0x3e71 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:32 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:32 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x7a00}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1050.545508][T16217] overlayfs: unrecognized mount option "wor+dir=./file1" or missing value [ 1050.555021][T16213] overlayfs: './file0' not a directory 23:08:32 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = semget$private(0x0, 0x20000000102, 0x0) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:32 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000ff0000000000003e"]) 23:08:32 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x7fff}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000380)={0x15, 0x110, 0xfa00, {r2, 0x2, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e24, @loopback}}}, 0x118) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) [ 1050.702879][T16224] ref_ctr_offset mismatch. inode: 0x3df4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:32 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="6c6f77657264d58a3d2e2f6275732c776f726b64697266696c65312c75707065726469723d2e2f66696c6530000000d5deb05a4c3be38d22b76efe0a91a1aaec1af61b2261cfd60c8b2d6ac258450bcbdc6b7d8090c554e7bc74040ea49bcf7bc57bc6e071f839d864c984f85ee6cc8c0dd6607dc1fd0000000000000000"]) getresuid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000300)=0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x20002, &(0x7f0000000340)={[{@mode={'mode', 0x3d, 0x8}}], [{@appraise='appraise'}, {@dont_hash='dont_hash'}, {@euid_gt={'euid>', r0}}, {@seclabel='seclabel'}, {@appraise_type='appraise_type=imasig'}, {@pcr={'pcr', 0x3d, 0x1d}}, {@seclabel='seclabel'}]}) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) renameat(r2, &(0x7f0000000100)='./bus\x00', r4, &(0x7f0000000480)='./bus\x00') r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0x2, 0x0) [ 1050.812516][T16226] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1050.868583][T16226] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1050.930781][T16226] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1050.997791][T16238] overlayfs: unrecognized mount option "lowerdÕŠ=./bus" or missing value [ 1051.008667][T16226] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1051.087839][T16226] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1051.104740][T16237] overlayfs: './file0' not a directory 23:08:33 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = semget$private(0x0, 0x20000000102, 0x0) semctl$GETALL(r0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:33 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000fdfdffff0000000000003e"]) [ 1051.156122][T16226] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1051.205509][T16226] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1051.227029][T16226] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1051.258521][T16226] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1051.295284][T16226] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 23:08:33 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x7fff}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000380)={0x15, 0x110, 0xfa00, {r2, 0x2, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e24, @loopback}}}, 0x118) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) [ 1051.323438][T16226] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1051.348856][T16226] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 23:08:33 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xf0ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1051.408847][T16240] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:08:33 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:33 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,work/file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x2, 0x0) [ 1051.607406][T16254] ref_ctr_offset mismatch. inode: 0x3d8e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:33 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) semtimedop(0x0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1051.736286][T16262] ref_ctr_offset mismatch. inode: 0x3d8e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1051.763318][T16259] overlayfs: './file0' not a directory 23:08:34 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000ccffffff0000000000003e"]) [ 1051.865913][T16266] overlayfs: unrecognized mount option "work/file1" or missing value 23:08:34 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xfff0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:34 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x7fff}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) 23:08:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_VCPU_EVENTS(r1, 0x8040ae9f, &(0x7f0000001740)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') openat$vicodec1(0xffffffffffffff9c, &(0x7f0000001780)='/dev/video37\x00', 0x2, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001bc0)=ANY=[@ANYBLOB="02b828be71e0b58856f53a87812c2bb56e3685e786023a0b7232ae133054b653e1cf4f5632932326", @ANYRES16=r3, @ANYBLOB="070000000000000000000700000018000180140002006970766c616e30000000000000000000"], 0x2c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000001340)=0x8, 0x4) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, r5, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000001300), 0x4) sendmsg$sock(r2, &(0x7f0000000140)={&(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @private=0xa010101}, 0x0, 0x1, 0x3, 0x3}}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000300)="d11d44242659a6205cb18414e22e3cb6af244c3b4ada12c1fb63f059a6106a15d70f8d9f579a8dfc9d9f9c4a152444fb015e05ddacd2a6700b431589529bfa0926c30620408bd45cd438997cbc734a1cc5334d8199c8957498497e45ba65dfd3205352a3cb0b4007b8773191f7556189d08d7ef3dcbf90ff241b973cde5b68780c56fef56d98a7d5e750f93548c94533897fde79dae4cc583cb807caff9841452dff21bc5635afe61f6b7a34c86a7b339fcd93535f7a0bf545e9cedc203a335007a2439661981e212c937c65ab901c035039fb100322207094e1bb30aeb3adfc54e57ad248de62b727ad250f976363a5bcd9d14e0d7da2e663058ec5d19e9e8e60b723a0a8a8f2b2f478a8cef433d0a87210ad055e13193d4b98aee11eb661146eb9b8df1f2a31f83231ec179590b4a71e61b0819b74368021ceecc2ead3affe68a56de38f00b437adb9e871e7af7e8eddd7a678e2d97e582eac41c13fa5f90f3235577bce63e6ca330f5f2a059acccea3b88bf150b9d348d52607268389670bb9ba40b82886eb0f1204a99a208964ad5d1952b22aad4521c723f1249f1d25692cbcdd7f70bdae5ee29dc223acf6c669478e75ec926d0cd520d4be0fb8274ef5a83cbe0f40c74958d64f4d5fc3d2fe7fe50add19080732d5c436d628a0ad38451a829728297e7a1d1663ae5acee32c81725c5ea9d0610d3b4767fee16d75fa5103c003fa0b1cc1973243568bb08fa4019060fe6cc87ec6cc6e4afd3fac58122b4691b84c713a9535e0e1493c31bb98d786ecde34883169b345c9461834cdfd74be49ec4f1b946b5caeda2d3af079d632c82d2b4b18de487be53966704749484fab22fbccd188fada09b3c124f07b5ba8347f71a256e124e22e2369053a70b0a3de3057e28bddb670e871711c4ac785696abe98ed8bcff7f752278dfc361a928a716339923dff091a5961a0ae97ea39ea9d793d7748063247a760e27c888cc9e6bd9a3240f7d275c54c5166b6641ab11f8226309aced1c66d736e8c2cba2b4a0ad5e4ff4ab2afdd1926bd6b1ff2e5e0c1c4f9fc710cf5d6b6d61e2daef30f285a809419b5df7f482da6c29cc64ce8a89a1f9613627516110780012076c5e3dfaba3d3f65f04e69ff360ebafa9cfc95c626441a2bb6e91ab2a179c11f7efdfb8ecbd01bf2712eae891616bd9dd7b9873ba4e9097f9cdbd7bce623ca0fed98f0837e9ebcdd4f40a903df48e085ba417f2bb6058275adfebc64673b894e0da5290ca61ec5f91cc87d957131a3bfe95ef17ce058fb2f257c25ed73fd4345cf0fac5ed0fd7a127ed4006a5b03b9975abb4a8706218dc1c6cbb5738c79b23df5390fa6c20f5f50bda2fd06556078be817555a6c9e488b82faca1a4bec5477e93fcc256ad9c3df5821bae0d9721c08acb51fd9a72327962af8f8d0a43d18e20b3c184f0d7da2786d2fba54b9539841daa4ba7870e8f580ab22ec54680265d154ee9ade51d6dda5542abe6ee857ce60e348c362c4b680edfe6736bb632937145057070f77e5fb69cb39e9afc28dc5f6dfda1c602a491caa8f8820252ff9604d465376ea767b528aa3168e54ad12b8c7508e7d909897e7589552bbd6ff87f2cdb4b4b743384d18a598957521a727bcf4c59b722a16b74021e7c2363a1f215a3370cc9364d617f1decd87c21f0cb26d0f24d6c72c8d1b3a23b90636bbecde17ace1bef40454925ee5aea5669661eb88c0135baf392eeb91974bedff11fe89bf0cc658c7f8399df62b1760b13b03bc5d70c2b1c536902871b06a2818b23300ff193fc747aa4a0b5cbad42a02122a05ddc679f57502ec87bb19c1736202fc1a3615ca666da0350b1a36777d98b1a1b9681b366e9fb9617806787425f12ce256e4fa1a0f93ce37a9b5cb9fad4450e2219556063538c9d470e26d76c1109f85e0bb73eaee0376e0be62d18a0fd04dccf19526992ffc10090c8fb500ba2796d4ae332f8d346d29346b8d465c7cf2ae37ea379c9d7e1019a77aefd31429409f384338b3e4a5535fe718766733d1aac89c8afb38ae083f4db366afeaab8a02918149526be8b4deff1579e90f17c49773b07be67351f8b1af64acb9b9c5996bac09197f689a65eb799a1b4a2363d2c6572519c4bda1b67095fdc84fe982d9bf897bd7f1b960bc77b34567ca999daa2fbd636f9a74c5f370b80c63e7782690823adac628bd1a0aefe223e17cc7f3f044c75803a61e2c1fc1d93f7e979d314298e39df531515b03940a9324575f992f05ca9eff5f90af3ae83af15f3fe0c3977ee88efa03a0921e84454776e94f9d3115caf31e219517a467745ed63e0ef47664394f31c3ea15330d4de7e7b2e3dfbe2910eda30e1778519632dfb4598cae933855d76efe87f3a58d88ffa3e3ba0dfdd8022dfd3a188e01057ea903c306f054f7dac1fcd8428b25f3b5c905f153013adfb0a43a10a3fa66447696fdd17f62d39a96fba2489b27083be9fd7d52524e3aba12d4c60e45040d900230db3c32e5990de6787f4c358a351a47adefa61c7145f8cc3be8e7169028e905cf808a83a0d3661c9c7b1c7b33b9f7c44b6b48951d8d26e42562863b18c9431eceb578c7b4f2024251170f6c77f418fa7735a9aefee27d9ba0fb66f302203a243304d4c188b2e239ca9e189e58f7e433464e19140ac5aaa8ee6cc17c96082171cc0390aac3ff3311e42933ecfc85459d7f790db68c8c2706f2b74dfa59b5ed6ec5ee5f2708d0eb0b67d19d29260b1fcedb957ff839f2e41a776dc505bd2c6f61f8e1105a7b1d9d5ee2e87025069277e63c0bd54d15c1a1c3cc572371718736fcc258baf20d29d0b45ed76a9ed7678f78e224442efb5481d281333ee6193821e363ec50667c8edaf2560c7af3eb576d771aa74270039061aa7173b7fb3ec982cdae5dda51a774d67a158e54cfca6e27ff7eb890a2473747169783ee6d74e4695c7105240d2f893a30fda5cb21a10442de3a19d8dc9a7b49275c16d5b122e88a16c3c61e2c88bd6cf87392b5c7b079d47f8bfd9e716bb77045a96513dd91c8b0f1962ec740a48c00846e1629dc8786eb455349ca839b07c78b148a485f0bbe5f851b16163ff92470c5fb2309a8feedbf80921c4ef9570e9a890ac6624d640e46102d1b754390b7db72157a0e57244271b6d7e130ae8b91e7907c047d88ca6e06d6bd7b19c9c37afaf1f58f4238a57ed51de3753b99b03639bd576deee2ef6d9a6e2d3cb0f2c133aa594080ba328ba7c0218647a65e64559007ef902508f4f1d6167bddad32c4fa6a23a649b64320317f4cd2a0b0db8b86247ab426314e360fe5befc5037f275e2ce42b8e01e1575b0ce66d9c3577348e99c0ef60cebcf2f310673b9764bbe76a862c2a7a84b5fe63d30370569e390718189a7e05ba845ef997ea30016803e45d1d30dc0c5e04697898dfb5cdfc4e5cdca7026e7f55242a5caa5b9facc107f769d4a18a324f7c05324b9d6bbc5c5142276c011c062170cc93811f28567ded6ab394865282265bb4448428d5f472f80093b60c9ded7f7a46045b43eba678cf3adbfa2ccb9aff07a0e0f0b854fcb32a556ea80eda8428a9bed92ed9a0c439d44699b41a08ff59714ee0e3c7504ad34eae4a64e22c60585785efa08b80296a2227b01b373ef60b62b9b6cd71321502ac3f466be377bcabb27ca572d42a48c92be045c3a83521ec408b5c587c8e3407f3347f7b45075f7c6384d979332532a2ad30122dbf21b7000d6279ca9211bfbe74e4ed752d3365fa38929690ade95dfbb8b0447fb9f35342a72b41799fd5c90b9c8768ce76b90af33542b00e6fe0081ecf36e07fa6eccb217f446e8a8dfd2d2a8abfac0c4a62e79d51aa9de3a7c9ddaf14dd18e6f34a37529c7869eb79def24d9498e1c7ef1ca3b00f783f43ad8bb2687d30c0abfcfe008b37e2b4b8a078784eb27fb754ab757020ffc386d95279c650a2bcac6af7c10b2eb8888ad1380b75a3cf45204254c67f242fb23351f699079f0c5a2bf18649cd45da9bad0b1e09a33452db3639130776de9809aa142958e3b1aee3dee57b4c6bd0360a6a07511b8e02642f43d1a91f04001b3754f34b50494334167f150f5d0302a52df0eb8197afa898f299229cb834079f4c8fdb225ffc92eab49b9fbf91deca2c4baa9b5dd7e46ba471128c2b0c56683618199d5964e93822fab45cea04bafc5a805f967c0c258f435dc0b15f17bb88146264c5c61561d911e535c836b4e79d9bb57d9153fe5816a63cf5b35508f4bba19610441b7b470621e1b62293fb7ab82978011f097b87f0b549e7d30a7c4324a5949d00585d3980462c4458deedb4fc26320f14450ed617a2da28bd86fde28beb5c09aa099e79530e82d9a694d6fccad874465c27eb1c0f9fa000289f73b9479beef6f0f6b482626f2ec56304be068e7f790a5279160c1e170d9bddb00f75158f1f3933a8154552490de36dea9878755f0c1b2c53862397e17e7b51416fb56a8884ce8c6bab01c1c0590dc05192b3a6c14609f10d4762a8c221107f076c3d8146d1be8eb596a1004bea34cab14cf896e39270962b9d6cdc7c9266095449812e71240982cbaebed2cf657b8fe30617b8fa9e2cf6e775d3d6cdff6a530b9caf203022462b7ab1ea00c6eabcbfa6b85babe6e30fb029d476d39d9aa03cdb9efea00ad98670ff118a5727a5c99ecfc59db279041f1afd7587c43fe2289ebbc67b0696b415b6de12adfaf4cbb11c07ce507f04453773790bec0dfbe04ac8c34886fc3317c7e3e7da438930604c0d169ffef13a40a7a7696f0334d2167370d874df065206425cdc4f76becac378939ecb2e2d9e19e0713f2db914976940382469cc9837925e01c56b253fe20d70019b1eb59006359fec861edf54ad068220d7d8715ba06b6a3359f109018ca1169bcb734c638ba0d90faa33a9053f8fcbdde9c55d13ce4885cbe664d090f2ebb76566574c264c721f8b1a6b4747c558880838271db7057a695f56d408ce9b599f29f4ea66db7beabd94036f1d8e71d966d7cbfd1081b3f0805915131ca9de51e79a41968b49305a70027d2490dda4f85718a67b4db224ddd9d5305f5e99a975ba6f43a35406bc144579a536294427ea7f1624fc89f205249942fec0020dffb202dec43df0b0744426c15f7fdb08c31843567969b49485c750fff4a2ef4961267f526e8d60f548611a975ba2571998f370ff9181470979a7b3ea1fb870b797711fe51f1124950c7dee75ecd16ac4eff2360f755456517f0d26869108714e83626996dede66e0c4aacde349660f100f187ec69b3088cb82b4e48124ff95e21312fdb676524abc1fd964e95219fcc21f6e4cf8d51bc1d4ab1afe7b361c2d1790d328d9aafbcddf0d1f6b76a6c97cdaefbbd89686326badad3a79733aa46f5978b6a42824c48404143486abe681ff894c345b3be3c2c50c7d39dd3bb13bf7603310784a2ece34484041d4b15b04361c9913d8c5fbf2d39439024fc03b8f46e02ed4aa25de70a860d514d4b3277593afa8afeeee7db2edfb8a0ac525d2e9c6f2be8ca7031c172c2da894e25e757c672f3b99b52b18e99407b95e17f8a9f99d5bd54a1f78cde2005b4ea12b2ce5fbb67ca7d249d32da61d67acc451d650305a9b352bff4c9f744590a216a49fe5a44d536506e3320badd4b8f717079a22b024d9e387ac1d81b95e26d5633613aede042d5b535b221032ea724e6deb2a447749eecf8f6fe8079aabc81a4af7749a1570ca1e12f3f0b21c476e3a6742c567afdaf97bf6479419c2a5f74e764a13a6e3b", 0x1000}, {&(0x7f0000001380)="5ac6612ff026c61557df9d6341f61f1804a2075090c2e45fa1d324a63b76bfb15a55d8e69c9410b727a12adc41610a4f5f908de7ce0501c0ed7cd3ed34db5364460347547d4057fd7f419ecf809b62ebab11e111e5691abc395b1462b392db3787278b65418cb57f316a932d4fdae89e45951cf7ca31d2a11ae534c89c9bddd54773d9ed8b2d7ce895d45dc2f959bae6b487a4344d7f6f02", 0x98}, {&(0x7f0000001440)="baf4c39e0f59ee53c6dec2ac540c1988d1b53f43c87b9c2df190d0c18f85a9c2b76cfea11faccd2c4a29e28bc22f76f134cd5dcb1e6fb0ad0283df83bb18342870d893240b20c7edd5514942c8d07fb03c420049fe1a4c39c2f0b72692e2047f4f23eb27d4ecec3f00c007b79f859d0f79e92967f6dbdd12aa6f31690f801547", 0x80}, {&(0x7f00000014c0)="ba65cbc2df34a1579582335ce7e41c3fa8c635fd41bc2a21992d023c526e3d0af247dbbf50ba20129525bcf035c75c36c89d06a3ea51db8b92a549b1b8f80a7a2561d992ed10f19d09c60e9689b0d2df7ba6a7b9e8fd281b1603a418c259a0429383f1f623b63745c7b420a585cd9d59f07ecdd452f9f240188e9b64331929c3d7df84e661060ac74cb52033408564a7155e0422e6971fe8e4179d0b74cca6ec8fb2fb9b570b3d1f42310927d4c4050b361be185e9c22c9738be246a63d177a21301d091b4dcaaa7c6616ebd7b9d0fc58c1b09a040", 0xd5}, {&(0x7f00000015c0)="edf23f19200749e3e2793e256dfe39d45e9bbe397f7cfebbab8c4d2d89695f35ef1b41c00c4b13d8bdb03fb9b5303094fb08165022b9ea8425f401e4f5ddc5b93f61d0adcd6e20e8cb5a513b110810c64d3340ba928f9a546c7524b5c57c9e1800ff89eee5c6a3e9cf236468d3da77a1a1e984e615faef2a922903e1e37dd2d5fdaa9a333dc5279190d5fb80a0859138d23da5cff403baab91f2147eddf2bb3905b530f493baa9f1be36811428cf3a4a3d98d03a34b3b48baf82f066f8476f248485103496f41740de9d858f882724d56815", 0xd2}, {&(0x7f00000016c0)="c3a68f8ad4471893213c0fc05d173df0715fe2e07e8fba7275f0a980ce92812c5c2b3189c78974c5015c19aa949eee776f60add5e60a5d671f", 0x39}, {&(0x7f0000001700)="fa0cc8ead5468dab5d166b17fdcffa64e34481f1ec7a9fda575a7a77b24bebf81f9132f5d9a8de", 0x27}, {&(0x7f0000001b00)="edbc390fb350144d3fc1fa4d0e8f45bbefba462607810fe081ea0f6f6ae7e5a68bfe02c036582f38bf0ab67ac228586164b6868456b8869d9bc7cff00be0aa017613420ce1b121ffcca272d0a98f5eece31584d46857318781fb0c04cf58c5d33d6b976941f052bf571eb54110d154ccf91fefd3817d2fb016142b07deb264dc52293c2043c29b494eebf276195554f37805dd8b33", 0x95}, {&(0x7f00000017c0)="2a65d57af73d320dadf26db16439fe04515ec2a665bceff0728ec5da6c66045bcdf0874989333e2ed9ec8915dd76e9e579eb931b9ae568d392e786566e8cb0423ad90c2d448bda0639137bcb6bceca6704c3e1029c0b8dcb4f60ae52e1b465b508381c33c69a552002100eadea7acfc9a9cfcbc8df74dc17760bd909f0f587073f56c505809491c2d640a7f96d77541c112c6d0b1945f6f7b1bbbbdc433da34a84a91d89f5036c", 0xa7}, {&(0x7f0000001880)="c6be16ca66e0d515bfd1b8ddd1bfda2a99e6fc884c1914fac128008934f351e3250a148937d61ed11669b83c0871254e7685ebce16bc7372f947aae47ba7adbb1f64b7a643d708e9c77221868cf6f69e9143e1c0da3e14c928dfd4f03842d02aa901e4464d91f45ea6900d86d7877922172377e1d7170551e8b18b2c5fd8c096f32ead46dea6fcb6746d5f842269c003f06bf85a48bfe32485c658600dfa6468e306f7f31ee815787edb22474685972c27faa95d8a036db9f4d59556b47e8a86e2c37bb1efb0f3a10856677a4fe1cf850074a631eaf44d2edfff5ed38c1df513", 0xe0}, {&(0x7f0000001980)="17195c6f54d8f63f443a204caa87c08c8fb464dd6e43aafb8ba5d9d82f4b764fb82d4dcb533c9fb5522f9d0582693b831726808b6ab3ae49283d7e94c134f74e1be38b400e068913d6d0c19eaff991211258323a0116975aa5b7a84b7da8f1fc9e1a01b492042b3c838d5a9dda1d0d20f0b6f7281c2607341cd49b863c5981fd28e7e2c024aaaacae35fa229b5d03400e6", 0x91}], 0xb}, 0x4) r6 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r6, 0x2, 0x0) [ 1052.119397][T16276] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1052.137999][T16277] ref_ctr_offset mismatch. inode: 0x3d8b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1052.262309][T16285] ref_ctr_offset mismatch. inode: 0x3d8b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1052.373443][T16284] overlayfs: failed to resolve './file0': -2 23:08:34 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x7fff}}}, 0x90) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) 23:08:34 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x1000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvram\x00', 0x40080, 0x0) r1 = socket$inet(0x2, 0x4000000805, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = dup3(r1, r2, 0x0) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000140)={r5}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000140)={r5, 0x8, 0x1, [0x53df]}, 0xa) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r6, 0x2, 0x0) lsetxattr$security_evm(&(0x7f00000001c0)='./bus\x00', &(0x7f0000000200)='security.evm\x00', &(0x7f0000000300)=@sha1={0x1, "facd9b02c9c9bee569bf2e50ae9c398a342ccc20"}, 0x15, 0x3) 23:08:34 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000010000003e"]) [ 1052.575776][T16293] ref_ctr_offset mismatch. inode: 0x3d8e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1052.629924][T16295] overlayfs: './file0' not a directory [ 1052.649838][T16297] ref_ctr_offset mismatch. inode: 0x3d8e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="6c6f776532051ea5732c776f726b6469723d2e2f66696c65312c75707065726469723d5d3e2f66696c6530"]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) name_to_handle_at(r2, &(0x7f0000000100)='./file1\x00', &(0x7f0000000300)=ANY=[@ANYBLOB="23000000000001003229cb52ff9f2edc32e8162c74775b27300bdc43f720ba02a49f45d286ad347bc0f949c4036cf21c813d7c8dac11cd8a9a7ad19f8a95078ae56282100accbca25a441bb938a711e192c04e143df5bf71dd7a34318a5eefbf6c4afb4aac5f9d0df4de09d190c3ccf7a2cc31241897b2071a410115fff9ecdef93b9138d45270b9bb934b1f83655bbc156764e4b0332f4e3152219135edf6f444d5a80a2744fc70c2b4808def3ab417c9bd4f50c9315f9f9ae3df7829a877e0d538f818"], &(0x7f00000001c0), 0x400) 23:08:34 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:34 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x2000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:35 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) semtimedop(0x0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:35 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) [ 1052.954330][T16303] overlayfs: './file0' not a directory [ 1053.012580][T16306] ref_ctr_offset mismatch. inode: 0x3db1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:35 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000100003e"]) [ 1053.061294][T16311] overlayfs: unrecognized mount option "lowe2¥s" or missing value 23:08:35 executing program 2: mkdir(&(0x7f0000000240)='./bus\x00', 0xa6) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="6c6f7765726469723d2e2f6275732c776fb191c8bd4bb93ea7c40e8c6a7659c4726b6469723d2e2f07696c65312c7570706572646968b32e2f66696c6530e962c9bf8156559d49c95370a7d9b33a256dbd0947718be95f508ab1c939519c6597b46f191610507140d54c182de4887c8df29a62f9ca3428bf50c2f309abaa0753424edce31a86f34adf5f05c7330b55b2340717b28cbd2335d6ffd84233b0d45b5f66fec42096f9219e6706"]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, r4, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) sendfile(r2, r3, 0x0, 0x1) r5 = getpid() sched_setscheduler(r5, 0x5, &(0x7f0000000040)) r6 = getpid() sched_setscheduler(r6, 0x5, &(0x7f0000000040)) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) kcmp(r5, r6, 0x6, r0, r7) [ 1053.238453][ T26] kauditd_printk_skb: 34 callbacks suppressed [ 1053.238469][ T26] audit: type=1804 audit(1589065715.320:1900): pid=16316 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir105873212/syzkaller.J7Vk0J/2115/bus/file0" dev="overlay" ino=15685 res=1 [ 1053.289459][T16321] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:08:35 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:35 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x3000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1053.386279][ T26] audit: type=1804 audit(1589065715.470:1901): pid=16324 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1926/bus/file0" dev="overlay" ino=15756 res=1 [ 1053.436433][T16325] overlayfs: './file0' not a directory [ 1053.446263][T16326] overlayfs: unrecognized mount option "wo±‘ȽK¹>§ÄŒjvYÄrkdir=./ile1" or missing value 23:08:35 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000200003e"]) [ 1053.518290][ T26] audit: type=1804 audit(1589065715.470:1902): pid=16325 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2230/bus/file0" dev="overlay" ino=15789 res=1 [ 1053.572027][T16326] overlayfs: unrecognized mount option "wo±‘ȽK¹>§ÄŒjvYÄrkdir=./ile1" or missing value [ 1053.616188][T16334] ref_ctr_offset mismatch. inode: 0x3da7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1053.661600][ T26] audit: type=1804 audit(1589065715.550:1903): pid=16329 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2230/bus/bus/file0" dev="overlay" ino=15835 res=1 23:08:35 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:35 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) shmctl$IPC_RMID(r0, 0x0) shmctl$IPC_RMID(r0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) [ 1053.805827][T16334] ref_ctr_offset mismatch. inode: 0x3da7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1053.824995][ T26] audit: type=1804 audit(1589065715.600:1904): pid=16326 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1811/bus/file0" dev="sda1" ino=15846 res=1 23:08:35 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 23:08:36 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:36 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000300003e"]) 23:08:36 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) semtimedop(0x0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1054.001072][ T26] audit: type=1804 audit(1589065715.680:1905): pid=16326 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1811/bus/bus/file0" dev="sda1" ino=15869 res=1 [ 1054.074808][T16343] overlayfs: './file0' not a directory [ 1054.152104][T16348] ref_ctr_offset mismatch. inode: 0x3dbd offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:36 executing program 2: mkdir(&(0x7f0000000140)='./file1\x00', 0x158) mkdir(&(0x7f00000000c0)='./file1\x00', 0xc1) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000180)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6c6f776572646972c8542f627573000000005b29080d64d92f66696c65312c75702f66696c65300000000000000000"]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) [ 1054.184901][ T26] audit: type=1804 audit(1589065715.830:1906): pid=16335 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir105873212/syzkaller.J7Vk0J/2116/bus/file0" dev="overlay" ino=15787 res=1 23:08:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1054.269776][T16355] ref_ctr_offset mismatch. inode: 0x3dbd offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1054.291881][T16356] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1054.350041][ T26] audit: type=1804 audit(1589065715.940:1907): pid=16338 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2231/bus/file0" dev="overlay" ino=15787 res=1 [ 1054.434887][T16359] overlayfs: failed to resolve './file0': -2 23:08:36 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x5000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:36 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000400003e"]) [ 1054.504597][ T26] audit: type=1804 audit(1589065716.000:1908): pid=16342 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2231/bus/bus/file0" dev="overlay" ino=15832 res=1 23:08:36 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6c6f0b0128df69720f74175af471a84205676c5175012c776f726b6469723d2e2f66696c65312c7570706572646972"]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x2, 0x0) [ 1054.632065][ T26] audit: type=1804 audit(1589065716.130:1909): pid=16343 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1812/bus/file0" dev="overlay" ino=15803 res=1 23:08:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1054.759170][T16373] ref_ctr_offset mismatch. inode: 0x3d85 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1054.762181][T16372] overlayfs: unrecognized mount option "lo (ßirtZôq¨BglQu" or missing value [ 1054.835676][T16373] ref_ctr_offset mismatch. inode: 0x3d85 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:37 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x6000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:37 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 23:08:37 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000500003e"]) 23:08:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) semtimedop(0x0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1055.217769][T16385] ref_ctr_offset mismatch. inode: 0x3dac offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1055.314487][T16385] ref_ctr_offset mismatch. inode: 0x3dac offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1055.402070][T16390] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:08:37 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x7000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1055.492925][T16396] overlayfs: failed to resolve './file0': -2 23:08:37 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000600003e"]) [ 1055.611900][T16405] ref_ctr_offset mismatch. inode: 0x3dae offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:38 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x8000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:38 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00>']) [ 1055.913747][T16408] overlayfs: './file0' not a directory 23:08:38 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:38 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:38 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) [ 1056.205770][T16417] ref_ctr_offset mismatch. inode: 0x3d86 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:38 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1056.300341][T16424] ref_ctr_offset mismatch. inode: 0x3d86 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:38 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00>']) 23:08:38 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1056.466585][T16430] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:08:38 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1056.691910][T16436] ref_ctr_offset mismatch. inode: 0x3d76 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1056.871748][T16438] overlayfs: './file0' not a directory 23:08:39 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x14000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:39 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000ffffffffffffffcc00003e"]) 23:08:39 executing program 4: semtimedop(0x0, 0x0, 0x0, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1057.111328][T16450] ref_ctr_offset mismatch. inode: 0x3d9c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:39 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:39 executing program 4: semtimedop(0x0, 0x0, 0x0, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1057.269706][T16450] ref_ctr_offset mismatch. inode: 0x3d9c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:39 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x20000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1057.451720][T16455] overlayfs: './file0' not a directory 23:08:39 executing program 4: semtimedop(0x0, 0x0, 0x0, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:39 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000fffffdfd00003e"]) [ 1057.567247][T16467] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1057.622660][T16465] ref_ctr_offset mismatch. inode: 0x3da1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:39 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}], 0x1, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1057.664644][T16471] overlayfs: failed to resolve './file0': -2 23:08:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:39 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}], 0x1, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:40 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x40000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1057.973547][T16477] overlayfs: './file0' not a directory [ 1057.975847][T16480] overlayfs: failed to resolve './file0': -2 23:08:40 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}], 0x1, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:40 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000000000ff00003e"]) [ 1058.136136][T16488] ref_ctr_offset mismatch. inode: 0x3d45 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1058.230901][T16491] ref_ctr_offset mismatch. inode: 0x3d45 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:40 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:40 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}, {}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1058.377222][T16496] overlayfs: failed to resolve './file0': -2 [ 1058.397155][ T26] kauditd_printk_skb: 21 callbacks suppressed [ 1058.397170][ T26] audit: type=1804 audit(1589065720.481:1931): pid=16494 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2240/bus/file0" dev="overlay" ino=15788 res=1 23:08:40 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x48000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:40 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}, {}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1058.449482][T16494] overlayfs: './file0' not a directory 23:08:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:40 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000ccffffffffffffff00003e"]) [ 1058.524729][ T26] audit: type=1804 audit(1589065720.561:1932): pid=16501 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2240/bus/bus/file0" dev="overlay" ino=15792 res=1 23:08:40 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}, {}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1058.655701][T16509] ref_ctr_offset mismatch. inode: 0x3da9 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1058.702746][T16511] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:08:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1058.773903][T16516] ref_ctr_offset mismatch. inode: 0x3da9 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1058.832501][ T26] audit: type=1804 audit(1589065720.921:1933): pid=16513 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2241/bus/file0" dev="overlay" ino=15757 res=1 23:08:40 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{0x0, 0xfc00}], 0x1, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:41 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000200000000000000003e"]) 23:08:41 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1058.933454][ T26] audit: type=1804 audit(1589065720.971:1934): pid=16521 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2241/bus/bus/file0" dev="overlay" ino=15921 res=1 [ 1059.161518][ T26] audit: type=1804 audit(1589065721.251:1935): pid=16530 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2242/bus/file0" dev="overlay" ino=15812 res=1 [ 1059.213340][T16530] overlayfs: failed to resolve './file0': -2 23:08:41 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:41 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x4c000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:41 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:41 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000300000000000000003e"]) [ 1059.479897][T16539] overlayfs: failed to resolve './file1': -2 [ 1059.511532][T16537] ref_ctr_offset mismatch. inode: 0x3d9b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:41 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1059.542958][ T26] audit: type=1804 audit(1589065721.631:1936): pid=16538 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2243/bus/file0" dev="overlay" ino=15764 res=1 [ 1059.596560][T16538] overlayfs: './file0' not a directory 23:08:41 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000400000000000000003e"]) [ 1059.649486][ T26] audit: type=1804 audit(1589065721.701:1937): pid=16541 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2243/bus/bus/file0" dev="overlay" ino=15705 res=1 23:08:41 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="6c2c776f726b6469723d2a2f66696c65311175707065726469723d2e2f66696c6530000000000000000000000000009d52fda5e81de0dc1b6da211db9b4660209a9e9e0a084a136de6bc072c59d3d6ce16a8ecb81c5d3ccaf27d08be9d4f5f310384384d878d17add1861670f4713f174e3a9e8fc4411853a4102170"]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = fcntl$dupfd(r4, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = syz_genetlink_get_family_id$net_dm(&(0x7f00000000c0)='NET_DM\x00') sendmsg$NET_DM_CMD_START(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0x14, r6, 0x0, 0x70bd25, 0x25dfdbfd, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000040}, 0x810) sendmsg$NET_DM_CMD_START(r5, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r6, 0x1, 0x70bd28, 0x25dfdc00, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20048000}, 0x4004004) sendmsg$NET_DM_CMD_START(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, r6, 0x400, 0x70bd2d, 0x25dfdbfd, {}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000011) setuid(0x0) [ 1059.779097][T16548] overlayfs: failed to resolve './file1': -2 [ 1059.817171][T16550] overlayfs: unrecognized mount option "l" or missing value 23:08:41 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{0x0, 0xfc00}], 0x1, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) [ 1059.825152][T16547] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:08:41 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x60000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:42 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1059.888964][ T26] audit: type=1804 audit(1589065721.971:1938): pid=16550 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1815/bus/file0" dev="sda1" ino=15757 res=1 [ 1059.999574][ T26] audit: type=1804 audit(1589065722.081:1939): pid=16557 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2244/bus/file0" dev="overlay" ino=15906 res=1 [ 1060.021569][T16557] overlayfs: './file0' not a directory 23:08:42 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setgid(r1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r2, 0x0, r2) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000a40)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private1}, 0x0, @in6=@remote}}, &(0x7f0000000b40)=0xe8) io_setup(0x7, &(0x7f0000000c40)=0x0) io_getevents(r4, 0x2, 0x5, &(0x7f0000000c80)=[{}, {}, {}, {}, {}], &(0x7f0000000d40)) syz_mount_image$exfat(&(0x7f00000000c0)='exfat\x00', &(0x7f0000000140)='./file0\x00', 0x67d4b750, 0xa, &(0x7f0000000940)=[{&(0x7f0000000300)="3d4398c8229d5e4d536936ea4ff57fc904c87dccd580346d1d12577d2234d20846cd78d461ee041631bc2433990c53b4da9d791f7b63eca1284d571866814befb71440e54dd4fb9b0895f9a40b275397bd9c419a6da43680d15b6f94e62128e6d5c5b5f434e0a2df4e062d06a50b2b44ceff88516e9d5c13a42329c00e26e9b982ae3e087182fa36c3a82268c4165cc2db179f9327a55453cea50f23bd34e1a08da78a6783564d1721aaca8517c8666cc17a048f018c92423dcedfed77bd79bed3221eea27419a33aeafe2c36f9aead1d28cb7e73cd62fa985b9b9add40f5797f4a275b32339af61e62321c9a659aaab", 0xf0, 0x3}, {&(0x7f0000000400)="ecc30c4ae92027af05cc5aad5fd48acd4abb06e2e4319dfc4e895dd30d7ae869c506942348e3b1814f281dbaf4020bf9d6f854259d7aaddaaa446bd009afd408ff7624441d0e5f4024461b8ce5331b290c9d7122cd4de850b5986b55cd4cc77cddec6a7027f99646cd796073e6bd48685c9389def22a016913a0853838bb46c15942", 0x82, 0x6}, {&(0x7f00000001c0)="8cfafebe", 0x4, 0xffffffff00000000}, {&(0x7f00000004c0)="b52546a9a3c83bc24841d3a3a6089219bf9261cbee600f3a265a0959f894d9ab79b90324276503a876cf718ce77449fa45298e61569ae77bcd2a59dbe2a9aff5220d6bda3f546b67e323c4199aff5ada83080262bc96c3886a21176f66448f122d1f0819bf4fc811f54db4e4c809e78635c519d389c2", 0x76, 0x8}, {&(0x7f0000000540)="55f26b3b1ceb8861d9b8a7609b6164f29a008edac641076591abca479bc98bcd71d070c92f20af342be8734a102533f3b461bbc52e4f548c4024b97397eee7402b0ce76c9e7b3b51039f0c2e9dcbbddd677cf9d88df83033786bab14cf472354c01d78604a96f72c4967f2b5856eeb060027fc0aafe118599926bf5df21667c3b9eb4e6220a206197a224628f2c52ec061cfd5666c39868ef19c375e50d6cd48b130e5b07c2fa2665b05", 0xaa, 0x3}, {&(0x7f0000000600)="b601914e7fb8195c45a588c5d59e928d7f753f142816b2c538448f724e829bf1d098afa5bbaae2b0d6669ea7cce7815e16b69d5f20a2f6e33b18dc38c72693237870b2bac6938143a6152816f77f69e0d14df3f7401e638b4fa3713f70654f22126b2a0e3f0a73881b52da0f4b43286134ea60ac53f9efa168da73cc558238a2802707bdd29562576498d5313346fc990e0c67f6a737c974e1a6a537a439d06152bcec38f9289b258d6c57e9a3ada10e05784761eacc3dae60d5711b646b6b38719fc7886851eb2e5560c8adda938880ad02a74e1ab122096e2ebed3165a84", 0xdf, 0x1}, {&(0x7f0000000200)="eb4d964c53c664e8fc0e491f8afed78f54dbb818144bba47f4424876b32adda38924a46da24f81936b18e01f1531d3", 0x2f, 0x200}, {&(0x7f0000000700)="7e8d3bc57acc0e27d50c4c02bc671a4ad1246885bef54e5f721e731ea7714b72f01478d549fe2b0f02051e6172e592bfbb6ccef12ab5dfeef884ec1ce599a3dff3b3da1776825896b84a071cceca1a530ffe18357996e87e5edff0ff769f29e543823bb8f3620f0f8fb229d3fb8b3bbbc6c8b4ae4710d791e52a6959e58a16fc4fe42044d281c930fadaa3e2482b994f8ec2cc8dd9d8c15b0253cced07b84e9548a29ddf3f89694f5ee878a8703aa631dc3ba83bcfe8389c7cd3a29f71eee0cd48e93c7231f6a2a7f146c2e1c6adba578691b886cbefe58d328a5ac4e91e834150790722ac832e0b08bf87cde75c6e0f0712baa8c1", 0xf5, 0x2}, {&(0x7f0000000800)="f2103a87949215eacff6492d51179400f9163218af6adc9ee51cd228a1f85375f58296daaba0f9cef1f87cdd500e55d26e7d3e932420fa285278a1916a074bd959285e809e716e5f40aa6ef84a3e2a74e1bb38356c72291a2b", 0x59, 0x6}, {&(0x7f0000000880)="8e1d4db544df97c8da3540cb2f35458ea64386aa445939d818140405f3cbcb060cc2b1cede3f3866680da358d58b40916fdc097fdd2032143b129f2dbc4a7d1421b991e872a02ef69c18e234e41da6a7fd52fc76f77c8cfd8c928258f0c6c2ec74c5bcded35d63b0f8a17d9bf3e06c77d1a534dd6757f6a469d82d6c1cd3ed68196be68bb8d84da5bec51780b3bff6b1ae8dcc255055f1", 0x97, 0x7ff}], 0x8801, &(0x7f0000000b80)={[{@uid={'uid'}}, {@namecase='namecase=1'}, {@gid={'gid', 0x3d, r1}}, {@allow_utime={'allow_utime', 0x3d, 0x4}}, {@errors_remount='errors=remount-ro'}, {@dmask={'dmask', 0x3d, 0x3}}, {@utf8='utf8'}], [{@euid_eq={'euid', 0x3d, r3}}, {@fsname={'fsname', 0x3d, '@-\x9d'}}]}) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0x2, 0x0) [ 1060.091725][T16560] ref_ctr_offset mismatch. inode: 0x3e91 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1060.117382][ T26] audit: type=1804 audit(1589065722.141:1940): pid=16567 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2244/bus/bus/file0" dev="overlay" ino=15986 res=1 23:08:42 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000500000000000000003e"]) [ 1060.147586][T16568] overlayfs: failed to resolve './file1': -2 [ 1060.175361][T16566] ref_ctr_offset mismatch. inode: 0x3e91 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1060.305031][T16571] exfat: Unknown parameter 'namecase' [ 1060.388282][T16575] overlayfs: './file0' not a directory [ 1060.395952][T16578] exfat: Unknown parameter 'namecase' 23:08:42 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:42 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x68000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:42 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:42 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000600000000000000003e"]) 23:08:42 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6c6f0100008069723d2ec1f5757301006f69723d2e2f6f696c65312c75707065726469663d2e2f66696c6530000000"]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f00000000c0)='./file0\x00', 0x141042, 0xa600ac4159d31e) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) perf_event_open$cgroup(&(0x7f00000001c0)={0x2, 0x70, 0x1, 0x2, 0x8, 0x1, 0x0, 0x2, 0x50201, 0x3, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x2, @perf_config_ext={0x0, 0x8001}, 0x8000, 0x0, 0x4, 0x5, 0x9b, 0x800, 0x1}, 0xffffffffffffffff, 0xf, r2, 0x3) [ 1060.578641][T16588] ref_ctr_offset mismatch. inode: 0x3d83 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1060.591959][T16589] overlayfs: failed to resolve './file1': -2 23:08:42 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1060.711360][T16594] ref_ctr_offset mismatch. inode: 0x3d83 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1060.729874][T16593] overlayfs: './file0' not a directory 23:08:42 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{0x0, 0xfc00}], 0x1, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:42 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00>']) [ 1060.830209][T16601] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1060.856884][T16602] overlayfs: unrecognized mount option "lo" or missing value 23:08:42 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x6c000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1060.877495][T16604] overlayfs: failed to resolve './file1': -2 23:08:43 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:43 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) mount$overlay(0x400000, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000080)='overlay\x00', 0x835420, &(0x7f0000000100)=ANY=[@ANYRES32=r1]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r2, 0x2, 0x0) [ 1061.051343][T16612] ref_ctr_offset mismatch. inode: 0x3da5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1061.168385][T16617] overlayfs: failed to resolve './file1': -2 [ 1061.168578][T16614] overlayfs: './file0' not a directory 23:08:43 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00>']) 23:08:43 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1061.212332][T16618] ref_ctr_offset mismatch. inode: 0x3da5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:43 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x74000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1061.441258][T16629] ref_ctr_offset mismatch. inode: 0x3dc5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:43 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:43 executing program 2: semtimedop(0x0, &(0x7f0000000140)=[{}, {}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000300)=""/159) 23:08:43 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1061.526042][T16630] overlayfs: './file0' not a directory [ 1061.546292][T16632] ref_ctr_offset mismatch. inode: 0x3dc5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:43 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000cc00000000000000003e"]) 23:08:43 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, 0x0) 23:08:43 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x7a000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:43 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:43 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) [ 1061.844848][T16646] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1061.859423][T16646] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1061.877530][T16654] ref_ctr_offset mismatch. inode: 0x3db7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1061.893700][T16646] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1061.972244][T16646] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 23:08:44 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000003000000000000003e"]) [ 1062.034000][T16646] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1062.082049][T16646] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.099983][T16646] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1062.116524][T16663] overlayfs: failed to resolve './file0': -2 [ 1062.122079][T16646] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.147689][T16646] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1062.167316][T16646] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.180124][T16646] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 23:08:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1062.198562][T16646] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1062.224662][T16655] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1062.277396][T16665] ref_ctr_offset mismatch. inode: 0x3db7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:44 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x8cffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1062.391951][T16657] netlink: 'syz-executor.2': attribute type 18 has an invalid length. [ 1062.417845][T16668] overlayfs: failed to resolve './file0': -2 [ 1062.506128][T16669] overlayfs: './file0' not a directory 23:08:44 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:44 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000005000000000000003e"]) [ 1062.614356][T16678] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:44 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, 0x0) 23:08:44 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) shmctl$IPC_RMID(r0, 0x0) shmctl$IPC_RMID(r0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) [ 1062.665563][T16679] overlayfs: failed to resolve './file0': -2 23:08:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:44 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xf0ffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1062.940166][T16692] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1062.967250][T16687] overlayfs: failed to resolve './file0': -2 23:08:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:45 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000006000000000000003e"]) 23:08:45 executing program 2: mkdir(&(0x7f0000000240)='./bus\x00', 0xa6) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="6c6f7765726469723d2e2f6275732c776fb191c8bd4bb93ea7c40e8c6a7659c4726b6469723d2e2f07696c65312c7570706572646968b32e2f66696c6530e962c9bf8156559d49c95370a7d9b33a256dbd0947718be95f508ab1c939519c6597b46f191610507140d54c182de4887c8df29a62f9ca3428bf50c2f309abaa0753424edce31a86f34adf5f05c7330b55b2340717b28cbd2335d6ffd84233b0d45b5f66fec42096f9219e6706"]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x2c, r4, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) sendfile(r2, r3, 0x0, 0x1) r5 = getpid() sched_setscheduler(r5, 0x5, &(0x7f0000000040)) r6 = getpid() sched_setscheduler(r6, 0x5, &(0x7f0000000040)) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) kcmp(r5, r6, 0x6, r0, r7) [ 1063.104058][T16699] ref_ctr_offset mismatch. inode: 0x3e26 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1063.175520][T16699] ref_ctr_offset mismatch. inode: 0x3e26 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:45 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xf6ffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1063.320731][T16705] overlayfs: unrecognized mount option "wo±‘ȽK¹>§ÄŒjvYÄrkdir=./ile1" or missing value [ 1063.407193][ T26] kauditd_printk_skb: 22 callbacks suppressed [ 1063.407208][ T26] audit: type=1804 audit(1589065725.491:1963): pid=16706 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2252/bus/file0" dev="overlay" ino=15825 res=1 [ 1063.435428][T16706] overlayfs: './file0' not a directory [ 1063.455742][T16713] ref_ctr_offset mismatch. inode: 0x3dd4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1063.531800][ T26] audit: type=1804 audit(1589065725.541:1964): pid=16712 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2252/bus/bus/file0" dev="overlay" ino=15890 res=1 [ 1063.561148][T16713] ref_ctr_offset mismatch. inode: 0x3dd4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:45 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:45 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00>']) 23:08:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:45 executing program 4: semtimedop(0x0, &(0x7f0000000140)=[{}, {0x0, 0xfc00}], 0x2, 0x0) semctl$GETALL(0x0, 0x0, 0xd, 0x0) 23:08:45 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xffffff7f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1063.835358][ T26] audit: type=1804 audit(1589065725.921:1965): pid=16720 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2253/bus/file0" dev="overlay" ino=15826 res=1 [ 1063.889450][T16729] ref_ctr_offset mismatch. inode: 0x3dd3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1063.893034][T16728] overlayfs: './file0' not a directory 23:08:46 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x7fff}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) 23:08:46 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000ffcc000000000000003e"]) [ 1063.947790][ T26] audit: type=1804 audit(1589065726.031:1966): pid=16731 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1936/bus/file0" dev="overlay" ino=15739 res=1 [ 1063.984084][T16729] ref_ctr_offset mismatch. inode: 0x3dd3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:46 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xffffff8c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1064.246854][ T26] audit: type=1804 audit(1589065726.331:1967): pid=16738 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1823/bus/file0" dev="overlay" ino=15740 res=1 [ 1064.254871][T16740] ref_ctr_offset mismatch. inode: 0x3d92 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:46 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x7fff}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) 23:08:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1064.390696][ T26] audit: type=1804 audit(1589065726.461:1968): pid=16742 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2254/bus/file0" dev="overlay" ino=15875 res=1 [ 1064.403383][T16748] overlayfs: './file0' not a directory [ 1064.495505][ T26] audit: type=1804 audit(1589065726.521:1969): pid=16749 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2254/bus/bus/file0" dev="overlay" ino=15751 res=1 [ 1064.575080][T16752] overlayfs: missing 'lowerdir' 23:08:46 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:46 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ff000000000000003e"]) 23:08:46 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xfffffff0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000ff0000000000000000003e"]) 23:08:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1064.735667][ T26] audit: type=1804 audit(1589065726.821:1970): pid=16753 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1824/bus/file0" dev="overlay" ino=15750 res=1 [ 1064.802792][T16760] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1064.847058][T16761] overlayfs: missing 'lowerdir' 23:08:47 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x7fff}}}, 0x90) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) [ 1064.900558][ T26] audit: type=1804 audit(1589065726.991:1971): pid=16758 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir132443096/syzkaller.m0zGRj/2078/bus/file0" dev="overlay" ino=15841 res=1 [ 1064.935308][T16760] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:47 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1064.994073][T16764] overlayfs: './file0' not a directory 23:08:47 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/bluetooth/6lowpan_enable\x00', 0x2, 0x0) sendfile(r0, r1, 0x0, 0x4000000fffd) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1065.037216][ T26] audit: type=1804 audit(1589065727.051:1972): pid=16764 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2255/bus/file0" dev="overlay" ino=15891 res=1 23:08:47 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:47 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000ccff000000000000003e"]) [ 1065.223948][T16773] overlayfs: missing 'lowerdir' [ 1065.308903][T16778] ref_ctr_offset mismatch. inode: 0x3d8c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:47 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:47 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r2, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x0, 0x0, 0x7fff}}}, 0x90) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) [ 1065.369446][T16778] ref_ctr_offset mismatch. inode: 0x3d8c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1065.556354][T16783] overlayfs: missing 'lowerdir' [ 1065.558836][T16781] overlayfs: './file0' not a directory 23:08:47 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:47 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x1000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:47 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) ioctl$VT_SETMODE(r0, 0x5602, &(0x7f00000000c0)={0x1, 0x6, 0x1ff, 0x1, 0x8}) 23:08:47 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000100000000003e"]) 23:08:47 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:47 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000340)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400), r2}}, 0x18) [ 1065.813408][T16793] overlayfs: missing 'lowerdir' [ 1065.841511][T16796] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1065.973727][T16796] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:48 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x22) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) [ 1066.085630][T16801] overlayfs: failed to resolve './bus': -2 [ 1066.096871][T16798] overlayfs: './file0' not a directory 23:08:48 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x100000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:48 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1066.172311][T16810] overlayfs: missing 'lowerdir' 23:08:48 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000200000000003e"]) 23:08:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1066.322731][T16813] ref_ctr_offset mismatch. inode: 0x3d86 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1066.409071][T16818] overlayfs: missing 'lowerdir' [ 1066.414250][T16819] ref_ctr_offset mismatch. inode: 0x3d86 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1066.595172][T16822] overlayfs: './file0' not a directory 23:08:48 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) splice(r2, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:48 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_GET_LAPIC(r2, 0x8400ae8e, &(0x7f0000000400)={"428e62048ac98d1b032d0d42504040f7529c7077c173e4e59d826f2000d0d8158109155801b1985914da932cd64a7a274cb00114e451255bf464aa27122a5be71a8e168115084fa195e5e4f20c397c511a21e584300d03b0df7c8b795e1bce4543211d1acf555bd29cfa1fd545e0904ddadb7338cf07f3a5a2d3d3b4f2781623c45f9cfbf58435121d403b7ea990b9301d89f313c271b8acaf14c834c4eb76e7d6d8d6612aca47267af4522bf1e53983ca775e05b5275f1b0accf5d70a24a44e54e681cf47ef46439e03918ec8ba18bdddc0a069335512270050dbf5470d52bde22858195abc1359df33de1096c9eefc043616d81d0724d206ef57585bddf5fd46254c628e38b203123351929fff4a6f0d0f475adc683a27f6dd2cf869a9a1106ad694c5b4605c4d5bb4e6e6a0084dd4d04fbb69766741f5e4452e529cbc93799e0bb175722748ead93eeba2adf2a62c1f582d3bd8b8e9672364733c21ee7d3ef67e35234ba6d6751171e724c4d673aeff6df4146a25202f1ce28e554703012f6c4187b016077828a2c1d3f805c98029d9ceead18bb1298bd87476be2d9539aa08f15ae0f08e6e7dcb98f3944e689913b70504fc7f0793ffea9052642f0e0519674a4e1de1c49e23f80651631ad2c382b79eff0d6be139d30d9a377487e5136c9dbfb46d9aaf74654df0dd5cd3f9fa0934ed1597f25d40247a2dcda6b16f5f79a3d22b95cbec141f6382bac8f2bf61e81a1c88bae59e51ca72433d05eb38f15a6aaccb902cb5e86c5bf65c3a7eb63b4a89eb5cac674ec6865dc91492463d4d1099117f24b333d70248d9ed629ec66fbf233622418c3991f5169586f431ef5ee9bb825cb80466d4ed9530a7c37d62e6cfda66f5f6972f8b73f88091e7f59decf5b814c6f6c5027f3409b00e649fc12b4ee06e556c013c636d8d4de8e52261b19ab8f05000d9da53bf70bc6682f8a9e753cbed758aedf33f4ef9571151b01caedc35d41fd451dada2ff90a659744c05ce0f4db821d25d46940f7cbba43db31f588e2539af592a0f357134819e104401631f691d376df525b247a1525a2484ae1d0e20a4f40623a84bb19cc59be8bebf22af002d7e1bc2b071fec5959c4ed970eb5cf9cebcfaa2ce2efce04d105c004f6cf1b0b16fee53fdde9bd36eca348d0741d72e204b6697aa8a5b93cd9ab5b343a5147afe99d2cd806def19f31493f94c4b6e56f99b0793f3ca328682825f47c5e6bf903dc39203e8dcbcbc128106d1f7251a66f2caa57f37de727de6732ef4272bd44737d3d5d06f7647a3802ab21333aca5992e3c8934a273dac78f095d8c98ed1f3e52b28b8c3427624e4f9887075e8ddd20111c130c36850bfe07bd52823cbad4929e88af9720af612875fad9b46f0c9227c8b99259efd0c01cac3c00d5c5acf56cd2525a6bc2bcccb890746773eeb1e"}) 23:08:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:48 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x200000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:48 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:48 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000300000000003e"]) [ 1066.838447][T16832] overlayfs: missing 'lowerdir' [ 1066.860822][T16831] ref_ctr_offset mismatch. inode: 0x3d94 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:49 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1067.025940][T16837] overlayfs: './file0' not a directory [ 1067.032691][T16839] ref_ctr_offset mismatch. inode: 0x3d94 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:49 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000400000000003e"]) 23:08:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="ffffffffffffffcc"]) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvmsg$can_bcm(r2, &(0x7f00000000c0)={&(0x7f00000001c0)=@alg, 0x80, &(0x7f0000003500)=[{&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/199, 0xc7}, {&(0x7f0000000300)=""/162, 0xa2}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/4096, 0x1000}], 0x5, &(0x7f0000003580)=""/206, 0xce}, 0x141) [ 1067.173515][T16844] overlayfs: missing 'lowerdir' 23:08:49 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x300000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1067.415349][T16852] ref_ctr_offset mismatch. inode: 0x3da8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1067.440055][T16856] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1067.458261][T16856] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1067.525526][T16854] overlayfs: failed to resolve './file0': -2 [ 1067.540599][T16857] ref_ctr_offset mismatch. inode: 0x3da8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:49 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) splice(r2, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:49 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:49 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000500000000003e"]) 23:08:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) sendto(r0, &(0x7f00000001c0)="78a71f8060d1638e2d419716c69329342f4ac4207d9d94d1f46fae4d1e173fb6d19e4372f8c40429500fbeb782473e66819a187de497b4ebc54d2471e22c5eb14ecbadf51d20c77f2f787b36bdd2301400b0c79bdae3bd93af592688570e", 0x5e, 0x8004, &(0x7f0000000300)=@ax25={{0x3, @bcast, 0x7}, [@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x80) 23:08:49 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1067.891510][T16868] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1067.908794][T16868] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1067.910565][T16867] ref_ctr_offset mismatch. inode: 0x3d85 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:50 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1068.047903][T16877] ref_ctr_offset mismatch. inode: 0x3d85 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:50 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:50 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000600000000003e"]) 23:08:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:50 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x500000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1068.247930][T16882] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1068.290944][T16882] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 23:08:50 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1068.460680][T16889] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1068.472611][ T26] kauditd_printk_skb: 27 callbacks suppressed [ 1068.472626][ T26] audit: type=1804 audit(1589065730.562:2000): pid=16888 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2262/bus/file0" dev="overlay" ino=15743 res=1 [ 1068.522854][T16888] overlayfs: './file0' not a directory [ 1068.589055][ T26] audit: type=1804 audit(1589065730.662:2001): pid=16891 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir132443096/syzkaller.m0zGRj/2085/bus/file0" dev="overlay" ino=15847 res=1 [ 1068.620651][T16889] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0xfffffff6 23:08:50 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) splice(r2, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:50 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:50 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00>']) 23:08:50 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:50 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x600000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1068.894342][T16903] overlayfs: unrecognized mount option "upper" or missing value 23:08:51 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1069.010594][T16907] ref_ctr_offset mismatch. inode: 0x3dc8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1069.029598][ T26] audit: type=1804 audit(1589065731.122:2002): pid=16905 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir132443096/syzkaller.m0zGRj/2086/bus/file0" dev="overlay" ino=15736 res=1 23:08:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1069.062386][T16906] overlayfs: './file0' not a directory [ 1069.110675][T16910] ref_ctr_offset mismatch. inode: 0x3dc8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:51 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:51 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00>']) [ 1069.148379][ T26] audit: type=1804 audit(1589065731.132:2003): pid=16906 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2263/bus/file0" dev="overlay" ino=15851 res=1 [ 1069.234783][T16915] overlayfs: unrecognized mount option "upper" or missing value 23:08:51 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x700000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1069.268205][ T26] audit: type=1804 audit(1589065731.182:2004): pid=16909 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2263/bus/bus/file0" dev="overlay" ino=15748 res=1 23:08:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1069.435326][ T26] audit: type=1804 audit(1589065731.422:2005): pid=16918 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1941/bus/file0" dev="overlay" ino=15769 res=1 [ 1069.498103][T16927] ref_ctr_offset mismatch. inode: 0x3d8c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1069.584371][ T26] audit: type=1804 audit(1589065731.622:2006): pid=16921 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir132443096/syzkaller.m0zGRj/2087/bus/file0" dev="overlay" ino=15772 res=1 [ 1069.588053][T16930] overlayfs: unrecognized mount option "upper" or missing value [ 1069.681175][T16927] ref_ctr_offset mismatch. inode: 0x3d8c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1069.682565][ T26] audit: type=1804 audit(1589065731.642:2007): pid=16924 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2264/bus/file0" dev="sda1" ino=15834 res=1 [ 1069.754974][ T26] audit: type=1804 audit(1589065731.652:2008): pid=16931 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2264/bus/bus/file0" dev="sda1" ino=15858 res=1 [ 1069.789139][ T26] audit: type=1804 audit(1589065731.652:2009): pid=16929 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2264/bus/bus/file0" dev="sda1" ino=15858 res=1 23:08:52 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:52 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 23:08:52 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000ffffffcc00000000003e"]) 23:08:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:52 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1070.078577][T16944] overlayfs: workdir and upperdir must be separate subtrees [ 1070.080468][T16942] ref_ctr_offset mismatch. inode: 0x3e15 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1070.142582][T16941] overlayfs: './file0' not a directory 23:08:52 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1070.197151][T16951] ref_ctr_offset mismatch. inode: 0x3e15 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:52 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000fffffdfd00000000003e"]) 23:08:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) [ 1070.374935][T16955] overlayfs: workdir and upperdir must be separate subtrees 23:08:52 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x1000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1070.573828][T16961] overlayfs: './file0' not a directory [ 1070.630597][T16965] ref_ctr_offset mismatch. inode: 0x3e75 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1070.665824][T16968] overlayfs: workdir and upperdir must be separate subtrees [ 1070.761657][T16969] ref_ctr_offset mismatch. inode: 0x3e75 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:53 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:53 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:53 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:08:53 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000ff00000000003e"]) 23:08:53 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:53 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x1400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1071.158592][T16982] overlayfs: failed to resolve './fil': -2 [ 1071.160577][T16984] ref_ctr_offset mismatch. inode: 0x3dc2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:53 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1071.204411][T16980] overlayfs: './file0' not a directory 23:08:53 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000fdfdffff00000000003e"]) 23:08:53 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:53 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1071.362247][T16992] ref_ctr_offset mismatch. inode: 0x3dc2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:53 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:53 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x2000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1071.526377][T16996] overlayfs: failed to resolve './fil': -2 [ 1071.597768][T17001] overlayfs: failed to resolve './file0': -2 [ 1071.776036][T17009] ref_ctr_offset mismatch. inode: 0x3e84 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1071.863686][T17009] ref_ctr_offset mismatch. inode: 0x3e84 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:54 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:54 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:54 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:08:54 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000ccffffff00000000003e"]) 23:08:54 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x4000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1072.217706][T17021] overlayfs: failed to resolve './fil': -2 [ 1072.230078][T17020] ref_ctr_offset mismatch. inode: 0x3e05 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1072.243491][T17023] overlayfs: failed to resolve './file0': -2 23:08:54 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:54 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1072.306383][T17019] overlayfs: failed to resolve './file0': -2 23:08:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1072.362053][T17027] ref_ctr_offset mismatch. inode: 0x3e05 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:54 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000100003e"]) 23:08:54 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x4800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1072.503292][T17032] overlayfs: failed to resolve './file0': -2 [ 1072.517358][T17033] overlayfs: failed to resolve './file': -2 23:08:54 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1072.656877][T17037] ref_ctr_offset mismatch. inode: 0x3de6 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1072.729686][T17040] overlayfs: './file0' not a directory [ 1072.800231][T17047] ref_ctr_offset mismatch. inode: 0x3de6 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:55 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:55 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:08:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:55 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000001003e"]) 23:08:55 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:55 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x4c00000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:55 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:55 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1073.292720][T17063] overlayfs: failed to resolve './file': -2 [ 1073.321550][T17064] ref_ctr_offset mismatch. inode: 0x3e56 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1073.401599][T17065] overlayfs: './file0' not a directory [ 1073.405004][T17068] ref_ctr_offset mismatch. inode: 0x3e56 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:55 executing program 2: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:55 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000002003e"]) 23:08:55 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x6000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1073.596746][T17076] overlayfs: failed to resolve './file': -2 [ 1073.607062][ T26] kauditd_printk_skb: 19 callbacks suppressed [ 1073.607077][ T26] audit: type=1804 audit(1589065735.702:2029): pid=17075 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1945/bus/file0" dev="overlay" ino=15845 res=1 [ 1073.629147][T17079] overlayfs: failed to resolve './file1': -2 [ 1073.698954][T17082] ref_ctr_offset mismatch. inode: 0x3d49 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1073.800671][ T26] audit: type=1804 audit(1589065735.892:2030): pid=17088 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2272/bus/file0" dev="overlay" ino=15857 res=1 [ 1073.831375][T17082] ref_ctr_offset mismatch. inode: 0x3d49 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0xfffffff6 [ 1073.860055][T17089] overlayfs: './file0' not a directory [ 1073.889126][ T26] audit: type=1804 audit(1589065735.972:2031): pid=17089 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2272/bus/bus/file0" dev="overlay" ino=15906 res=1 23:08:56 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:56 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r1, 0xffffffffffffffff) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'gre0\x00', 0x4000}) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:08:56 executing program 2: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:56 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:56 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x6800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:56 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000003003e"]) [ 1074.286559][T17103] overlayfs: failed to resolve './file1': -2 [ 1074.320396][T17104] ref_ctr_offset mismatch. inode: 0x3dc6 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:56 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) dup2(r1, 0xffffffffffffffff) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1074.386305][ T26] audit: type=1804 audit(1589065736.472:2032): pid=17110 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2273/bus/file0" dev="overlay" ino=15781 res=1 [ 1074.403061][T17111] ref_ctr_offset mismatch. inode: 0x3dc6 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1074.430564][T17110] overlayfs: './file0' not a directory 23:08:56 executing program 2: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:56 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:56 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000004003e"]) [ 1074.550298][ T26] audit: type=1804 audit(1589065736.542:2033): pid=17110 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2273/bus/bus/file0" dev="overlay" ino=16040 res=1 [ 1074.629383][T17116] overlayfs: failed to resolve './file1': -2 23:08:56 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x6c00000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1074.670058][ T26] audit: type=1804 audit(1589065736.562:2034): pid=17112 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1946/bus/file0" dev="overlay" ino=16023 res=1 23:08:56 executing program 2: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1074.880276][T17126] ref_ctr_offset mismatch. inode: 0x3da3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1074.929633][ T26] audit: type=1804 audit(1589065737.012:2035): pid=17123 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2274/bus/file0" dev="overlay" ino=15749 res=1 [ 1074.986829][T17123] overlayfs: './file0' not a directory [ 1075.013168][T17130] overlayfs: failed to resolve './file1': -2 [ 1075.036297][ T26] audit: type=1804 audit(1589065737.092:2036): pid=17131 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2274/bus/bus/file0" dev="overlay" ino=15803 res=1 23:08:57 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:08:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:57 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000005003e"]) 23:08:57 executing program 2: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:57 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x7400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1075.313328][T17139] overlayfs: failed to resolve './file1': -2 23:08:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1075.401458][ T26] audit: type=1804 audit(1589065737.493:2037): pid=17142 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2275/bus/file0" dev="overlay" ino=15800 res=1 [ 1075.420720][T17142] overlayfs: './file0' not a directory [ 1075.442468][T17147] ref_ctr_offset mismatch. inode: 0x3de1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:57 executing program 2: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:57 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000006003e"]) [ 1075.531735][T17147] ref_ctr_offset mismatch. inode: 0x3de1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1075.541507][ T26] audit: type=1804 audit(1589065737.553:2038): pid=17148 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2275/bus/bus/file0" dev="overlay" ino=15762 res=1 23:08:57 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x7a00000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1075.702394][T17157] overlayfs: failed to resolve './file1': -2 [ 1075.878954][T17163] ref_ctr_offset mismatch. inode: 0x3dc7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1075.906562][T17161] overlayfs: './file0' not a directory [ 1075.961180][T17169] ref_ctr_offset mismatch. inode: 0x3dc7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:58 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:58 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:58 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:08:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:58 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00>']) 23:08:58 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x8cffffff00000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:58 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1076.299654][T17177] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:58 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1076.392248][T17180] overlayfs: './file0' not a directory [ 1076.450188][T17184] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:58 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00>']) 23:08:58 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xf0ffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:58 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1076.721300][T17195] ref_ctr_offset mismatch. inode: 0x3dd1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1076.830579][T17200] ref_ctr_offset mismatch. inode: 0x3dd1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1076.885706][T17198] overlayfs: failed to resolve './file0': -2 23:08:59 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:08:59 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:59 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:08:59 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xf6ffffff00000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:59 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000ffffffffffffffcc003e"]) [ 1077.324858][T17217] overlayfs: failed to resolve './file0': -2 [ 1077.327616][T17218] ref_ctr_offset mismatch. inode: 0x3db1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:08:59 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000fffffdfd003e"]) 23:08:59 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:08:59 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1077.520511][T17218] ref_ctr_offset mismatch. inode: 0x3db1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:08:59 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xffffff7f00000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:08:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1077.657759][T17229] overlayfs: failed to resolve './file0': -2 [ 1077.790167][T17236] ref_ctr_offset mismatch. inode: 0x3da3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:00 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:00 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:00 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:00 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:00 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000ff003e"]) 23:09:00 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xffffffff00000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1078.370229][T17258] overlayfs: failed to resolve './file0': -2 [ 1078.409914][T17259] ref_ctr_offset mismatch. inode: 0x3dd8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:00 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:00 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1078.479362][T17260] overlayfs: './file0' not a directory 23:09:00 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1078.560078][T17266] ref_ctr_offset mismatch. inode: 0x3dd8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:00 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000ccffffffffffffff003e"]) 23:09:00 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0xfffffffffffffff0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1078.670762][ T26] kauditd_printk_skb: 14 callbacks suppressed [ 1078.670780][ T26] audit: type=1804 audit(1589065740.763:2053): pid=17268 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1950/bus/file0" dev="overlay" ino=15743 res=1 23:09:00 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1078.833727][T17277] ref_ctr_offset mismatch. inode: 0x3d95 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1078.954613][ T26] audit: type=1804 audit(1589065741.043:2054): pid=17278 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2282/bus/file0" dev="overlay" ino=15766 res=1 [ 1079.006057][T17278] overlayfs: './file0' not a directory [ 1079.093115][ T26] audit: type=1804 audit(1589065741.113:2055): pid=17284 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2282/bus/bus/file0" dev="overlay" ino=15740 res=1 23:09:01 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:01 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:01 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000002000000000000003e"]) 23:09:01 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:01 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:01 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1079.439487][T17293] ref_ctr_offset mismatch. inode: 0x3daf offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1079.469046][ T26] audit: type=1804 audit(1589065741.553:2056): pid=17295 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2283/bus/file0" dev="overlay" ino=15889 res=1 [ 1079.500288][T17295] overlayfs: './file0' not a directory 23:09:01 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:01 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:01 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1079.583338][ T26] audit: type=1804 audit(1589065741.623:2057): pid=17301 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2283/bus/bus/file0" dev="overlay" ino=15908 res=1 23:09:01 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000003000000000000003e"]) 23:09:01 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1079.779227][ T26] audit: type=1804 audit(1589065741.863:2058): pid=17307 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1951/bus/file0" dev="overlay" ino=15749 res=1 23:09:01 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1079.846726][T17312] overlayfs: failed to resolve './file0': -2 23:09:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1079.989424][T17320] ref_ctr_offset mismatch. inode: 0x3d9b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1080.001642][ T26] audit: type=1804 audit(1589065742.083:2059): pid=17316 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2284/bus/file0" dev="overlay" ino=15743 res=1 [ 1080.024463][T17316] overlayfs: './file0' not a directory 23:09:02 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:02 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000004000000000000003e"]) [ 1080.123449][ T26] audit: type=1804 audit(1589065742.163:2060): pid=17325 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2284/bus/bus/file0" dev="overlay" ino=15779 res=1 [ 1080.141043][T17326] overlayfs: failed to resolve './file0': -2 23:09:02 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:02 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {0x0}}, 0x18) 23:09:02 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1080.478470][ T26] audit: type=1804 audit(1589065742.563:2061): pid=17336 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2285/bus/file0" dev="overlay" ino=15736 res=1 [ 1080.539648][T17339] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1080.559287][T17340] overlayfs: failed to resolve './file0': -2 23:09:02 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000005000000000000003e"]) [ 1080.606671][ T26] audit: type=1804 audit(1589065742.623:2062): pid=17345 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2285/bus/bus/file0" dev="overlay" ino=15748 res=1 [ 1080.662306][T17351] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:02 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:02 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1081.032915][T17362] overlayfs: './file0' not a directory [ 1081.044275][T17368] ref_ctr_offset mismatch. inode: 0x3ed1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:03 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000006000000000000003e"]) [ 1081.111005][T17367] overlayfs: missing 'lowerdir' [ 1081.180778][T17368] ref_ctr_offset mismatch. inode: 0x3ed1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:03 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:03 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:03 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:03 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1081.425745][T17373] overlayfs: failed to resolve './file0': -2 23:09:03 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00>']) 23:09:03 executing program 4: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1081.567472][T17385] overlayfs: missing 'lowerdir' [ 1081.590865][T17384] ref_ctr_offset mismatch. inode: 0x3e13 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:03 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:03 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1081.738915][T17389] ref_ctr_offset mismatch. inode: 0x3e13 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1081.757644][T17391] overlayfs: failed to resolve './file1': -2 23:09:03 executing program 4: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:04 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1081.927763][T17394] overlayfs: failed to resolve './file0': -2 [ 1081.945108][T17398] overlayfs: missing 'lowerdir' 23:09:04 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00>']) [ 1082.090450][T17405] overlayfs: failed to resolve './file1': -2 [ 1082.097625][T17406] ref_ctr_offset mismatch. inode: 0x3e91 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1082.238827][T17406] ref_ctr_offset mismatch. inode: 0x3e91 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1082.351153][T17410] overlayfs: './file0' not a directory 23:09:04 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:04 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:04 executing program 4: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:04 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) 23:09:04 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:04 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000cc000000000000003e"]) [ 1082.575515][T17422] overlayfs: failed to resolve './file1': -2 [ 1082.596999][T17423] overlayfs: missing 'lowerdir' 23:09:04 executing program 4: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1082.627428][T17424] ref_ctr_offset mismatch. inode: 0x3da0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1082.667638][T17421] overlayfs: './file0' not a directory 23:09:04 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) 23:09:04 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1082.746556][T17424] ref_ctr_offset mismatch. inode: 0x3da0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:04 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000030000000000003e"]) 23:09:05 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:05 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1082.876097][T17433] overlayfs: failed to resolve './file1': -2 23:09:05 executing program 4: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1082.993711][T17437] overlayfs: missing 'lowerdir' 23:09:05 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) [ 1083.075571][T17440] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:05 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:05 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1083.211709][T17446] overlayfs: failed to resolve './file1': -2 [ 1083.231648][T17448] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:05 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000050000000000003e"]) 23:09:05 executing program 4: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1083.324414][T17453] overlayfs: missing 'lowerdir' 23:09:05 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x14}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:05 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:05 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1083.513292][T17458] overlayfs: failed to resolve './file1': -2 23:09:05 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:05 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1083.621636][T17463] ref_ctr_offset mismatch. inode: 0x3d59 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1083.715473][T17466] overlayfs: failed to resolve './file0': -2 [ 1083.732555][T17469] overlayfs: missing 'lowerdir' [ 1083.741244][ T26] kauditd_printk_skb: 18 callbacks suppressed [ 1083.741259][ T26] audit: type=1804 audit(1589065745.833:2081): pid=17471 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2292/bus/bus/file0" dev="overlay" ino=15792 res=1 23:09:05 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:05 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000060000000000003e"]) 23:09:06 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:06 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x48}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:06 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1084.067446][T17486] overlayfs: missing 'lowerdir' [ 1084.075830][T17489] ref_ctr_offset mismatch. inode: 0x3db0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1084.095017][T17490] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1084.175203][ T26] audit: type=1804 audit(1589065746.263:2082): pid=17487 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2293/bus/file0" dev="overlay" ino=15806 res=1 23:09:06 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:06 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00>']) [ 1084.255368][T17495] ref_ctr_offset mismatch. inode: 0x3db0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1084.276545][ T26] audit: type=1804 audit(1589065746.323:2083): pid=17494 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2293/bus/bus/file0" dev="overlay" ino=15815 res=1 23:09:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1084.405004][T17500] overlayfs: missing 'lowerdir' 23:09:06 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1084.590467][T17507] overlayfs: failed to resolve './file0': -2 [ 1084.631733][ T26] audit: type=1804 audit(1589065746.724:2084): pid=17506 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2294/bus/file0" dev="overlay" ino=15689 res=1 [ 1084.653762][T17506] overlayfs: './file0' not a directory [ 1084.663095][T17510] ref_ctr_offset mismatch. inode: 0x3dc3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:06 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:06 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:06 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:06 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffcc0000000000003e"]) [ 1084.712856][ T26] audit: type=1804 audit(1589065746.764:2085): pid=17511 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2294/bus/bus/file0" dev="overlay" ino=15875 res=1 [ 1084.742228][T17510] ref_ctr_offset mismatch. inode: 0x3dc3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1084.833747][T17514] overlayfs: option "workdir=." is useless in a non-upper mount, ignore 23:09:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:07 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x60}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1084.887474][T17514] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1084.912259][T17519] overlayfs: failed to resolve './file0': -2 23:09:07 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:07 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1085.064560][ T26] audit: type=1804 audit(1589065747.154:2086): pid=17523 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2295/bus/file0" dev="overlay" ino=15972 res=1 [ 1085.091833][T17521] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1085.108381][T17523] overlayfs: './file0' not a directory [ 1085.129988][T17531] ref_ctr_offset mismatch. inode: 0x3d7a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1085.168536][ T26] audit: type=1804 audit(1589065747.214:2087): pid=17530 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2295/bus/bus/file0" dev="overlay" ino=15739 res=1 23:09:07 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000ff0000000000003e"]) [ 1085.226395][T17536] ref_ctr_offset mismatch. inode: 0x3d7a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1085.267566][T17537] overlayfs: failed to resolve './file0': -2 [ 1085.301454][T17538] overlayfs: option "workdir=." is useless in a non-upper mount, ignore 23:09:07 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1085.337405][T17538] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1085.539514][ T26] audit: type=1804 audit(1589065747.634:2088): pid=17545 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2296/bus/file0" dev="overlay" ino=15842 res=1 [ 1085.566748][T17545] overlayfs: './file0' not a directory [ 1085.644318][ T26] audit: type=1804 audit(1589065747.674:2089): pid=17548 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2296/bus/bus/file0" dev="overlay" ino=15890 res=1 23:09:07 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:07 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:07 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x68}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:07 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:07 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ccff0000000000003e"]) [ 1085.839317][T17559] overlayfs: failed to resolve './file0': -2 [ 1085.853664][T17558] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1085.859144][T17557] ref_ctr_offset mismatch. inode: 0x3dc3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1085.914539][T17558] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 23:09:08 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1085.942658][ T26] audit: type=1804 audit(1589065748.034:2090): pid=17560 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2297/bus/file0" dev="overlay" ino=15953 res=1 [ 1085.969932][T17560] overlayfs: './file0' not a directory 23:09:08 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1086.042097][T17566] ref_ctr_offset mismatch. inode: 0x3dc3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:08 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000001000000003e"]) [ 1086.147036][T17567] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1086.159493][T17570] overlayfs: failed to resolve './file0': -2 [ 1086.181118][T17571] overlayfs: unrecognized mount option "upper" or missing value 23:09:08 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1086.438944][T17581] ref_ctr_offset mismatch. inode: 0x3dad offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1086.453002][T17582] overlayfs: failed to resolve './file0': -2 [ 1086.497169][T17579] overlayfs: failed to resolve './file0': -2 23:09:08 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:08 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:08 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:08 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000002000000003e"]) 23:09:08 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x74}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1086.842874][T17596] overlayfs: unrecognized mount option "upper" or missing value [ 1086.919617][T17597] ref_ctr_offset mismatch. inode: 0x3dd5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:09 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1086.978998][T17598] overlayfs: './file0' not a directory 23:09:09 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:09 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000003000000003e"]) 23:09:09 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1087.170411][T17611] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:09 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7a}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1087.223993][T17612] overlayfs: unrecognized mount option "upper" or missing value [ 1087.398718][T17618] ref_ctr_offset mismatch. inode: 0x3d9f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1087.440278][T17620] overlayfs: './file0' not a directory 23:09:09 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:09 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:09 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:09 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:09 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000004000000003e"]) 23:09:09 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xf0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1087.878022][T17638] overlayfs: failed to resolve './file1': -2 [ 1087.915323][T17640] overlayfs: workdir and upperdir must be separate subtrees [ 1087.918626][T17637] ref_ctr_offset mismatch. inode: 0x3d92 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:10 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:10 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1088.001520][T17643] overlayfs: './file0' not a directory 23:09:10 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:10 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000005000000003e"]) [ 1088.078988][T17647] ref_ctr_offset mismatch. inode: 0x3d92 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1088.081871][T17649] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1088.140925][T17650] overlayfs: failed to resolve './file1': -2 23:09:10 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x300}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1088.183855][T17653] overlayfs: workdir and upperdir must be separate subtrees 23:09:10 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1088.358428][T17658] ref_ctr_offset mismatch. inode: 0x3d8d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1088.400392][T17663] overlayfs: failed to resolve './file1': -2 [ 1088.452965][T17662] overlayfs: './file0' not a directory [ 1088.478578][T17665] ref_ctr_offset mismatch. inode: 0x3d8d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:10 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:10 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:10 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:10 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:10 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000006000000003e"]) 23:09:10 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x500}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1088.854365][T17680] overlayfs: failed to resolve './file1': -2 [ 1088.861351][T17682] overlayfs: workdir and upperdir must be separate subtrees [ 1088.900490][T17684] ref_ctr_offset mismatch. inode: 0x3d9e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1088.937324][ T26] kauditd_printk_skb: 12 callbacks suppressed 23:09:11 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1088.937339][ T26] audit: type=1804 audit(1589065751.024:2103): pid=17683 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2303/bus/file0" dev="overlay" ino=15826 res=1 23:09:11 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:11 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1089.033114][T17691] ref_ctr_offset mismatch. inode: 0x3d9e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:11 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00>']) [ 1089.097569][ T26] audit: type=1804 audit(1589065751.104:2104): pid=17689 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2303/bus/bus/file0" dev="overlay" ino=15773 res=1 [ 1089.104466][T17692] overlayfs: failed to resolve './file1': -2 [ 1089.134231][T17693] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1089.231375][ T26] audit: type=1804 audit(1589065751.324:2105): pid=17697 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1962/bus/file0" dev="sda1" ino=15739 res=1 23:09:11 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x600}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:11 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1089.276030][T17699] overlayfs: failed to resolve './fil': -2 [ 1089.419576][T17704] ref_ctr_offset mismatch. inode: 0x3da8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1089.441323][ T26] audit: type=1804 audit(1589065751.534:2106): pid=17705 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2304/bus/file0" dev="overlay" ino=15749 res=1 [ 1089.442734][T17707] overlayfs: failed to resolve './file1': -2 [ 1089.492672][T17705] overlayfs: './file0' not a directory [ 1089.544458][T17712] ref_ctr_offset mismatch. inode: 0x3da8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1089.583111][ T26] audit: type=1804 audit(1589065751.614:2107): pid=17711 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2304/bus/bus/file0" dev="overlay" ino=15738 res=1 23:09:11 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:11 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:11 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:11 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:11 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00>']) 23:09:11 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x700}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:12 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1089.898576][T17720] ref_ctr_offset mismatch. inode: 0x3d9b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1089.915724][T17723] overlayfs: failed to resolve './fil': -2 23:09:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1089.968179][ T26] audit: type=1804 audit(1589065752.064:2108): pid=17721 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2305/bus/file0" dev="overlay" ino=15739 res=1 [ 1090.000904][T17725] overlayfs: './file0' not a directory 23:09:12 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1090.059382][T17729] ref_ctr_offset mismatch. inode: 0x3d9b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1090.081247][ T26] audit: type=1804 audit(1589065752.134:2109): pid=17728 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2305/bus/bus/file0" dev="overlay" ino=15844 res=1 23:09:12 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffcc000000003e"]) 23:09:12 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1090.183005][T17733] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:12 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x1400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1090.247327][ T26] audit: type=1804 audit(1589065752.334:2110): pid=17736 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1963/bus/file0" dev="overlay" ino=15749 res=1 [ 1090.260017][T17737] overlayfs: failed to resolve './fil': -2 [ 1090.438365][ T26] audit: type=1804 audit(1589065752.534:2111): pid=17745 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2306/bus/file0" dev="overlay" ino=15875 res=1 [ 1090.490440][T17743] ref_ctr_offset mismatch. inode: 0x3e14 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1090.517747][T17745] overlayfs: './file0' not a directory 23:09:12 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:12 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:12 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:12 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000fffffdfd000000003e"]) 23:09:12 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x2000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1090.950193][T17761] overlayfs: failed to resolve './file0': -2 [ 1090.963424][T17762] overlayfs: failed to resolve './file': -2 23:09:13 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1090.988683][ T26] audit: type=1804 audit(1589065753.074:2112): pid=17759 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2307/bus/file0" dev="overlay" ino=15758 res=1 [ 1091.013344][T17759] overlayfs: './file0' not a directory 23:09:13 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000ff000000003e"]) [ 1091.073405][T17765] ref_ctr_offset mismatch. inode: 0x3e12 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:13 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:13 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1091.196220][T17770] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1091.250256][T17772] ref_ctr_offset mismatch. inode: 0x3e12 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1091.298199][T17777] overlayfs: failed to resolve './file': -2 [ 1091.312995][T17778] overlayfs: failed to resolve './file0': -2 23:09:13 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:13 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1091.423381][T17780] overlayfs: './file0' not a directory [ 1091.572554][T17786] overlayfs: failed to resolve './file0': -2 [ 1091.610373][T17787] overlayfs: failed to resolve './file': -2 23:09:14 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:14 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:14 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000fdfdffff000000003e"]) 23:09:14 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:14 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:14 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1092.040037][T17797] ref_ctr_offset mismatch. inode: 0x3d7a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:14 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1092.109727][T17800] overlayfs: failed to resolve './file0': -2 23:09:14 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ccffffff000000003e"]) [ 1092.189939][T17807] ref_ctr_offset mismatch. inode: 0x3d7a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:14 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1092.250198][T17811] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:14 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1092.590898][T17827] ref_ctr_offset mismatch. inode: 0x3da2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1092.675430][T17829] ref_ctr_offset mismatch. inode: 0x3da2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:15 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, 0x0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:15 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:15 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:15 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:15 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000001003e"]) 23:09:15 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4c00}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1093.018052][T17841] ref_ctr_offset mismatch. inode: 0x3df3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:15 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1093.099829][T17844] overlayfs: failed to resolve './file0': -2 23:09:15 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:15 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1093.158020][T17851] ref_ctr_offset mismatch. inode: 0x3df3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:15 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000013e"]) 23:09:15 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:15 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1093.361679][T17859] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1093.511352][T17867] overlayfs: './file0' not a directory [ 1093.528036][T17869] ref_ctr_offset mismatch. inode: 0x3ea2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1093.628016][T17878] ref_ctr_offset mismatch. inode: 0x3ea2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:16 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000023e"]) 23:09:16 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:16 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:16 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:16 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, 0x0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:16 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1094.079105][T17889] ref_ctr_offset mismatch. inode: 0x3e11 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1094.100551][T17893] overlayfs: missing 'lowerdir' 23:09:16 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1094.190301][T17899] ref_ctr_offset mismatch. inode: 0x3e11 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1094.219367][ T26] kauditd_printk_skb: 14 callbacks suppressed 23:09:16 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:16 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1094.219384][ T26] audit: type=1804 audit(1589065756.315:2127): pid=17895 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2313/bus/file0" dev="overlay" ino=15791 res=1 [ 1094.291948][T17895] overlayfs: failed to resolve './file0': -2 23:09:16 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000033e"]) 23:09:16 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6c00}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1094.372984][ T26] audit: type=1804 audit(1589065756.405:2128): pid=17902 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2313/bus/bus/file0" dev="overlay" ino=15878 res=1 [ 1094.416244][T17907] overlayfs: missing 'lowerdir' [ 1094.422065][T17906] overlayfs: missing 'lowerdir' 23:09:16 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1094.463411][T17904] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:16 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1094.521177][ T26] audit: type=1804 audit(1589065756.615:2129): pid=17913 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1967/bus/file0" dev="sda1" ino=15860 res=1 [ 1094.614067][T17918] ref_ctr_offset mismatch. inode: 0x3dd7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:16 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) [ 1094.678799][T17920] overlayfs: missing 'lowerdir' [ 1094.759653][ T26] audit: type=1804 audit(1589065756.855:2130): pid=17922 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2314/bus/file0" dev="overlay" ino=15821 res=1 [ 1094.777917][T17925] overlayfs: missing 'lowerdir' [ 1094.803895][T17922] overlayfs: './file0' not a directory 23:09:16 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1094.884743][ T26] audit: type=1804 audit(1589065756.915:2131): pid=17927 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2314/bus/bus/file0" dev="overlay" ino=15809 res=1 [ 1095.033929][T17935] overlayfs: missing 'lowerdir' [ 1095.080841][T17936] overlayfs: missing 'lowerdir' 23:09:17 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, 0x0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:17 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:17 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000043e"]) 23:09:17 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1095.257909][T17941] ref_ctr_offset mismatch. inode: 0x3dc1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1095.268345][T17945] overlayfs: missing 'lowerdir' [ 1095.332383][ T26] audit: type=1804 audit(1589065757.425:2132): pid=17944 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2315/bus/file0" dev="overlay" ino=15752 res=1 23:09:17 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:17 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000053e"]) 23:09:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1095.460081][T17953] ref_ctr_offset mismatch. inode: 0x3dc1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1095.470603][ T26] audit: type=1804 audit(1589065757.455:2133): pid=17949 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2315/bus/bus/file0" dev="overlay" ino=15878 res=1 [ 1095.477056][T17951] overlayfs: missing 'lowerdir' [ 1095.560519][T17956] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:17 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7a00}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1095.634453][ T26] audit: type=1804 audit(1589065757.725:2134): pid=17959 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1968/bus/file0" dev="overlay" ino=15806 res=1 [ 1095.654806][T17960] overlayfs: missing 'lowerdir' 23:09:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1095.790528][ T26] audit: type=1804 audit(1589065757.885:2135): pid=17964 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2316/bus/file0" dev="overlay" ino=15843 res=1 [ 1095.834243][T17964] overlayfs: './file0' not a directory [ 1095.868016][T17966] ref_ctr_offset mismatch. inode: 0x3db4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1095.895502][ T26] audit: type=1804 audit(1589065757.955:2136): pid=17969 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2316/bus/bus/file0" dev="overlay" ino=15776 res=1 [ 1095.949418][T17971] overlayfs: missing 'lowerdir' [ 1095.990599][T17973] overlayfs: missing 'lowerdir' [ 1095.994386][T17974] ref_ctr_offset mismatch. inode: 0x3db4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:18 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:18 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:18 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000063e"]) 23:09:18 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:18 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xf0ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1096.265997][T17982] overlayfs: missing 'lowerdir' [ 1096.329996][T17985] overlayfs: missing 'lowerdir' 23:09:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1096.363371][T17981] overlayfs: './file0' not a directory [ 1096.396644][T17990] ref_ctr_offset mismatch. inode: 0x3de9 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:18 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:18 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:18 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a>']) [ 1096.491375][T17990] ref_ctr_offset mismatch. inode: 0x3de9 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1096.560041][T17995] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:18 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xfff0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1096.645652][T17999] overlayfs: missing 'lowerdir' [ 1096.655421][T18001] overlayfs: missing 'lowerdir' 23:09:18 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1096.833242][T18008] ref_ctr_offset mismatch. inode: 0x3d49 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1096.867321][T18006] overlayfs: './file0' not a directory [ 1096.913098][T18012] overlayfs: missing 'lowerdir' [ 1096.929669][T18013] ref_ctr_offset mismatch. inode: 0x3d49 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:19 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:19 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:19 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b>']) 23:09:19 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000400)}}, 0x18) 23:09:19 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:19 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x1000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1097.346202][T18025] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1097.368771][T18026] overlayfs: missing 'lowerdir' [ 1097.379544][T18025] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1097.399236][T18028] ref_ctr_offset mismatch. inode: 0x3da1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:19 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:19 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:19 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1097.468871][T18024] overlayfs: './file0' not a directory 23:09:19 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1097.527387][T18028] ref_ctr_offset mismatch. inode: 0x3da1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1097.544821][T18034] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:19 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x2000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1097.682375][T18038] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1097.745512][T18038] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1097.754455][T18045] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1097.771754][T18042] overlayfs: './file0' not a directory [ 1097.792797][T18045] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 23:09:19 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1097.837520][T18048] ref_ctr_offset mismatch. inode: 0x3dd3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1097.946172][T18052] ref_ctr_offset mismatch. inode: 0x3dd3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1098.038289][T18054] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1098.061557][T18054] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 23:09:20 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:20 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:20 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000fffffdfd3e"]) 23:09:20 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:20 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x3000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:20 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1098.342092][T18065] overlayfs: unrecognized mount option "upper" or missing value [ 1098.377716][T18062] ref_ctr_offset mismatch. inode: 0x3da2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1098.387931][T18066] overlayfs: option "workdir=." is useless in a non-upper mount, ignore 23:09:20 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:20 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1098.438751][T18066] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1098.467657][T18071] ref_ctr_offset mismatch. inode: 0x3da2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:20 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:20 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:20 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000ff3e"]) [ 1098.672887][T18078] overlayfs: unrecognized mount option "upper" or missing value [ 1098.682024][T18076] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:20 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1098.774586][T18087] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1098.809229][T18087] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1098.838040][T18086] ref_ctr_offset mismatch. inode: 0x3ddc offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1099.031556][T18095] overlayfs: unrecognized mount option "upper" or missing value 23:09:21 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:21 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:21 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000000c0)={0x5, 0x10, 0xfa00, {0x0}}, 0x18) 23:09:21 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ccffffffffffffff3e"]) 23:09:21 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:21 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x5000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1099.459140][T18110] overlayfs: workdir and upperdir must be separate subtrees [ 1099.477369][T18109] ref_ctr_offset mismatch. inode: 0x3d9c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1099.506461][T18113] overlayfs: unrecognized mount option "upper" or missing value [ 1099.549156][ T26] kauditd_printk_skb: 15 callbacks suppressed [ 1099.549172][ T26] audit: type=1804 audit(1589065761.645:2152): pid=18111 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2323/bus/file0" dev="overlay" ino=15762 res=1 [ 1099.571578][T18111] overlayfs: './file0' not a directory 23:09:21 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:21 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:21 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000001"]) [ 1099.647292][T18116] ref_ctr_offset mismatch. inode: 0x3d9c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1099.662252][ T26] audit: type=1804 audit(1589065761.705:2153): pid=18117 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2323/bus/bus/file0" dev="overlay" ino=15837 res=1 23:09:21 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:21 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1099.763535][T18119] overlayfs: failed to resolve './file0': -2 [ 1099.853226][T18124] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1099.868623][T18122] overlayfs: workdir and upperdir must be separate subtrees [ 1099.914358][ T26] audit: type=1804 audit(1589065762.005:2154): pid=18129 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1972/bus/file0" dev="sda1" ino=15809 res=1 23:09:22 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1099.956453][T18133] overlayfs: unrecognized mount option "upper" or missing value [ 1100.011566][T18132] ref_ctr_offset mismatch. inode: 0x3e11 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1100.025714][ T26] audit: type=1804 audit(1589065762.115:2155): pid=18131 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2324/bus/file0" dev="overlay" ino=15985 res=1 [ 1100.087426][T18137] overlayfs: './file0' not a directory [ 1100.103721][T18132] ref_ctr_offset mismatch. inode: 0x3e11 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1100.164881][ T26] audit: type=1804 audit(1589065762.115:2156): pid=18130 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1904/bus/file0" dev="overlay" ino=15969 res=1 [ 1100.210890][T18140] overlayfs: workdir and upperdir must be separate subtrees [ 1100.257626][ T26] audit: type=1804 audit(1589065762.215:2157): pid=18138 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2324/bus/bus/file0" dev="overlay" ino=15685 res=1 23:09:22 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:22 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:22 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000002"]) 23:09:22 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:22 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:22 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1100.592809][T18154] overlayfs: failed to resolve './fil': -2 [ 1100.607358][T18153] ref_ctr_offset mismatch. inode: 0x3da1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:22 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1100.623318][ T26] audit: type=1804 audit(1589065762.715:2158): pid=18152 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2325/bus/file0" dev="overlay" ino=15794 res=1 [ 1100.659011][T18158] overlayfs: failed to resolve './file0': -2 [ 1100.671957][T18155] overlayfs: unrecognized mount option "upper" or missing value 23:09:22 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000003"]) [ 1100.741524][ T26] audit: type=1804 audit(1589065762.785:2159): pid=18161 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2325/bus/bus/file0" dev="overlay" ino=15969 res=1 23:09:22 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1100.785383][T18164] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1100.869943][ T26] audit: type=1804 audit(1589065762.945:2160): pid=18166 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1973/bus/file0" dev="sda1" ino=15743 res=1 23:09:23 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x8000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:23 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1100.928500][ T26] audit: type=1804 audit(1589065763.015:2161): pid=18156 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1905/bus/file0" dev="overlay" ino=15736 res=1 [ 1100.954386][T18167] overlayfs: failed to resolve './fil': -2 23:09:23 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1101.074968][T18171] overlayfs: workdir and upperdir must be separate subtrees [ 1101.137250][T18173] ref_ctr_offset mismatch. inode: 0x3da5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1101.152186][T18172] overlayfs: './file0' not a directory [ 1101.233972][T18180] overlayfs: failed to resolve './fil': -2 [ 1101.298662][T18173] ref_ctr_offset mismatch. inode: 0x3da5 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0xfffffff6 23:09:23 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:23 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:23 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000004"]) 23:09:23 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:23 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:23 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1101.558408][T18191] overlayfs: workdir and upperdir must be separate subtrees [ 1101.571118][T18194] overlayfs: failed to resolve './file': -2 [ 1101.594505][T18198] ref_ctr_offset mismatch. inode: 0x3dbe offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1101.611006][T18190] overlayfs: './file0' not a directory 23:09:23 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:23 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:23 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:23 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000005"]) [ 1101.695382][T18202] overlayfs: failed to resolve './file0': -2 23:09:23 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x14000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1101.813369][T18203] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1101.903759][T18209] overlayfs: failed to resolve './file': -2 [ 1101.953671][T18216] overlayfs: workdir and upperdir must be separate subtrees 23:09:24 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1102.041128][T18218] ref_ctr_offset mismatch. inode: 0x3e72 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:24 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:24 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:24 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:24 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000006"]) 23:09:24 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:24 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x20000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1102.521331][T18236] overlayfs: failed to resolve './fil': -2 [ 1102.524871][T18237] overlayfs: failed to resolve './file': -2 [ 1102.565452][T18240] ref_ctr_offset mismatch. inode: 0x3da2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:24 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:24 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:24 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:24 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a']) [ 1102.682431][T18244] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1102.761464][T18247] ref_ctr_offset mismatch. inode: 0x3da2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1102.875481][T18253] overlayfs: failed to resolve './fil': -2 23:09:25 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x40000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:25 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1103.109013][T18259] ref_ctr_offset mismatch. inode: 0x3d8f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1103.134138][T18257] overlayfs: './file0' not a directory 23:09:25 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:25 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:25 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:25 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:25 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b']) 23:09:25 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x48000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1103.525741][T18277] overlayfs: failed to resolve './fil': -2 23:09:25 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1103.568036][T18279] ref_ctr_offset mismatch. inode: 0x3d99 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1103.590270][T18274] overlayfs: './file0' not a directory 23:09:25 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:25 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:25 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t']) [ 1103.671189][T18285] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1103.745851][T18287] ref_ctr_offset mismatch. inode: 0x3d99 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1103.821465][T18289] overlayfs: failed to resolve './file': -2 23:09:26 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:26 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4c000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1104.028413][T18295] overlayfs: './file0' not a directory [ 1104.095851][T18302] overlayfs: failed to resolve './file': -2 [ 1104.103061][T18303] ref_ctr_offset mismatch. inode: 0x3db4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1104.236986][T18303] ref_ctr_offset mismatch. inode: 0x3db4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:26 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:26 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:26 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:26 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:26 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n']) 23:09:26 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x60000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1104.469707][T18315] overlayfs: failed to resolve './file': -2 23:09:26 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1104.550024][T18319] ref_ctr_offset mismatch. inode: 0x3de1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:26 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:26 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) [ 1104.623396][ T26] kauditd_printk_skb: 16 callbacks suppressed [ 1104.623411][ T26] audit: type=1804 audit(1589065766.716:2178): pid=18317 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2333/bus/file0" dev="overlay" ino=15973 res=1 [ 1104.641142][T18317] overlayfs: './file0' not a directory [ 1104.674468][T18319] ref_ctr_offset mismatch. inode: 0x3de1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:26 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v']) [ 1104.740123][T18323] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1104.792150][ T26] audit: type=1804 audit(1589065766.786:2179): pid=18322 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2333/bus/bus/file0" dev="overlay" ino=15766 res=1 23:09:26 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x68000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:27 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1105.077540][ T26] audit: type=1804 audit(1589065767.176:2180): pid=18335 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2334/bus/file0" dev="overlay" ino=15779 res=1 [ 1105.093637][T18335] overlayfs: './file0' not a directory [ 1105.137420][T18339] ref_ctr_offset mismatch. inode: 0x3d9c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1105.183123][ T26] audit: type=1804 audit(1589065767.216:2181): pid=18338 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2334/bus/bus/file0" dev="overlay" ino=15769 res=1 [ 1105.239917][T18339] ref_ctr_offset mismatch. inode: 0x3d9c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1105.251114][ T26] audit: type=1804 audit(1589065767.336:2182): pid=18341 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1916/bus/file0" dev="sda1" ino=15780 res=1 23:09:27 executing program 1: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:27 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:27 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:27 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\f']) 23:09:27 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:27 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6c000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1105.486157][ T26] audit: type=1804 audit(1589065767.576:2183): pid=18350 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1917/bus/file0" dev="sda1" ino=15793 res=1 [ 1105.540834][T18355] ref_ctr_offset mismatch. inode: 0x3da1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:27 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1105.588720][T18351] overlayfs: './file0' not a directory 23:09:27 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:27 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) [ 1105.624400][ T26] audit: type=1804 audit(1589065767.666:2184): pid=18351 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2335/bus/file0" dev="overlay" ino=15969 res=1 [ 1105.640552][T18359] overlayfs: failed to resolve './file1': -2 23:09:27 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r']) [ 1105.726629][T18355] ref_ctr_offset mismatch. inode: 0x3da1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1105.764891][T18359] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1105.771477][ T26] audit: type=1804 audit(1589065767.716:2185): pid=18360 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2335/bus/bus/file0" dev="overlay" ino=16082 res=1 23:09:28 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x74000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:28 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1105.863520][ T26] audit: type=1804 audit(1589065767.906:2186): pid=18363 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1978/bus/file0" dev="sda1" ino=15756 res=1 [ 1105.997332][ T26] audit: type=1804 audit(1589065767.926:2187): pid=18364 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1918/bus/file0" dev="sda1" ino=15764 res=1 [ 1106.057399][T18374] ref_ctr_offset mismatch. inode: 0x3e22 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1106.143453][T18377] overlayfs: failed to resolve './file0': -2 [ 1106.147163][T18378] ref_ctr_offset mismatch. inode: 0x3e22 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1106.205285][T18376] overlayfs: failed to resolve './file0': -2 23:09:28 executing program 1: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:28 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(0x0, 0x141042, 0x0) 23:09:28 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:28 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, 0x0, 0x0) 23:09:28 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7a000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:28 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000000e"]) 23:09:28 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(0x0, 0x141042, 0x0) [ 1106.606695][T18386] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1106.624182][T18392] overlayfs: failed to resolve './file1': -2 [ 1106.656146][T18393] overlayfs: failed to resolve './file0': -2 [ 1106.694790][T18391] overlayfs: failed to resolve './file0': -2 23:09:28 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) [ 1106.706829][T18392] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:28 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:28 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000000f"]) [ 1106.773004][T18403] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:29 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(0x0, 0x141042, 0x0) 23:09:29 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x8cffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1106.941220][T18407] overlayfs: failed to resolve './file0': -2 [ 1107.131450][T18412] overlayfs: failed to resolve './file0': -2 [ 1107.177008][T18415] ref_ctr_offset mismatch. inode: 0x3d8c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1107.297361][T18421] ref_ctr_offset mismatch. inode: 0x3d8c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:29 executing program 1: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:29 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:29 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) 23:09:29 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000010"]) 23:09:29 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 23:09:29 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xf0ffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:29 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1107.571055][T18427] overlayfs: failed to resolve './bus': -2 [ 1107.590873][T18436] overlayfs: failed to resolve './file1': -2 [ 1107.601436][T18429] overlayfs: failed to resolve './bus': -2 [ 1107.608877][T18437] ref_ctr_offset mismatch. inode: 0x3e34 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:29 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) 23:09:29 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) [ 1107.672649][T18429] overlayfs: './file0' not a directory [ 1107.678842][T18439] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:29 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000011"]) [ 1107.716146][T18440] ref_ctr_offset mismatch. inode: 0x3e34 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:29 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:30 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xf6ffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1108.053286][T18452] overlayfs: './file0' not a directory [ 1108.079082][T18454] ref_ctr_offset mismatch. inode: 0x3d8e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1108.198613][T18458] ref_ctr_offset mismatch. inode: 0x3d8e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:30 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:30 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 23:09:30 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r']) 23:09:30 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:30 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000012"]) 23:09:30 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xffffff7f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:30 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1108.543138][T18475] ref_ctr_offset mismatch. inode: 0x3db8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1108.586867][T18474] overlayfs: './file0' not a directory [ 1108.611450][T18475] ref_ctr_offset mismatch. inode: 0x3db8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:30 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1108.679049][T18477] overlayfs: failed to resolve './file1': -2 23:09:30 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000013"]) [ 1108.763982][T18480] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:30 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xffffff8c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:30 executing program 0: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x1000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:31 executing program 2: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1108.988676][T18486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1108.997313][T18483] overlayfs: failed to resolve './file0': -2 [ 1109.017038][T18493] ref_ctr_offset mismatch. inode: 0x3d8c offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1109.061336][T18486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1109.104926][T18486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1109.145272][T18499] overlayfs: failed to resolve './file1': -2 [ 1109.165386][T18486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1109.208482][T18486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1109.252527][T18486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1109.291118][T18486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1109.305171][T18486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1109.326403][T18486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1109.346285][T18486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1109.357091][T18486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 1109.368512][T18486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1109.397382][T18497] netlink: 'syz-executor.4': attribute type 18 has an invalid length. [ 1109.439976][T18504] ref_ctr_offset mismatch. inode: 0x3e65 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:31 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:31 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000014"]) 23:09:31 executing program 2: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:31 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, 0x0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1109.543358][T18513] overlayfs: failed to resolve './file1': -2 23:09:31 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xfffffff0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:31 executing program 2: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1109.661334][T18517] overlayfs: failed to resolve './file1': -2 [ 1109.700915][ T26] kauditd_printk_skb: 26 callbacks suppressed [ 1109.700931][ T26] audit: type=1804 audit(1589065771.796:2214): pid=18515 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2343/bus/file0" dev="overlay" ino=15738 res=1 [ 1109.747622][T18520] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1109.782720][T18515] overlayfs: './file0' not a directory [ 1109.829043][T18528] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1109.831929][T18530] overlayfs: failed to resolve './file1': -2 23:09:32 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000015"]) [ 1109.883600][ T26] audit: type=1804 audit(1589065771.916:2215): pid=18526 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2343/bus/bus/file0" dev="overlay" ino=15964 res=1 23:09:32 executing program 2: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1110.009581][T18528] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1110.023034][ T26] audit: type=1804 audit(1589065771.946:2216): pid=18527 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1982/bus/file0" dev="sda1" ino=15764 res=1 [ 1110.058174][T18531] netlink: 'syz-executor.0': attribute type 18 has an invalid length. [ 1110.084602][ T26] audit: type=1804 audit(1589065771.946:2217): pid=18530 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1929/bus/file0" dev="sda1" ino=15987 res=1 23:09:32 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1110.109563][T18537] overlayfs: failed to resolve './file1': -2 [ 1110.129081][ T26] audit: type=1804 audit(1589065772.226:2218): pid=18532 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir105873212/syzkaller.J7Vk0J/2266/bus/file0" dev="overlay" ino=15788 res=1 23:09:32 executing program 2: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1110.243083][ T26] audit: type=1804 audit(1589065772.266:2219): pid=18537 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1930/bus/file0" dev="sda1" ino=15789 res=1 23:09:32 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000016"]) [ 1110.326467][T18544] ref_ctr_offset mismatch. inode: 0x3da0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1110.347820][ T26] audit: type=1804 audit(1589065772.396:2220): pid=18541 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2344/bus/file0" dev="overlay" ino=15787 res=1 [ 1110.460905][T18549] overlayfs: failed to resolve './file1': -2 23:09:32 executing program 1: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:32 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000fffffdfd003e"]) [ 1110.488588][ T26] audit: type=1804 audit(1589065772.426:2221): pid=18534 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir132443096/syzkaller.m0zGRj/2178/bus/file0" dev="overlay" ino=15765 res=1 23:09:32 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000005003e"]) 23:09:32 executing program 2: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:32 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x1000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1110.638992][ T26] audit: type=1804 audit(1589065772.436:2222): pid=18546 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2344/bus/bus/file0" dev="overlay" ino=15789 res=1 [ 1110.688071][T18554] overlayfs: failed to resolve './file1': -2 [ 1110.772759][ T26] audit: type=1804 audit(1589065772.606:2223): pid=18549 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1931/bus/file0" dev="sda1" ino=15734 res=1 [ 1110.783364][T18560] overlayfs: failed to resolve './file1': -2 [ 1110.801919][T18562] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1110.828620][T18555] overlayfs: './file0' not a directory [ 1110.867373][T18561] ref_ctr_offset mismatch. inode: 0x3df6 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:33 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:33 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:33 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000017"]) [ 1110.975850][T18570] ref_ctr_offset mismatch. inode: 0x3df6 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:33 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x100000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:33 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc018945c, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:33 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1111.287186][T18578] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1111.384947][T18579] overlayfs: './file0' not a directory 23:09:33 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1111.435817][T18585] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:33 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:33 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000018"]) 23:09:33 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x200000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:33 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f00000000c0)) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) 23:09:33 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1111.751433][T18598] ref_ctr_offset mismatch. inode: 0x3d99 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1111.751776][T18599] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1111.844534][T18597] overlayfs: failed to resolve './file0': -2 [ 1111.866366][T18605] overlayfs: failed to resolve './file0': -2 [ 1111.885983][T18607] ref_ctr_offset mismatch. inode: 0x3d99 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:34 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000000000000019"]) 23:09:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x4090ae82, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:34 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x300000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:34 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f00000000c0)) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) [ 1112.143034][T18610] overlayfs: failed to resolve './file0': -2 23:09:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1112.226101][T18613] ref_ctr_offset mismatch. inode: 0x3d96 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1112.262230][T18618] overlayfs: './file0' not a directory 23:09:34 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000001a"]) [ 1112.430046][T18624] overlayfs: failed to resolve './file0': -2 23:09:34 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:34 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:34 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xae9a, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:34 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f00000000c0)) ioctl$FIDEDUPERANGE(r1, 0x2, 0x0) [ 1112.769831][T18630] ref_ctr_offset mismatch. inode: 0x3d92 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:34 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:35 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000001b"]) [ 1112.891064][T18641] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1112.906007][T18640] ref_ctr_offset mismatch. inode: 0x3d92 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:35 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x500000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:35 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000040000000000000000000000003e"]) 23:09:35 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:35 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f00000000c0)) [ 1113.206272][T18648] ref_ctr_offset mismatch. inode: 0x3d94 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1113.266583][T18649] overlayfs: './file0' not a directory 23:09:35 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000001c"]) [ 1113.349413][T18656] ref_ctr_offset mismatch. inode: 0x3d94 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:35 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x600000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:35 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:35 executing program 4 (fault-call:8 fault-nth:0): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:35 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:35 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:35 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1113.760255][T18671] ref_ctr_offset mismatch. inode: 0x3d96 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1113.761974][T18662] overlayfs: './file0' not a directory [ 1113.810323][T18672] FAULT_INJECTION: forcing a failure. [ 1113.810323][T18672] name failslab, interval 1, probability 0, space 0, times 0 [ 1113.858851][T18671] ref_ctr_offset mismatch. inode: 0x3d96 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1113.871582][T18672] CPU: 1 PID: 18672 Comm: syz-executor.4 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 1113.881494][T18672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1113.891579][T18672] Call Trace: [ 1113.894894][T18672] dump_stack+0x188/0x20d [ 1113.899248][T18672] should_fail.cold+0x5/0x14 [ 1113.902695][T18678] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1113.904092][T18672] ? lock_downgrade+0x840/0x840 [ 1113.904111][T18672] ? setup_fault_attr+0x1e0/0x1e0 [ 1113.904141][T18672] should_failslab+0x5/0xf [ 1113.904154][T18672] kmem_cache_alloc+0x29b/0x740 [ 1113.904177][T18672] ? ksys_write+0x212/0x250 [ 1113.936085][T18672] getname_flags+0xd2/0x5b0 [ 1113.940605][T18672] do_sys_openat2+0x3fc/0x7d0 [ 1113.945299][T18672] ? file_open_root+0x400/0x400 [ 1113.950236][T18672] ? __mutex_unlock_slowpath+0xe2/0x660 [ 1113.955804][T18672] ? wait_for_completion+0x270/0x270 [ 1113.960562][T18681] overlayfs: failed to resolve './file1': -2 [ 1113.961106][T18672] ? __this_cpu_preempt_check+0x28/0x190 [ 1113.972686][T18672] ? __sb_end_write+0x101/0x1d0 [ 1113.977576][T18672] do_sys_open+0xc3/0x140 [ 1113.981958][T18672] ? filp_open+0x70/0x70 [ 1113.986209][T18672] ? ksys_write+0x1a5/0x250 [ 1113.990769][T18672] ? __ia32_sys_clock_settime+0x260/0x260 [ 1113.996539][T18672] ? trace_hardirqs_off_caller+0x55/0x230 [ 1114.002367][T18672] do_syscall_64+0xf6/0x7d0 [ 1114.006916][T18672] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 1114.012816][T18672] RIP: 0033:0x45c829 [ 1114.016730][T18672] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1114.036338][T18672] RSP: 002b:00007f36344d1c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 1114.044761][T18672] RAX: ffffffffffffffda RBX: 00000000004f6a20 RCX: 000000000045c829 23:09:36 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000001d"]) [ 1114.053326][T18672] RDX: 0000000000000000 RSI: 0000000000141042 RDI: 0000000020000040 [ 1114.061310][T18672] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1114.069380][T18672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 1114.077360][T18672] R13: 0000000000000779 R14: 00000000005253ff R15: 00007f36344d26d4 23:09:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:36 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:36 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x700000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1114.380774][T18694] ref_ctr_offset mismatch. inode: 0x3dc3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1114.408210][T18690] overlayfs: failed to resolve './file0': -2 23:09:36 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000001e"]) [ 1114.469645][T18694] ref_ctr_offset mismatch. inode: 0x3dc3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:36 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:36 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1114.716284][T18703] ref_ctr_offset mismatch. inode: 0x3d86 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1114.740040][T18705] overlayfs: missing 'lowerdir' 23:09:36 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 23:09:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000300)=""/176) 23:09:36 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1114.781470][ T26] kauditd_printk_skb: 39 callbacks suppressed [ 1114.781486][ T26] audit: type=1804 audit(1589065776.877:2263): pid=18705 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1945/bus/file0" dev="sda1" ino=15759 res=1 23:09:37 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:37 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x1000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1114.933752][T18707] overlayfs: './file0' not a directory [ 1114.943264][T18712] overlayfs: failed to resolve './file0': -2 [ 1114.948622][ T26] audit: type=1804 audit(1589065776.987:2264): pid=18707 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2353/bus/file0" dev="overlay" ino=15772 res=1 23:09:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000300)=""/176) [ 1115.019946][T18718] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:37 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000000001f"]) [ 1115.088890][T18721] overlayfs: missing 'lowerdir' 23:09:37 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1115.154610][ T26] audit: type=1804 audit(1589065777.057:2265): pid=18714 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2353/bus/bus/file0" dev="overlay" ino=15765 res=1 [ 1115.262336][T18727] ref_ctr_offset mismatch. inode: 0x3d7b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1115.292174][ T26] audit: type=1804 audit(1589065777.177:2266): pid=18719 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1987/bus/file0" dev="sda1" ino=15773 res=1 23:09:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x2) [ 1115.336708][T18731] overlayfs: missing 'lowerdir' 23:09:37 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1115.373269][ T26] audit: type=1804 audit(1589065777.207:2267): pid=18721 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1946/bus/file0" dev="sda1" ino=15738 res=1 23:09:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000300)=""/176) [ 1115.439503][T18725] ref_ctr_offset mismatch. inode: 0x3d7b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1115.466296][T18734] overlayfs: './file0' not a directory 23:09:37 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x1400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:37 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 ']) [ 1115.532524][ T26] audit: type=1804 audit(1589065777.457:2268): pid=18731 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1947/bus/file0" dev="sda1" ino=15859 res=1 [ 1115.639748][T18738] overlayfs: missing 'lowerdir' [ 1115.668297][ T26] audit: type=1804 audit(1589065777.537:2269): pid=18732 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2354/bus/file0" dev="overlay" ino=15747 res=1 [ 1115.694060][T18741] overlayfs: './file0' not a directory 23:09:37 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:37 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1115.757598][T18743] ref_ctr_offset mismatch. inode: 0x3da4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:37 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x3) [ 1115.821292][ T26] audit: type=1804 audit(1589065777.587:2270): pid=18734 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2354/bus/bus/file0" dev="overlay" ino=15740 res=1 23:09:38 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1115.910174][T18750] overlayfs: './file0' not a directory [ 1115.939868][T18752] overlayfs: failed to resolve './file0': -2 23:09:38 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!']) 23:09:38 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x2000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1116.008476][ T26] audit: type=1804 audit(1589065777.777:2271): pid=18738 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1948/bus/file0" dev="sda1" ino=15772 res=1 [ 1116.039624][T18755] overlayfs: missing 'lowerdir' [ 1116.040485][T18757] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:38 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:38 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1116.148477][ T26] audit: type=1804 audit(1589065777.987:2272): pid=18748 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2355/bus/file0" dev="overlay" ino=15739 res=1 [ 1116.275858][T18767] ref_ctr_offset mismatch. inode: 0x3db3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1116.284328][T18766] overlayfs: './file0' not a directory [ 1116.293728][T18765] overlayfs: './file0' not a directory 23:09:38 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\"']) [ 1116.338723][T18772] overlayfs: missing 'lowerdir' 23:09:38 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x4) [ 1116.365574][T18773] ref_ctr_offset mismatch. inode: 0x3db3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:38 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:38 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1116.587582][T18779] overlayfs: missing 'lowerdir' 23:09:38 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:38 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:38 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1116.679222][T18780] overlayfs: './file0' not a directory [ 1116.695776][T18783] ref_ctr_offset mismatch. inode: 0x3dd7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:38 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00#']) [ 1116.762308][T18787] overlayfs: './file0' not a directory [ 1116.791155][T18788] ref_ctr_offset mismatch. inode: 0x3dd7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x5) [ 1116.922722][T18795] overlayfs: missing 'lowerdir' [ 1116.929398][T18794] overlayfs: failed to resolve './file0': -2 23:09:39 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:39 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1117.017886][T18796] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1117.168623][T18800] overlayfs: './file0' not a directory [ 1117.176664][T18803] ref_ctr_offset mismatch. inode: 0x3d9e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1117.194558][T18811] overlayfs: missing 'lowerdir' [ 1117.244134][T18812] overlayfs: './file0' not a directory [ 1117.268866][T18803] ref_ctr_offset mismatch. inode: 0x3d9e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:39 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:39 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$']) 23:09:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x6) [ 1117.453424][T18815] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1117.490893][T18815] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 23:09:39 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:39 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x4c00000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:39 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1117.657666][T18820] overlayfs: './file0' not a directory [ 1117.682864][T18824] overlayfs: './file0' not a directory 23:09:39 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00%']) 23:09:39 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x7) [ 1117.781091][T18829] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1117.795446][T18828] ref_ctr_offset mismatch. inode: 0x3d8d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1117.828510][T18829] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 23:09:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:40 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1117.938960][T18835] ref_ctr_offset mismatch. inode: 0x3d8d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1117.957226][T18836] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:40 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1118.048956][T18843] overlayfs: failed to resolve './file0': -2 23:09:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1118.117156][T18846] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1118.146821][T18846] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 23:09:40 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00&']) [ 1118.219493][T18851] overlayfs: './file0' not a directory 23:09:40 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1118.315074][T18853] ref_ctr_offset mismatch. inode: 0x3dd5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1118.336971][T18855] overlayfs: failed to resolve './file0': -2 [ 1118.426433][T18858] ref_ctr_offset mismatch. inode: 0x3dd5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1118.451745][T18857] overlayfs: './file0' not a directory [ 1118.502597][T18862] overlayfs: unrecognized mount option "upper" or missing value 23:09:40 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:40 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x8) 23:09:40 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\'']) 23:09:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:40 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:40 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1118.721815][T18867] ref_ctr_offset mismatch. inode: 0x3d9b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1118.763162][T18870] overlayfs: failed to resolve './file0': -2 [ 1118.801761][T18875] overlayfs: './file0' not a directory [ 1118.814531][T18877] ref_ctr_offset mismatch. inode: 0x3d9b offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1118.819322][T18874] overlayfs: unrecognized mount option "upper" or missing value 23:09:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:41 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00(']) [ 1118.897061][T18876] overlayfs: './file0' not a directory 23:09:41 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x6c00000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:41 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xc) [ 1118.961872][T18878] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:41 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:41 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1119.206763][T18892] overlayfs: unrecognized mount option "upper" or missing value [ 1119.215192][T18889] ref_ctr_offset mismatch. inode: 0x3d7a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1119.289747][T18893] overlayfs: './file0' not a directory [ 1119.378406][T18903] overlayfs: './file0' not a directory 23:09:41 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:41 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:41 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00)']) 23:09:41 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:41 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x10) 23:09:41 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7400000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:41 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1119.703364][T18914] overlayfs: workdir and upperdir must be separate subtrees [ 1119.736523][T18911] ref_ctr_offset mismatch. inode: 0x3da1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1119.784857][ T26] kauditd_printk_skb: 29 callbacks suppressed [ 1119.784873][ T26] audit: type=1804 audit(1589065781.877:2302): pid=18916 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2364/bus/file0" dev="overlay" ino=15831 res=1 [ 1119.791004][T18918] overlayfs: './file0' not a directory [ 1119.803068][T18916] overlayfs: './file0' not a directory 23:09:42 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:42 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x12) [ 1119.918544][T18923] ref_ctr_offset mismatch. inode: 0x3da1 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1119.955951][ T26] audit: type=1804 audit(1589065781.937:2303): pid=18921 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2364/bus/bus/file0" dev="overlay" ino=15755 res=1 [ 1119.964718][T18925] overlayfs: failed to resolve './file1': -2 [ 1119.997210][T18926] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:42 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7a00000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:42 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00*']) [ 1120.134074][ T26] audit: type=1804 audit(1589065782.157:2304): pid=18930 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1992/bus/file0" dev="overlay" ino=15749 res=1 [ 1120.167344][T18931] overlayfs: workdir and upperdir must be separate subtrees 23:09:42 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1120.267965][ T26] audit: type=1804 audit(1589065782.297:2305): pid=18935 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1961/bus/file0" dev="sda1" ino=15759 res=1 [ 1120.315983][T18937] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1120.329693][T18940] overlayfs: './file0' not a directory [ 1120.354404][T18942] overlayfs: failed to resolve './file1': -2 [ 1120.385618][T18941] overlayfs: './file0' not a directory [ 1120.397464][T18937] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1120.420260][ T26] audit: type=1804 audit(1589065782.467:2306): pid=18941 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2365/bus/file0" dev="overlay" ino=15831 res=1 [ 1120.529791][ T26] audit: type=1804 audit(1589065782.497:2307): pid=18945 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2365/bus/bus/file0" dev="overlay" ino=15857 res=1 23:09:42 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:42 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:42 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:42 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x13) 23:09:42 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00+']) 23:09:42 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x8cffffff00000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1120.740684][T18952] overlayfs: failed to resolve './file1': -2 [ 1120.764640][T18951] overlayfs: workdir and upperdir must be separate subtrees [ 1120.851018][T18959] ref_ctr_offset mismatch. inode: 0x3dab offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1120.863164][ T26] audit: type=1804 audit(1589065782.957:2308): pid=18951 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1962/bus/file0" dev="sda1" ino=15829 res=1 [ 1120.897053][T18961] overlayfs: './file0' not a directory 23:09:43 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:43 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1120.921735][ T26] audit: type=1804 audit(1589065782.977:2309): pid=18956 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2366/bus/file0" dev="overlay" ino=15825 res=1 [ 1120.923557][T18956] overlayfs: './file0' not a directory 23:09:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xf0) [ 1120.991960][T18959] ref_ctr_offset mismatch. inode: 0x3dab offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1121.061744][T18964] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:43 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00,']) [ 1121.089463][ T26] audit: type=1804 audit(1589065783.057:2310): pid=18966 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2366/bus/bus/file0" dev="overlay" ino=15938 res=1 [ 1121.158540][T18971] overlayfs: failed to resolve './file1': -2 [ 1121.172050][ T26] audit: type=1804 audit(1589065783.227:2311): pid=18969 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1993/bus/file0" dev="overlay" ino=15734 res=1 23:09:43 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xf0ffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1121.227924][T18973] overlayfs: failed to resolve './fil': -2 23:09:43 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1121.402395][T18983] overlayfs: './file0' not a directory [ 1121.440408][T18985] overlayfs: failed to resolve './file1': -2 [ 1121.447641][T18980] ref_ctr_offset mismatch. inode: 0x3da9 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1121.519922][T18984] overlayfs: failed to resolve './file0': -2 [ 1121.595088][T18988] ref_ctr_offset mismatch. inode: 0x3da9 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:43 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:43 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x300) 23:09:43 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:43 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:43 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00-']) 23:09:43 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xf6ffffff00000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1121.826771][T18996] overlayfs: failed to resolve './file1': -2 [ 1121.845713][T19000] overlayfs: failed to resolve './fil': -2 [ 1121.875003][T18999] ref_ctr_offset mismatch. inode: 0x3da8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:44 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1121.928108][T19003] overlayfs: './file0' not a directory [ 1121.956840][T18998] overlayfs: './file0' not a directory [ 1122.003890][T19007] ref_ctr_offset mismatch. inode: 0x3da8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:44 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x500) 23:09:44 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.']) [ 1122.138449][T19012] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:44 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xffffff7f00000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1122.210641][T19014] overlayfs: failed to resolve './fil': -2 [ 1122.405281][T19023] overlayfs: './file0' not a directory [ 1122.411661][T19024] ref_ctr_offset mismatch. inode: 0x3db6 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1122.438708][T19026] overlayfs: './file0' not a directory [ 1122.524626][T19028] ref_ctr_offset mismatch. inode: 0x3db6 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:44 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:44 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:44 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/']) 23:09:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:44 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x600) 23:09:44 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xffffffff00000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1122.858427][T19038] overlayfs: failed to resolve './file': -2 [ 1122.884907][T19036] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:45 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1122.979204][T19039] overlayfs: './file0' not a directory [ 1123.003757][T19043] overlayfs: './file0' not a directory 23:09:45 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000']) [ 1123.024785][T19045] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:45 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x700) 23:09:45 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xfffffffffffffff0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1123.153896][T19051] overlayfs: failed to resolve './file0': -2 [ 1123.206292][T19052] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1123.233732][T19055] overlayfs: failed to resolve './file': -2 23:09:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1123.427406][T19058] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1123.437992][T19065] overlayfs: failed to resolve './file0': -2 [ 1123.456244][T19066] overlayfs: './file0' not a directory [ 1123.468865][T19062] overlayfs: './file0' not a directory [ 1123.508360][T19063] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:45 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:45 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:45 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:45 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xc00) 23:09:45 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x001']) [ 1123.944586][T19080] overlayfs: failed to resolve './file0': -2 [ 1123.965550][T19078] ref_ctr_offset mismatch. inode: 0x3df5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1123.981547][T19082] overlayfs: failed to resolve './file': -2 23:09:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:46 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1124.044940][T19084] overlayfs: './file0' not a directory [ 1124.059066][T19086] ref_ctr_offset mismatch. inode: 0x3df5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1124.119049][T19081] overlayfs: './file0' not a directory 23:09:46 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:46 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x1200) 23:09:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:46 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x002']) [ 1124.197848][T19092] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1124.425602][T19097] ref_ctr_offset mismatch. inode: 0x3e06 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1124.485025][T19104] overlayfs: './file0' not a directory [ 1124.507353][T19101] ref_ctr_offset mismatch. inode: 0x3e06 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1124.618887][T19105] overlayfs: './file0' not a directory 23:09:46 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:46 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:47 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:47 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x1300) 23:09:47 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x003']) [ 1125.030370][T19127] ref_ctr_offset mismatch. inode: 0x3e25 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1125.060093][ T26] kauditd_printk_skb: 21 callbacks suppressed 23:09:47 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1125.060108][ T26] audit: type=1804 audit(1589065787.158:2333): pid=19122 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2374/bus/file0" dev="sda1" ino=16178 res=1 [ 1125.081740][T19122] overlayfs: './file0' not a directory [ 1125.105929][T19125] overlayfs: failed to resolve './bus': -2 23:09:47 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1125.160551][T19129] overlayfs: './file0' not a directory 23:09:47 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x2000) [ 1125.216514][ T26] audit: type=1804 audit(1589065787.208:2334): pid=19131 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2374/bus/bus/file0" dev="sda1" ino=16209 res=1 23:09:47 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004']) [ 1125.282251][T19132] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1125.347322][ T26] audit: type=1804 audit(1589065787.438:2335): pid=19138 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1997/bus/file0" dev="sda1" ino=15781 res=1 23:09:47 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:47 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1125.545742][T19148] overlayfs: './file0' not a directory [ 1125.579284][T19152] ref_ctr_offset mismatch. inode: 0x3e83 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1125.644074][ T26] audit: type=1804 audit(1589065787.738:2336): pid=19151 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2375/bus/file0" dev="overlay" ino=15796 res=1 [ 1125.688961][T19152] ref_ctr_offset mismatch. inode: 0x3e83 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1125.698182][T19155] overlayfs: './file0' not a directory [ 1125.745758][ T26] audit: type=1804 audit(1589065787.818:2337): pid=19157 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2375/bus/bus/file0" dev="overlay" ino=15804 res=1 23:09:48 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:48 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(0x0, 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:48 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x26e3) 23:09:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:48 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x005']) 23:09:48 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1126.064613][T19167] ref_ctr_offset mismatch. inode: 0x3e35 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:48 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(0x0, 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1126.165418][ T26] audit: type=1804 audit(1589065788.268:2338): pid=19176 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2376/bus/file0" dev="sda1" ino=16241 res=1 [ 1126.223317][T19177] overlayfs: './file0' not a directory 23:09:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:48 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x006']) 23:09:48 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x26e4) [ 1126.301926][ T26] audit: type=1804 audit(1589065788.288:2339): pid=19180 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2376/bus/bus/file0" dev="sda1" ino=16321 res=1 23:09:48 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1126.369337][T19183] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1126.444210][ T26] audit: type=1804 audit(1589065788.538:2340): pid=19184 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/1998/bus/file0" dev="overlay" ino=15781 res=1 [ 1126.535993][T19190] overlayfs: missing 'lowerdir' 23:09:48 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(0x0, 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1126.604324][T19192] ref_ctr_offset mismatch. inode: 0x3e23 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1126.678222][T19192] ref_ctr_offset mismatch. inode: 0x3e23 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1126.722431][T19198] overlayfs: './file0' not a directory [ 1126.740328][ T26] audit: type=1804 audit(1589065788.838:2341): pid=19197 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2377/bus/file0" dev="overlay" ino=15896 res=1 [ 1126.769528][T19197] overlayfs: './file0' not a directory [ 1126.870088][ T26] audit: type=1804 audit(1589065788.898:2342): pid=19200 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2377/bus/bus/file0" dev="overlay" ino=15806 res=1 23:09:49 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x3f00) 23:09:49 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:49 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x007']) 23:09:49 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1127.101212][T19210] overlayfs: missing 'lowerdir' [ 1127.114951][T19208] ref_ctr_offset mismatch. inode: 0x3e04 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1127.224008][T19212] overlayfs: './file0' not a directory [ 1127.264577][T19218] ref_ctr_offset mismatch. inode: 0x3e04 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:49 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xe326) 23:09:49 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x008']) [ 1127.356125][T19221] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1127.402009][T19225] overlayfs: missing 'lowerdir' 23:09:49 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:49 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1127.624956][T19229] ref_ctr_offset mismatch. inode: 0x3db0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1127.661629][T19232] overlayfs: './file0' not a directory [ 1127.706218][T19236] overlayfs: missing 'lowerdir' [ 1127.754653][T19238] ref_ctr_offset mismatch. inode: 0x3db0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1127.796803][T19242] overlayfs: './file0' not a directory 23:09:50 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:50 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x009']) 23:09:50 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:50 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:50 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xe426) [ 1128.154623][T19250] ref_ctr_offset mismatch. inode: 0x3dc0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1128.158862][T19252] overlayfs: missing 'lowerdir' 23:09:50 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(0x0, 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:50 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1128.258668][T19251] overlayfs: './file0' not a directory [ 1128.294560][T19256] ref_ctr_offset mismatch. inode: 0x3dc0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:50 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00:']) [ 1128.326043][T19262] overlayfs: './file0' not a directory 23:09:50 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x14}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:50 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xf000) [ 1128.472162][T19266] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1128.523479][T19267] overlayfs: missing 'lowerdir' 23:09:50 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(0x0, 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1128.699334][T19270] ref_ctr_offset mismatch. inode: 0x3db8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1128.721910][T19272] overlayfs: './file0' not a directory [ 1128.772840][T19281] ref_ctr_offset mismatch. inode: 0x3db8 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1128.812949][T19282] overlayfs: './file0' not a directory 23:09:51 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:51 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(0x0, 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:51 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00;']) 23:09:51 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xff00) 23:09:51 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x48}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1129.235262][T19292] ref_ctr_offset mismatch. inode: 0x3d95 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1129.235269][T19293] overlayfs: missing 'lowerdir' 23:09:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:51 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1129.307424][T19294] overlayfs: './file0' not a directory [ 1129.341575][T19300] ref_ctr_offset mismatch. inode: 0x3d95 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:51 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xff0f) 23:09:51 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00<']) 23:09:51 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x4c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1129.516292][T19307] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1129.554471][T19306] overlayfs: missing 'lowerdir' 23:09:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1129.724857][T19317] ref_ctr_offset mismatch. inode: 0x3e01 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1129.725956][T19316] overlayfs: './file0' not a directory [ 1129.805072][T19318] overlayfs: './file0' not a directory [ 1129.875580][T19323] ref_ctr_offset mismatch. inode: 0x3e01 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1129.876338][T19324] overlayfs: missing 'lowerdir' 23:09:52 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:52 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x60}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:52 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x200000) 23:09:52 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00=']) 23:09:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1130.304450][T19332] ref_ctr_offset mismatch. inode: 0x3d95 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1130.356992][T19338] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1130.390346][ T26] kauditd_printk_skb: 17 callbacks suppressed [ 1130.390363][ T26] audit: type=1804 audit(1589065792.488:2360): pid=19335 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2384/bus/file0" dev="overlay" ino=15835 res=1 [ 1130.423673][T19343] overlayfs: './file0' not a directory [ 1130.447689][T19338] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1130.479777][T19347] ref_ctr_offset mismatch. inode: 0x3d95 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:52 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) 23:09:52 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000020000000000003e"]) 23:09:52 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xf0ffff) 23:09:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1130.625705][ T26] audit: type=1804 audit(1589065792.498:2361): pid=19336 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1982/bus/file0" dev="overlay" ino=15842 res=1 [ 1130.658010][T19350] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:52 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x68}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1130.809651][ T26] audit: type=1804 audit(1589065792.568:2362): pid=19346 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2384/bus/bus/file0" dev="overlay" ino=15884 res=1 [ 1130.819109][T19355] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1130.924743][T19355] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 23:09:53 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, 0x0) [ 1130.964746][T19359] ref_ctr_offset mismatch. inode: 0x3de4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1130.986872][ T26] audit: type=1804 audit(1589065792.848:2363): pid=19351 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/2002/bus/file0" dev="overlay" ino=15738 res=1 [ 1131.052488][T19361] overlayfs: failed to resolve './file0': -2 [ 1131.081510][T19367] overlayfs: './file0' not a directory [ 1131.094630][T19363] ref_ctr_offset mismatch. inode: 0x3de4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1131.176046][ T26] audit: type=1804 audit(1589065793.008:2364): pid=19356 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1983/bus/file0" dev="overlay" ino=15800 res=1 23:09:53 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:53 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000030000000000003e"]) 23:09:53 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:53 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x1000000) 23:09:53 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x6c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1131.418663][ T26] audit: type=1804 audit(1589065793.078:2365): pid=19361 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2385/bus/file0" dev="overlay" ino=15885 res=1 23:09:53 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, 0x0) [ 1131.470043][T19375] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 1131.473996][T19379] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1131.544626][T19375] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1131.617435][ T26] audit: type=1804 audit(1589065793.178:2366): pid=19366 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2385/bus/bus/file0" dev="overlay" ino=15759 res=1 [ 1131.631755][T19378] overlayfs: './file0' not a directory 23:09:53 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1131.692787][T19389] overlayfs: './file0' not a directory [ 1131.702188][T19379] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1131.779978][T19392] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1131.791082][ T26] audit: type=1804 audit(1589065793.438:2367): pid=19371 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1984/bus/file0" dev="overlay" ino=15748 res=1 23:09:53 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x2000000) 23:09:53 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000040000000000003e"]) 23:09:54 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x74}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:54 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, 0x0) [ 1131.958141][T19395] overlayfs: unrecognized mount option "upper" or missing value [ 1131.991671][ T26] audit: type=1804 audit(1589065793.688:2368): pid=19378 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2386/bus/file0" dev="overlay" ino=15743 res=1 23:09:54 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1132.084211][T19400] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1132.147682][ T26] audit: type=1804 audit(1589065793.778:2369): pid=19387 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2386/bus/bus/file0" dev="overlay" ino=15830 res=1 [ 1132.209073][T19406] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1132.247842][T19403] overlayfs: './file0' not a directory [ 1132.268648][T19413] overlayfs: './file0' not a directory [ 1132.280610][T19410] overlayfs: unrecognized mount option "upper" or missing value 23:09:54 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:54 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000050000000000003e"]) 23:09:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x3000000) 23:09:54 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:54 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x7a}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:54 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[]) [ 1132.584850][T19417] ref_ctr_offset mismatch. inode: 0x3d84 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1132.615999][T19422] overlayfs: unrecognized mount option "upper" or missing value [ 1132.705445][T19430] overlayfs: './file0' not a directory [ 1132.714013][T19428] ref_ctr_offset mismatch. inode: 0x3d84 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:54 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[]) 23:09:54 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1132.756946][T19432] overlayfs: './file0' not a directory 23:09:54 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x4000000) 23:09:54 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xf0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:55 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000060000000000003e"]) [ 1132.847710][T19431] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1132.995472][T19439] overlayfs: workdir and upperdir must be separate subtrees 23:09:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1133.071299][T19441] ref_ctr_offset mismatch. inode: 0x3daa offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1133.167900][T19447] ref_ctr_offset mismatch. inode: 0x3daa offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1133.212600][T19449] overlayfs: './file0' not a directory [ 1133.280117][T19448] overlayfs: './file0' not a directory [ 1133.319715][T19453] overlayfs: workdir and upperdir must be separate subtrees 23:09:55 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:55 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[]) 23:09:55 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x5000000) 23:09:55 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x300}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:55 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00>']) 23:09:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1133.644217][T19462] ref_ctr_offset mismatch. inode: 0x3dc0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1133.648569][T19466] overlayfs: workdir and upperdir must be separate subtrees [ 1133.716968][T19467] overlayfs: './file0' not a directory [ 1133.729887][T19468] overlayfs: './file0' not a directory 23:09:55 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB]) 23:09:55 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x6000000) [ 1133.793943][T19473] ref_ctr_offset mismatch. inode: 0x3dc0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:55 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00>']) 23:09:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:56 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x500}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1133.923843][T19475] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1134.042637][T19482] overlayfs: failed to resolve './fil': -2 23:09:56 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB]) [ 1134.143656][T19486] ref_ctr_offset mismatch. inode: 0x3e1e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1134.205865][T19490] overlayfs: './file0' not a directory [ 1134.254122][T19486] ref_ctr_offset mismatch. inode: 0x3e1e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:56 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:56 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:56 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x7000000) 23:09:56 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000cc0000000000003e"]) 23:09:56 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x600}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:56 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB]) [ 1134.693538][T19505] overlayfs: failed to resolve './fil': -2 [ 1134.753886][T19508] ref_ctr_offset mismatch. inode: 0x3db9 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1134.785621][T19509] overlayfs: './file0' not a directory [ 1134.798438][T19504] overlayfs: './file0' not a directory 23:09:56 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1134.836797][T19508] ref_ctr_offset mismatch. inode: 0x3db9 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:57 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ff"]) 23:09:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x8000000) 23:09:57 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000300000000003e"]) 23:09:57 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x700}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1134.932097][T19516] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1135.061197][T19519] overlayfs: failed to resolve './fil': -2 23:09:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1135.143680][T19522] ref_ctr_offset mismatch. inode: 0x3db2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1135.250039][T19530] ref_ctr_offset mismatch. inode: 0x3db2 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1135.285956][T19531] overlayfs: './file0' not a directory [ 1135.295284][T19528] overlayfs: './file0' not a directory [ 1135.432638][T19536] overlayfs: failed to resolve './file': -2 23:09:57 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:57 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ff"]) 23:09:57 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xc000000) 23:09:57 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000500000000003e"]) 23:09:57 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x1400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1135.717311][T19548] overlayfs: failed to resolve './file': -2 [ 1135.751516][ T26] kauditd_printk_skb: 26 callbacks suppressed [ 1135.751530][ T26] audit: type=1804 audit(1589065797.849:2396): pid=19545 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2394/bus/file0" dev="overlay" ino=15900 res=1 [ 1135.788642][T19550] ref_ctr_offset mismatch. inode: 0x3e03 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1135.808287][T19551] overlayfs: './file0' not a directory 23:09:57 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000600000000003e"]) 23:09:58 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ff"]) 23:09:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1135.881009][ T26] audit: type=1804 audit(1589065797.879:2397): pid=19546 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1994/bus/file0" dev="overlay" ino=15862 res=1 23:09:58 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x10000000) [ 1136.015903][T19550] ref_ctr_offset mismatch. inode: 0x3e03 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1136.055840][T19556] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1136.072889][ T26] audit: type=1804 audit(1589065797.909:2398): pid=19552 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2394/bus/bus/file0" dev="overlay" ino=15905 res=1 23:09:58 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x2000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1136.140326][T19561] overlayfs: failed to resolve './file': -2 [ 1136.211369][ T26] audit: type=1804 audit(1589065798.219:2399): pid=19558 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/2007/bus/file0" dev="overlay" ino=15762 res=1 23:09:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1136.297373][T19563] overlayfs: './file0' not a directory [ 1136.348096][T19569] overlayfs: './file0' not a directory [ 1136.394884][T19572] ref_ctr_offset mismatch. inode: 0x3e1a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1136.409712][ T26] audit: type=1804 audit(1589065798.349:2400): pid=19562 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1995/bus/file0" dev="overlay" ino=15875 res=1 [ 1136.466961][T19572] ref_ctr_offset mismatch. inode: 0x3e1a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1136.560816][ T26] audit: type=1804 audit(1589065798.369:2401): pid=19568 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2395/bus/file0" dev="overlay" ino=15843 res=1 [ 1136.637777][ T26] audit: type=1804 audit(1589065798.419:2402): pid=19571 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2395/bus/bus/file0" dev="overlay" ino=15788 res=1 23:09:58 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, 0x0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:58 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00>']) 23:09:58 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffff"]) 23:09:58 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x12000000) 23:09:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:58 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x4000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1136.823675][T19582] ref_ctr_offset mismatch. inode: 0x3db7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:09:59 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1136.875639][ T26] audit: type=1804 audit(1589065798.979:2403): pid=19585 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2396/bus/file0" dev="overlay" ino=15890 res=1 [ 1136.919574][T19590] overlayfs: './file0' not a directory 23:09:59 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffff"]) [ 1136.991672][ T26] audit: type=1804 audit(1589065799.019:2404): pid=19584 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/1996/bus/file0" dev="overlay" ino=15898 res=1 23:09:59 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000ffcc00000000003e"]) 23:09:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x13000000) [ 1137.047080][T19595] ref_ctr_offset mismatch. inode: 0x3db7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1137.136674][ T26] audit: type=1804 audit(1589065799.059:2405): pid=19591 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2396/bus/bus/file0" dev="overlay" ino=15924 res=1 23:09:59 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x4800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1137.189348][T19598] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:09:59 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1137.406894][T19603] overlayfs: './file0' not a directory [ 1137.434030][T19607] ref_ctr_offset mismatch. inode: 0x3d49 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1137.466594][T19611] overlayfs: './file0' not a directory 23:09:59 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, 0x0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:09:59 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x4c00}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:09:59 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:09:59 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffff"]) 23:09:59 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000ff00000000003e"]) 23:09:59 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x3f000000) [ 1137.923507][T19621] ref_ctr_offset mismatch. inode: 0x3d9d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1137.993417][T19627] overlayfs: './file0' not a directory [ 1138.005658][T19624] overlayfs: './file0' not a directory [ 1138.033222][T19631] ref_ctr_offset mismatch. inode: 0x3d9d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:00 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffff"]) 23:10:00 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000ccff00000000003e"]) 23:10:00 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xe3260000) 23:10:00 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(0x0, 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:10:00 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x6000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1138.250604][T19636] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:00 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffff"]) [ 1138.428030][T19643] overlayfs: './file0' not a directory [ 1138.443403][T19652] ref_ctr_offset mismatch. inode: 0x3e24 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1138.464634][T19650] overlayfs: failed to resolve './bus': -2 [ 1138.511442][T19650] overlayfs: './file0' not a directory [ 1138.586203][T19648] ref_ctr_offset mismatch. inode: 0x3e24 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:00 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, 0x0, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:00 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) 23:10:00 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000010000003e"]) 23:10:00 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xe4260000) 23:10:00 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x6800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:00 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffff"]) [ 1138.973411][T19663] ref_ctr_offset mismatch. inode: 0x3d45 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:01 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1139.066572][T19666] overlayfs: './file0' not a directory [ 1139.089183][T19676] overlayfs: './file0' not a directory 23:10:01 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1139.108172][T19673] ref_ctr_offset mismatch. inode: 0x3d45 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:01 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000020000003e"]) 23:10:01 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x6c00}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:01 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xe4ffffff) [ 1139.278833][T19679] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:01 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000300)=""/176) [ 1139.439685][T19689] ref_ctr_offset mismatch. inode: 0x3d99 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1139.536993][T19685] ref_ctr_offset mismatch. inode: 0x3d99 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1139.577777][T19691] overlayfs: './file0' not a directory [ 1139.611143][T19697] overlayfs: './file0' not a directory 23:10:02 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x0, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:02 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffff"]) 23:10:02 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x7400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xf6ffffff) 23:10:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000300)=""/176) 23:10:02 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000030000003e"]) [ 1140.095072][T19706] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1140.145496][T19707] overlayfs: './file0' not a directory 23:10:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000300)=""/176) 23:10:02 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000040000003e"]) [ 1140.226380][T19717] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:02 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffff"]) 23:10:02 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xfeffffff) 23:10:02 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x7a00}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1140.410247][T19722] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1140.550837][T19725] overlayfs: './file0' not a directory [ 1140.575644][T19730] ref_ctr_offset mismatch. inode: 0x3e75 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000300)=""/176) [ 1140.667379][T19730] ref_ctr_offset mismatch. inode: 0x3e75 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1140.736962][T19739] overlayfs: './file0' not a directory 23:10:03 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x0, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:03 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000050000003e"]) 23:10:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xff000000) 23:10:03 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffff"]) 23:10:03 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xf0ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:03 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, 0x0) [ 1141.283665][T19757] ref_ctr_offset mismatch. inode: 0x3e25 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1141.295603][ T26] kauditd_printk_skb: 26 callbacks suppressed [ 1141.295619][ T26] audit: type=1804 audit(1589065803.389:2432): pid=19758 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2404/bus/file0" dev="overlay" ino=16067 res=1 [ 1141.310071][T19758] overlayfs: './file0' not a directory 23:10:03 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xff0f0000) [ 1141.360524][T19755] overlayfs: failed to resolve './bus': -2 [ 1141.375462][T19756] overlayfs: failed to resolve './bus': -2 23:10:03 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000060000003e"]) [ 1141.466342][ T26] audit: type=1804 audit(1589065803.469:2433): pid=19762 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2005/bus/file0" dev="sda1" ino=16225 res=1 23:10:03 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, 0x0) 23:10:03 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(0x0, 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc3e"]) [ 1141.506518][T19768] ref_ctr_offset mismatch. inode: 0x3e25 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:03 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xfff0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1141.617930][T19770] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1141.682014][ T26] audit: type=1804 audit(1589065803.779:2434): pid=19773 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/2012/bus/file0" dev="overlay" ino=15806 res=1 [ 1141.730855][T19771] overlayfs: failed to resolve './bus': -2 23:10:03 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, 0x0) [ 1141.803395][ T26] audit: type=1804 audit(1589065803.879:2435): pid=19777 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2405/bus/file0" dev="overlay" ino=15973 res=1 [ 1141.847403][T19777] overlayfs: './file0' not a directory [ 1141.925762][T19784] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1141.954669][ T26] audit: type=1804 audit(1589065803.969:2436): pid=19785 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2405/bus/bus/file0" dev="overlay" ino=15685 res=1 [ 1142.023597][T19791] ref_ctr_offset mismatch. inode: 0x3d88 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:04 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x0, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:04 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00>']) 23:10:04 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xfffff000) 23:10:04 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x003']) 23:10:04 executing program 0 (fault-call:6 fault-nth:0): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, 0x0) 23:10:04 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x1000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1142.406393][T19806] ref_ctr_offset mismatch. inode: 0x3dcc offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1142.438918][ T26] audit: type=1804 audit(1589065804.539:2437): pid=19801 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2406/bus/file0" dev="overlay" ino=15938 res=1 [ 1142.495297][T19807] overlayfs: './file0' not a directory [ 1142.497828][T19808] FAULT_INJECTION: forcing a failure. [ 1142.497828][T19808] name failslab, interval 1, probability 0, space 0, times 0 [ 1142.508283][T19801] overlayfs: './file0' not a directory [ 1142.529244][T19806] ref_ctr_offset mismatch. inode: 0x3dcc offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1142.587598][ T26] audit: type=1804 audit(1589065804.639:2438): pid=19812 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2406/bus/bus/file0" dev="overlay" ino=15975 res=1 [ 1142.588456][T19808] CPU: 1 PID: 19808 Comm: syz-executor.0 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 1142.621928][T19808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1142.632076][T19808] Call Trace: [ 1142.635378][T19808] dump_stack+0x188/0x20d [ 1142.639726][T19808] should_fail.cold+0x5/0x14 [ 1142.644677][T19808] ? setup_fault_attr+0x1e0/0x1e0 [ 1142.649720][T19808] should_failslab+0x5/0xf [ 1142.654141][T19808] __kmalloc+0x2d9/0x7a0 [ 1142.661432][T19808] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 1142.667681][T19808] ? tomoyo_realpath_from_path+0xc2/0x620 [ 1142.673414][T19808] ? lock_release+0x800/0x800 [ 1142.678181][T19808] ? __lock_acquire+0xcbb/0x4c50 [ 1142.683131][T19808] tomoyo_realpath_from_path+0xc2/0x620 [ 1142.688773][T19808] ? tomoyo_profile+0x42/0x50 [ 1142.693475][T19808] tomoyo_path_number_perm+0x1c2/0x4d0 [ 1142.701029][T19808] ? tomoyo_path_number_perm+0x17a/0x4d0 [ 1142.706762][T19808] ? tomoyo_execute_permission+0x470/0x470 [ 1142.712597][T19808] ? __fget_files+0x30d/0x500 [ 1142.717299][T19808] ? __fget_files+0x32f/0x500 [ 1142.719235][T19817] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1142.722010][T19808] ? do_dup2+0x520/0x520 [ 1142.722024][T19808] ? __sb_end_write+0x101/0x1d0 [ 1142.722045][T19808] ? vfs_write+0x161/0x5d0 [ 1142.743657][T19808] security_file_ioctl+0x6c/0xb0 [ 1142.748610][T19808] ksys_ioctl+0x50/0x180 [ 1142.752864][T19808] __x64_sys_ioctl+0x6f/0xb0 [ 1142.757810][T19808] ? lockdep_hardirqs_on+0x463/0x620 [ 1142.763105][T19808] do_syscall_64+0xf6/0x7d0 [ 1142.767830][T19808] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 1142.773727][T19808] RIP: 0033:0x45c829 [ 1142.777635][T19808] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1142.798027][T19808] RSP: 002b:00007f97c4ee9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1142.806449][T19808] RAX: ffffffffffffffda RBX: 00000000004e3ca0 RCX: 000000000045c829 [ 1142.814434][T19808] RDX: 0000000000000000 RSI: 0000000080044584 RDI: 0000000000000003 [ 1142.822503][T19808] RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 1142.830490][T19808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 23:10:04 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00>']) 23:10:04 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xffffff7f) [ 1142.838472][T19808] R13: 00000000000002c3 R14: 00000000004c5135 R15: 00007f97c4eea6d4 23:10:05 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x2000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1142.926899][ T26] audit: type=1804 audit(1589065805.029:2439): pid=19804 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2007/bus/file0" dev="overlay" ino=15799 res=1 23:10:05 executing program 2 (fault-call:7 fault-nth:0): mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1143.120176][T19827] overlayfs: './file0' not a directory [ 1143.154048][T19829] ref_ctr_offset mismatch. inode: 0x3dcc offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1143.215453][ T26] audit: type=1804 audit(1589065805.319:2440): pid=19826 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2407/bus/file0" dev="overlay" ino=15905 res=1 [ 1143.247747][T19831] overlayfs: './file0' not a directory 23:10:05 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xffffffe4) [ 1143.272743][T19829] ref_ctr_offset mismatch. inode: 0x3dcc offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1143.308686][T19808] ERROR: Out of memory at tomoyo_realpath_from_path. 23:10:05 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000ffffffcc0000003e"]) [ 1143.344118][ T26] audit: type=1804 audit(1589065805.449:2441): pid=19832 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2008/bus/file0" dev="overlay" ino=15787 res=1 [ 1143.351894][T19832] FAULT_INJECTION: forcing a failure. [ 1143.351894][T19832] name failslab, interval 1, probability 0, space 0, times 0 23:10:05 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x14, r1, 0x7, 0x0, 0x0, {0x7}}, 0x14}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:05 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x3000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1143.505672][T19832] CPU: 0 PID: 19832 Comm: syz-executor.2 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 1143.515592][T19832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1143.525656][T19832] Call Trace: [ 1143.528959][T19832] dump_stack+0x188/0x20d [ 1143.533305][T19832] should_fail.cold+0x5/0x14 [ 1143.537913][T19832] ? setup_fault_attr+0x1e0/0x1e0 [ 1143.543050][T19832] should_failslab+0x5/0xf [ 1143.547474][T19832] __kmalloc+0x2d9/0x7a0 [ 1143.551731][T19832] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 1143.557720][T19832] ? tomoyo_realpath_from_path+0xc2/0x620 [ 1143.564058][T19832] ? lock_release+0x800/0x800 [ 1143.568754][T19832] ? __lock_acquire+0xcbb/0x4c50 [ 1143.573738][T19832] tomoyo_realpath_from_path+0xc2/0x620 [ 1143.579291][T19832] ? tomoyo_profile+0x42/0x50 [ 1143.583985][T19832] tomoyo_path_number_perm+0x1c2/0x4d0 [ 1143.589453][T19832] ? tomoyo_path_number_perm+0x17a/0x4d0 [ 1143.595196][T19832] ? tomoyo_execute_permission+0x470/0x470 [ 1143.601462][T19832] ? __fget_files+0x30d/0x500 [ 1143.606189][T19832] ? __fget_files+0x32f/0x500 [ 1143.610884][T19832] ? do_dup2+0x520/0x520 [ 1143.613282][T19842] overlayfs: './file0' not a directory [ 1143.615131][T19832] ? __sb_end_write+0x101/0x1d0 [ 1143.615149][T19832] ? vfs_write+0x161/0x5d0 [ 1143.615173][T19832] security_file_ioctl+0x6c/0xb0 [ 1143.615193][T19832] ksys_ioctl+0x50/0x180 [ 1143.615213][T19832] __x64_sys_ioctl+0x6f/0xb0 [ 1143.643807][T19832] ? lockdep_hardirqs_on+0x463/0x620 [ 1143.649112][T19832] do_syscall_64+0xf6/0x7d0 [ 1143.653632][T19832] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 1143.659539][T19832] RIP: 0033:0x45c829 [ 1143.663524][T19832] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1143.683133][T19832] RSP: 002b:00007fcfbc679c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1143.692404][T19843] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:05 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xfffffff6) 23:10:05 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, 0x0) [ 1143.697102][T19832] RAX: ffffffffffffffda RBX: 00000000004e49a0 RCX: 000000000045c829 [ 1143.697112][T19832] RDX: 00000000200003c0 RSI: 00000000c0189436 RDI: 0000000000000004 [ 1143.697120][T19832] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1143.697129][T19832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 1143.697138][T19832] R13: 00000000000002f7 R14: 00000000004c5528 R15: 00007fcfbc67a6d4 [ 1143.880463][T19850] ref_ctr_offset mismatch. inode: 0x3db7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1143.888530][T19846] overlayfs: './file0' not a directory 23:10:06 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000fffffdfd0000003e"]) 23:10:06 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x2, 0x0) 23:10:06 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1144.140146][T19832] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1144.161906][T19856] overlayfs: './file0' not a directory 23:10:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xfffffffe) [ 1144.216571][T19848] ref_ctr_offset mismatch. inode: 0x3db7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:06 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x4000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1144.357678][T19860] overlayfs: './file0' not a directory 23:10:06 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x14, r1, 0x7, 0x0, 0x0, {0x7}}, 0x14}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:06 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000ff0000003e"]) [ 1144.417315][T19862] overlayfs: './file0' not a directory 23:10:06 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x10, 0x0) [ 1144.553490][T19873] ref_ctr_offset mismatch. inode: 0x3da4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1144.580954][T19874] overlayfs: './file0' not a directory 23:10:06 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x1000000000000) [ 1144.660125][T19875] ref_ctr_offset mismatch. inode: 0x3da4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:06 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x5000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:06 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x2, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1144.821856][T19878] overlayfs: './file0' not a directory [ 1144.852584][T19884] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x4c01, 0x0) 23:10:07 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000fdfdffff0000003e"]) [ 1145.035588][T19896] ref_ctr_offset mismatch. inode: 0x3d8d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1145.049172][T19894] overlayfs: './file0' not a directory 23:10:07 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x20000000000000) [ 1145.135680][T19893] ref_ctr_offset mismatch. inode: 0x3d8d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1145.156852][T19897] overlayfs: './file0' not a directory 23:10:07 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x6000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:07 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x541b, 0x0) [ 1145.315109][T19904] overlayfs: './file0' not a directory [ 1145.383068][T19909] ref_ctr_offset mismatch. inode: 0x3d92 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:07 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x14, r1, 0x7, 0x0, 0x0, {0x7}}, 0x14}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:07 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000ccffffff0000003e"]) [ 1145.565110][T19918] overlayfs: './file0' not a directory 23:10:07 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xf0ffffffffffff) 23:10:07 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x7000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:07 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x4b3b, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1145.677947][T19919] overlayfs: failed to resolve './file0': -2 23:10:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x5421, 0x0) [ 1145.793340][T19923] overlayfs: './file0' not a directory 23:10:07 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@']) [ 1145.895114][T19932] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1145.935942][T19934] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1145.982813][T19938] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1146.103977][T19940] overlayfs: './file0' not a directory [ 1146.117824][T19941] overlayfs: './file0' not a directory 23:10:08 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x4c01, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:08 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x8000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:08 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x100000000000000) 23:10:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x5450, 0x0) [ 1146.295341][T19948] overlayfs: failed to resolve './file0': -2 23:10:08 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000000000000000ff"]) [ 1146.383729][T19953] ref_ctr_offset mismatch. inode: 0x3d49 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1146.489988][ T26] kauditd_printk_skb: 19 callbacks suppressed [ 1146.490005][ T26] audit: type=1804 audit(1589065808.580:2461): pid=19956 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2013/bus/file0" dev="overlay" ino=15812 res=1 [ 1146.508227][T19956] overlayfs: './file0' not a directory 23:10:08 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x18, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x4}]}, 0x18}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:08 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x10000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1146.636998][T19967] overlayfs: './file0' not a directory 23:10:08 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x541b, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1146.692869][ T26] audit: type=1804 audit(1589065808.630:2462): pid=19962 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2013/bus/bus/file0" dev="overlay" ino=15859 res=1 23:10:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x5451, 0x0) 23:10:08 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x200000000000000) [ 1146.791103][T19969] overlayfs: './file0' not a directory [ 1146.856579][T19974] ref_ctr_offset mismatch. inode: 0x3d9f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:09 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000200000000003e"]) [ 1146.894686][ T26] audit: type=1804 audit(1589065808.860:2463): pid=19969 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2414/bus/file0" dev="overlay" ino=15772 res=1 [ 1146.987340][T19974] ref_ctr_offset mismatch. inode: 0x3d9f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1147.014109][ T26] audit: type=1804 audit(1589065808.910:2464): pid=19973 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2414/bus/bus/file0" dev="overlay" ino=15743 res=1 [ 1147.016770][T19982] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:09 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x5421, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1147.139944][ T26] audit: type=1804 audit(1589065809.190:2465): pid=19984 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/2017/bus/file0" dev="overlay" ino=15908 res=1 23:10:09 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x14000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1147.218914][T19988] overlayfs: failed to resolve './bus': -2 23:10:09 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x5452, 0x0) [ 1147.304710][T19991] overlayfs: './file0' not a directory [ 1147.314013][ T26] audit: type=1804 audit(1589065809.200:2466): pid=19978 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2014/bus/file0" dev="overlay" ino=15751 res=1 [ 1147.372795][T19990] overlayfs: './file0' not a directory 23:10:09 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000300000000003e"]) [ 1147.407513][ T26] audit: type=1804 audit(1589065809.380:2467): pid=19991 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2415/bus/file0" dev="overlay" ino=15749 res=1 [ 1147.455392][T20003] ref_ctr_offset mismatch. inode: 0x3d8f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:09 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x300000000000000) [ 1147.589325][ T26] audit: type=1804 audit(1589065809.450:2468): pid=19996 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2415/bus/bus/file0" dev="overlay" ino=15773 res=1 23:10:09 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x5450, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1147.651413][T20007] overlayfs: './file0' not a directory 23:10:09 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x18, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x4}]}, 0x18}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1147.749480][ T26] audit: type=1804 audit(1589065809.630:2469): pid=20002 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2015/bus/file0" dev="overlay" ino=15847 res=1 23:10:09 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x5460, 0x0) 23:10:09 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x20000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1147.890479][T20015] overlayfs: './file0' not a directory [ 1147.908737][ T26] audit: type=1804 audit(1589065809.670:2470): pid=20004 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2015/bus/bus/file0" dev="overlay" ino=15786 res=1 23:10:10 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x400000000000000) [ 1147.973243][T20014] overlayfs: './file0' not a directory [ 1147.992668][T20018] ref_ctr_offset mismatch. inode: 0x3d9d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:10 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000400000000003e"]) [ 1148.095663][T20027] ref_ctr_offset mismatch. inode: 0x3d9d offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1148.141568][T20030] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:10 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x5451, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:10 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x40000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:10 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x6364, 0x0) [ 1148.370996][T20037] overlayfs: './file0' not a directory 23:10:10 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x500000000000000) [ 1148.524742][T20046] ref_ctr_offset mismatch. inode: 0x3e16 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:10 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000500000000003e"]) 23:10:10 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x5452, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1148.689260][T20049] overlayfs: './file0' not a directory [ 1148.731906][T20046] ref_ctr_offset mismatch. inode: 0x3e16 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:10 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x48000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:10 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x18, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x4}]}, 0x18}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:10 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x8912, 0x0) [ 1148.909350][T20058] overlayfs: './file0' not a directory 23:10:11 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x600000000000000) [ 1148.962843][T20057] overlayfs: './file0' not a directory [ 1148.994824][T20060] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:11 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000600000000003e"]) [ 1149.106350][T20064] overlayfs: failed to resolve './file0': -2 [ 1149.132121][T20068] ref_ctr_offset mismatch. inode: 0x3d87 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:11 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x5460, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:11 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x8933, 0x0) 23:10:11 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x4c000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1149.301242][T20077] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1149.446692][T20079] overlayfs: './file0' not a directory 23:10:11 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00>']) [ 1149.497106][T20081] overlayfs: './file0' not a directory [ 1149.522299][T20084] ref_ctr_offset mismatch. inode: 0x3e04 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:11 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x700000000000000) [ 1149.576314][T20087] overlayfs: failed to resolve './file0': -2 23:10:11 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x6364, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1149.653014][T20089] ref_ctr_offset mismatch. inode: 0x3e04 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:11 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0xae01, 0x0) 23:10:11 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x60000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1149.865082][T20099] overlayfs: './file0' not a directory [ 1149.932452][T20106] ref_ctr_offset mismatch. inode: 0x3de3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:12 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:12 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00>']) [ 1149.984758][T20109] overlayfs: './file0' not a directory 23:10:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x800000000000000) [ 1150.082592][T20113] ref_ctr_offset mismatch. inode: 0x3de3 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:12 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x8933, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:12 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x68000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:12 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0xae41, 0x0) [ 1150.347165][T20120] overlayfs: './file0' not a directory [ 1150.353413][T20123] ref_ctr_offset mismatch. inode: 0x3dae offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1150.379245][T20129] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:12 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000cc00000000003e"]) [ 1150.542299][T20138] ref_ctr_offset mismatch. inode: 0x3dae offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:12 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x400454ca, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1150.597775][T20134] overlayfs: './file0' not a directory [ 1150.605880][T20136] overlayfs: './file0' not a directory 23:10:12 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0xae80, 0x0) 23:10:12 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x6c000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:12 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xc00000000000000) [ 1150.812576][T20147] ref_ctr_offset mismatch. inode: 0x3da7 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1150.852620][T20146] overlayfs: './file0' not a directory 23:10:13 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000003000000003e"]) [ 1150.972394][T20151] overlayfs: './file0' not a directory 23:10:13 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1151.057211][T20155] overlayfs: './file0' not a directory 23:10:13 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x400454cb, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:13 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x74000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:13 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0xae9a, 0x0) [ 1151.161244][T20163] overlayfs: './file0' not a directory 23:10:13 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x1000000000000000) [ 1151.260106][T20164] overlayfs: './file0' not a directory [ 1151.303381][T20166] ref_ctr_offset mismatch. inode: 0x3d9e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:13 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000005000000003e"]) [ 1151.439174][T20176] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1151.442077][T20173] ref_ctr_offset mismatch. inode: 0x3d9e offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1151.509405][ T26] kauditd_printk_skb: 31 callbacks suppressed [ 1151.509422][ T26] audit: type=1804 audit(1589065813.600:2502): pid=20182 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2023/bus/bus/file0" dev="overlay" ino=15792 res=1 23:10:13 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x400454cd, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:13 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x7a000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1151.638064][ T26] audit: type=1804 audit(1589065813.620:2503): pid=20179 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir120219598/syzkaller.W15y56/2021/bus/file0" dev="overlay" ino=15752 res=1 23:10:13 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x40042408, 0x0) [ 1151.700694][T20185] overlayfs: './file0' not a directory [ 1151.768608][T20187] overlayfs: './file0' not a directory [ 1151.793165][T20190] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:13 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x1200000000000000) [ 1151.794882][ T26] audit: type=1804 audit(1589065813.840:2504): pid=20187 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2424/bus/file0" dev="overlay" ino=15783 res=1 23:10:14 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000006000000003e"]) [ 1151.944075][ T26] audit: type=1804 audit(1589065813.910:2505): pid=20193 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2424/bus/bus/file0" dev="overlay" ino=15778 res=1 [ 1151.973600][T20195] ref_ctr_offset mismatch. inode: 0x3d7f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1152.028257][T20196] overlayfs: './file0' not a directory 23:10:14 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x8cffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1152.075413][ T26] audit: type=1804 audit(1589065814.100:2506): pid=20196 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2024/bus/file0" dev="overlay" ino=15845 res=1 23:10:14 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000000c0)={0x0, 'batadv_slave_0\x00', {0x2}, 0x5}) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:14 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x40049409, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x400454ca, 0x0) [ 1152.233651][ T26] audit: type=1804 audit(1589065814.140:2507): pid=20202 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2024/bus/bus/file0" dev="overlay" ino=15779 res=1 [ 1152.297075][T20210] overlayfs: './file0' not a directory [ 1152.315995][T20206] overlayfs: './file0' not a directory [ 1152.322733][T20209] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:14 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x1300000000000000) [ 1152.375526][ T26] audit: type=1804 audit(1589065814.370:2508): pid=20206 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2425/bus/file0" dev="overlay" ino=15752 res=1 23:10:14 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00>']) [ 1152.430302][T20216] ref_ctr_offset mismatch. inode: 0x3d9a offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1152.540200][ T26] audit: type=1804 audit(1589065814.440:2509): pid=20213 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir245439690/syzkaller.JVZ70F/2425/bus/bus/file0" dev="overlay" ino=15689 res=1 23:10:14 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x40186366, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1152.588749][T20220] overlayfs: './file0' not a directory [ 1152.592120][T20225] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:14 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xf0ffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x40049409, 0x0) [ 1152.712086][ T26] audit: type=1804 audit(1589065814.580:2510): pid=20215 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2025/bus/file0" dev="overlay" ino=15827 res=1 [ 1152.842904][T20231] overlayfs: './file0' not a directory [ 1152.848585][ T26] audit: type=1804 audit(1589065814.610:2511): pid=20222 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir115228386/syzkaller.1AcJxA/2025/bus/bus/file0" dev="overlay" ino=15845 res=1 [ 1152.868937][T20234] overlayfs: './file0' not a directory 23:10:15 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000ffcc000000003e"]) [ 1152.901828][T20239] ref_ctr_offset mismatch. inode: 0x3db4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:15 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x3f00000000000000) [ 1153.001084][T20245] ref_ctr_offset mismatch. inode: 0x3db4 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:15 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x4020940d, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1153.088146][T20243] overlayfs: './file0' not a directory 23:10:15 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x40086602, 0x0) 23:10:15 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) 23:10:15 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xf6ffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1153.263447][T20252] overlayfs: './file0' not a directory 23:10:15 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xe326000000000000) [ 1153.380636][T20251] overlayfs: './file0' not a directory [ 1153.422060][T20256] ref_ctr_offset mismatch. inode: 0x3db0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:15 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000000000ff000000003e"]) [ 1153.490274][T20257] overlayfs: './file0' not a directory 23:10:15 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x4008ae90, 0x0) [ 1153.572198][T20266] ref_ctr_offset mismatch. inode: 0x3db0 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:15 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x80045518, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1153.619763][T20269] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:15 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffff7f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1153.831595][T20277] overlayfs: './file0' not a directory [ 1153.857452][T20278] ref_ctr_offset mismatch. inode: 0x3d9f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1153.876440][T20276] overlayfs: './file0' not a directory 23:10:16 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xe426000000000000) [ 1153.946796][T20286] ref_ctr_offset mismatch. inode: 0x3d9f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:16 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0x80086301, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:16 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="00000000000000000000ccff000000003e"]) 23:10:16 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffff8c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:16 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x4010ae67, 0x0) [ 1154.241966][T20292] ref_ctr_offset mismatch. inode: 0x3d83 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:16 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1154.350772][T20301] ref_ctr_offset mismatch. inode: 0x3d83 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1154.379644][T20305] overlayfs: './file0' not a directory 23:10:16 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0045878, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) [ 1154.457887][T20300] overlayfs: './file0' not a directory 23:10:16 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xe4ffffff00000000) 23:10:16 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000100003e"]) 23:10:16 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xfffffff0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:16 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x40186366, 0x0) [ 1154.772915][T20316] ref_ctr_offset mismatch. inode: 0x3d8f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1154.778960][T20322] netlink: 'syz-executor.1': attribute type 18 has an invalid length. [ 1154.810389][T20318] overlayfs: './file0' not a directory [ 1154.857110][T20328] overlayfs: './file0' not a directory 23:10:17 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0045878, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x401c5820, 0x0) [ 1154.911784][T20330] ref_ctr_offset mismatch. inode: 0x3d8f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1154.945900][T20334] overlayfs: './file0' not a directory 23:10:17 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:17 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000200003e"]) 23:10:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xf6ffffff00000000) [ 1155.203299][T20339] ref_ctr_offset mismatch. inode: 0x3d8f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1155.269068][T20342] overlayfs: './file0' not a directory [ 1155.271788][T20341] overlayfs: failed to resolve './file0': -2 [ 1155.319053][T20350] ref_ctr_offset mismatch. inode: 0x3d8f offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x4020940d, 0x0) 23:10:17 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc018945c, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:17 executing program 1: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x9f440cd949fe4132) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r1, 0x7, 0x0, 0x0, {0x7}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff8141", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e00000018000280140012"], 0x3}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x2004ffe7, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="02"]) [ 1155.424819][T20349] overlayfs: './file0' not a directory [ 1155.455395][T20354] overlayfs: './file0' not a directory 23:10:17 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 23:10:17 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000300003e"]) 23:10:17 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xfeffffff00000000) [ 1155.692409][T20365] ref_ctr_offset mismatch. inode: 0x3d76 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1155.748993][T20362] overlayfs: './file0' not a directory 23:10:17 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc020660b, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000000000000000ffffffffffffffcc"]) 23:10:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x4020ae46, 0x0) [ 1155.807088][T20365] ref_ctr_offset mismatch. inode: 0x3d76 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 [ 1155.868034][T20374] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 23:10:18 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000080)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 1156.013079][T20377] overlayfs: failed to resolve './bus': -2 [ 1156.021987][T20373] overlayfs: './file0' not a directory 23:10:18 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f0000000500)={0x0, 0x0, {0x0, 0x0, 0x0, {}, {}, @rumble={0x5}}, {0x0, 0x0, 0x0, {}, {}, @cond}}) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000000000000000000000000400003e"]) [ 1156.070717][T20380] overlayfs: './file0' not a directory [ 1156.132657][T20389] ref_ctr_offset mismatch. inode: 0x3da5 offset: 0x0 ref_ctr_offset(old): 0xfffffff6 ref_ctr_offset(new): 0x0 23:10:18 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0xff00000000000000) [ 1156.206786][T20387] ------------[ cut here ]------------ [ 1156.212387][T20387] WARNING: CPU: 1 PID: 20387 at fs/iomap/apply.c:51 iomap_apply+0xa0c/0xcb0 [ 1156.221087][T20387] Kernel panic - not syncing: panic_on_warn set ... [ 1156.227708][T20387] CPU: 1 PID: 20387 Comm: syz-executor.2 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 [ 1156.237630][T20387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1156.247715][T20387] Call Trace: [ 1156.251020][T20387] dump_stack+0x188/0x20d [ 1156.255365][T20387] ? iomap_apply+0x960/0xcb0 [ 1156.260040][T20387] panic+0x2e3/0x75c [ 1156.263952][T20387] ? add_taint.cold+0x16/0x16 [ 1156.268644][T20387] ? printk+0xba/0xed [ 1156.272640][T20387] ? kmsg_dump_rewind_nolock+0xd9/0xd9 [ 1156.278200][T20387] ? __warn.cold+0x14/0x35 [ 1156.283438][T20387] ? iomap_apply+0xa0c/0xcb0 [ 1156.288046][T20387] __warn.cold+0x2f/0x35 [ 1156.292313][T20387] ? iomap_apply+0xa0c/0xcb0 [ 1156.296914][T20387] report_bug+0x27b/0x2f0 [ 1156.301333][T20387] do_error_trap+0x12b/0x220 [ 1156.305971][T20387] ? iomap_apply+0xa0c/0xcb0 [ 1156.310632][T20387] do_invalid_op+0x32/0x40 [ 1156.315059][T20387] ? iomap_apply+0xa0c/0xcb0 [ 1156.319663][T20387] invalid_op+0x23/0x30 [ 1156.323831][T20387] RIP: 0010:iomap_apply+0xa0c/0xcb0 [ 1156.329086][T20387] Code: ff e9 0e fd ff ff e8 03 71 95 ff 0f 0b e9 07 f7 ff ff e8 f7 70 95 ff 0f 0b 49 c7 c4 fb ff ff ff e9 35 f9 ff ff e8 e4 70 95 ff <0f> 0b 49 c7 c4 fb ff ff ff e9 22 f9 ff ff e8 d1 70 95 ff 0f 0b e9 [ 1156.348706][T20387] RSP: 0018:ffffc90015dbf968 EFLAGS: 00010216 [ 1156.354778][T20387] RAX: 0000000000040000 RBX: ffffc90015dbf9c8 RCX: ffffc9000cede000 [ 1156.362756][T20387] RDX: 0000000000008ad3 RSI: ffffffff81ddc3ac RDI: 0000000000000007 [ 1156.370822][T20387] RBP: 0000000000000000 R08: ffff888097dec440 R09: ffffed1015ce710c [ 1156.379510][T20387] R10: ffff8880ae73885b R11: ffffed1015ce710b R12: 0000000000000000 [ 1156.387497][T20387] R13: ffff888033d295b8 R14: 0000000000000000 R15: ffffc90015dbfb50 [ 1156.395512][T20387] ? iomap_apply+0xa0c/0xcb0 [ 1156.400208][T20387] ? iomap_apply+0xa0c/0xcb0 [ 1156.404810][T20387] ? iomap_fiemap+0x2c0/0x2c0 [ 1156.409513][T20387] ? trace_event_raw_event_iomap_apply+0x430/0x430 [ 1156.416024][T20387] ? mark_lock+0x12b/0xf10 [ 1156.420471][T20387] ? __lock_acquire+0x2184/0x4c50 [ 1156.425619][T20387] iomap_fiemap+0x184/0x2c0 [ 1156.430136][T20387] ? iomap_fiemap+0x2c0/0x2c0 [ 1156.434827][T20387] ? iomap_to_fiemap+0x210/0x210 [ 1156.439787][T20387] ? tomoyo_path_number_perm+0x1ee/0x4d0 [ 1156.445539][T20387] _ext4_fiemap+0x178/0x4f0 [ 1156.446443][T20395] overlayfs: './file0' not a directory [ 1156.450050][T20387] ? ext4_ext_precache+0x5f0/0x5f0 [ 1156.450067][T20387] ? lock_downgrade+0x840/0x840 [ 1156.450149][T20387] ovl_fiemap+0x13f/0x200 [ 1156.450171][T20387] do_vfs_ioctl+0x8d7/0x12d0 [ 1156.474437][T20387] ? ioctl_file_clone+0x180/0x180 [ 1156.479482][T20387] ? do_dup2+0x520/0x520 [ 1156.483749][T20387] ksys_ioctl+0xa3/0x180 [ 1156.488001][T20387] __x64_sys_ioctl+0x6f/0xb0 [ 1156.492602][T20387] ? lockdep_hardirqs_on+0x463/0x620 [ 1156.497898][T20387] do_syscall_64+0xf6/0x7d0 [ 1156.502447][T20387] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 1156.508355][T20387] RIP: 0033:0x45c829 [ 1156.512256][T20387] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1156.531949][T20387] RSP: 002b:00007fcfbc679c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1156.540373][T20387] RAX: ffffffffffffffda RBX: 00000000004e49a0 RCX: 000000000045c829 [ 1156.548357][T20387] RDX: 00000000200003c0 RSI: 00000000c020660b RDI: 0000000000000004 [ 1156.556331][T20387] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 1156.564315][T20387] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 1156.572298][T20387] R13: 00000000000002f7 R14: 00000000004c5528 R15: 00007fcfbc67a6d4 [ 1156.582018][T20387] Kernel Offset: disabled [ 1156.586388][T20387] Rebooting in 86400 seconds..