, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r2, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4, 0x0, 0x2}, 0x0, 0x0) 05:22:11 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffff6, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:11 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffff5, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000400)='/proc/capi/capi20ncci\x00', 0x2080, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) r3 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r3, &(0x7f0000008880), 0x62a, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000680)={{0xa, 0x4e24, 0x68b, @mcast1, 0x6d6}, {0xa, 0x4e22, 0x3ff, @rand_addr="772c32286536c5440e59ae73948f4a0a", 0x81}, 0x4, [0x7, 0x3, 0x1, 0x7, 0x1f, 0x6, 0x3, 0x39e]}, 0x5c) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0xffffffffffffff66, 0x2, 0x1, 0x0, 0x5, 0x0, 0x0, 0x2}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4}, 0x0, 0x0) [ 659.315266][ T26] kauditd_printk_skb: 5 callbacks suppressed [ 659.315285][ T26] audit: type=1804 audit(1574140932.585:209): pid=19697 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/361/file0/file0" dev="loop4" ino=435 res=1 05:22:12 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100500, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:12 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffff7, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:13 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:13 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) getpgrp(0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000380)) timer_create(0x1, &(0x7f0000000840)={0x0, 0x3a, 0x2, @thr={&(0x7f0000000680)="05101700f43b91bdd9615571aabdb1250ebfaee0758069cf65077526c8458a3f81c791b99a447dbc966f2cd04b14ca2bb7bfa49e951d68e22a7c075c75bd17a583d8fe80a3c3e71494232cd7821b22107001036377f37a04b1ef7fbc4ac3964e9c3f045d16b9916dd69063f6b9504e1e829c622d1c64a56bf973399f3c4dd87ee703cde46aeba24a915da51f534961cf812fb9d505e85c1279682913ab3230833cc49dfc573183bdd8b271f1ae51e1113408b8f1dc0ebc78ce7df68bfe9f8bdac1927b71ff2ea47a4f4f4556c6b98ddedddb0f1d30e675e82e3601b4e9", &(0x7f0000000780)="fae7ffc979762a59352a586c189ed9149b4b005b857ad5a040e255b303726d81dd9a7ee22ff336d000120b060423616fb0bf40df1202c260abdb7f8497f79706f66da4ca81e2e55d2924c521ff3d5bb0bd9f6853b94ed0707867fefc4b8e82d168949b72d764701bedbe3212db40b7c1dfbaf0a538d418e39054338f929cad8525f717fbc43e"}}, &(0x7f0000000880)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:13 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) r1 = open(0x0, 0x8001141042, 0x0) write(r1, &(0x7f0000000000)="b6", 0xfffffe7e) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f00000002c0)={0x40, 0x0, 0xffffb321, 'queue1\x00', 0x1}) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000380)) sched_setscheduler(r2, 0x6, &(0x7f0000000380)=0xf0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000240)={0x5, 0x80001, 0x1, 0x0, 0xe, 0x2, 0x6, 0x1, 0x6, 0x1000, 0x0, 0xfff}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4}, 0x0, 0x0) [ 660.454874][ T26] audit: type=1804 audit(1574140933.725:210): pid=19744 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/346/file0/file0" dev="loop0" ino=439 res=1 [ 660.519621][ T26] audit: type=1804 audit(1574140933.775:211): pid=19773 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/346/file0/file0" dev="loop0" ino=439 res=1 [ 660.604154][ T26] audit: type=1804 audit(1574140933.875:212): pid=19745 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/362/file0/file0" dev="loop4" ino=440 res=1 05:22:13 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000980)=ANY=[@ANYBLOB="656e633d6f616562636d616328626c6f776669736829000000000003cb0000000000ff0000000000000000000000000000000000000000000000000007000000000000000000e6a06682b6c36c8cc0204a90861b4616c27f8318eb63d94019f035558eef20094b61bddcb05e7b3f1fb586fa14282c2a2a3f7aae6df979d855dd7078b3faa246c6bfbd08b0c7505476c2ec91b2fa67169020052cacd819cf29ed94cf69b185d45a99a86b1e6cdab48e4d0f4d013e8e71ed7c13b852a50075792fcbff960640bc52184754276843e4012f3dc38e35decf0ba8cee0cc920d519f3fd50190e7bbe4e1ca91f144e6c5dd4d43c2bc45d4d88c7b2d0ec6fbf41cebd753c2198782cbad8f251e3baf033ed209cbd2f6707ea982719509967bfc5621aa77d3ccf9a0b247bb128d7ac4925a38de8e9c30224df3fd0fc09d3b8056d436266f8fb52f39b2a4a8b27622f220d269aeca5ea152e928318dd29516235a49a0ba2cc02b1362483ad2e93484c81a3f75dbd5950af6c8ff44630a7f73e1026989a3a8373766e4c216ef8c6da002c5687000000000000000005b0080184fcc99d61099bb29f9e513c8dadf1c69800badfa2e3bd43e772d18d1ed1c01281623a7b45879795ce52d3b038fe45cb5b8982f76c025bfac404d7c70a7cf826ec93761e77b63bfb8dafef8ce7c12d6cde7a42a3cccc46b5dd5e44ab829ea9f596f608b37ebc0151c28330480b8efd685fb609697a2ae008a618b9d3a8a0cf180e7e2b0f654ad0e32626138b387e945eb1bd3f51dcff722ecd58c14c2283948b73c70b31c31a3e99eb9be3080c743845b064df24d907915d411ed7b38ab3f3d5558f9d08a11cf47a8641380548404dc11b3b88a9a077eddac029c00000000000000000000002984f8ae273099465190443d1f9eb85b75e8361483c97b0ddb4b8b59d951a1ee46a9fbb91af3a7132a1ce8a5cccb8f63c7e8d42b587ca9cdf01f0150e3e0955194afea896290b1ff9fadb98f15f2d350cb4177ee8d35121576c9730db9188d6abcf926"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:14 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100600, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffff8, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:14 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:14 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r3, 0x10e, 0x5, &(0x7f0000000400)=0xdb88, 0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:14 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000980)=ANY=[@ANYBLOB="656e633d6f616562636d616328626c6f776669736829000000000003cb0000000000ff0000000000000000000000000000000000000000000000000007000000000000000000e6a06682b6c36c8cc0204a90861b4616c27f8318eb63d94019f035558eef20094b61bddcb05e7b3f1fb586fa14282c2a2a3f7aae6df979d855dd7078b3faa246c6bfbd08b0c7505476c2ec91b2fa67169020052cacd819cf29ed94cf69b185d45a99a86b1e6cdab48e4d0f4d013e8e71ed7c13b852a50075792fcbff960640bc52184754276843e4012f3dc38e35decf0ba8cee0cc920d519f3fd50190e7bbe4e1ca91f144e6c5dd4d43c2bc45d4d88c7b2d0ec6fbf41cebd753c2198782cbad8f251e3baf033ed209cbd2f6707ea982719509967bfc5621aa77d3ccf9a0b247bb128d7ac4925a38de8e9c30224df3fd0fc09d3b8056d436266f8fb52f39b2a4a8b27622f220d269aeca5ea152e928318dd29516235a49a0ba2cc02b1362483ad2e93484c81a3f75dbd5950af6c8ff44630a7f73e1026989a3a8373766e4c216ef8c6da002c5687000000000000000005b0080184fcc99d61099bb29f9e513c8dadf1c69800badfa2e3bd43e772d18d1ed1c01281623a7b45879795ce52d3b038fe45cb5b8982f76c025bfac404d7c70a7cf826ec93761e77b63bfb8dafef8ce7c12d6cde7a42a3cccc46b5dd5e44ab829ea9f596f608b37ebc0151c28330480b8efd685fb609697a2ae008a618b9d3a8a0cf180e7e2b0f654ad0e32626138b387e945eb1bd3f51dcff722ecd58c14c2283948b73c70b31c31a3e99eb9be3080c743845b064df24d907915d411ed7b38ab3f3d5558f9d08a11cf47a8641380548404dc11b3b88a9a077eddac029c00000000000000000000002984f8ae273099465190443d1f9eb85b75e8361483c97b0ddb4b8b59d951a1ee46a9fbb91af3a7132a1ce8a5cccb8f63c7e8d42b587ca9cdf01f0150e3e0955194afea896290b1ff9fadb98f15f2d350cb4177ee8d35121576c9730db9188d6abcf926"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:14 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) socket$inet6_dccp(0xa, 0x6, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4}, 0x0, 0x0) [ 661.749628][ T26] audit: type=1804 audit(1574140935.025:213): pid=19817 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/347/file0/file0" dev="sda1" ino=16666 res=1 [ 661.793423][ T26] audit: type=1800 audit(1574140935.025:214): pid=19817 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16666 res=0 [ 661.816766][ T26] audit: type=1804 audit(1574140935.025:215): pid=19793 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/363/file0/file0" dev="loop4" ino=445 res=1 05:22:15 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffff9, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:15 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 661.860354][ T26] audit: type=1804 audit(1574140935.025:216): pid=19819 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/347/file0/file0" dev="sda1" ino=16666 res=1 05:22:15 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100700, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:15 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f0000000140), &(0x7f00000001c0)) r0 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r0, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x3) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) 05:22:15 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x284800, 0x0) ioctl$PPPOEIOCDFWD(r3, 0xb101, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) close(r4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:15 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000011, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:15 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) write$P9_RLOCK(r1, &(0x7f00000002c0)={0x8, 0x35, 0x2}, 0x8) socket$caif_seqpacket(0x25, 0x5, 0x1) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) ioctl$VIDIOC_ENUMAUDIO(r2, 0xc0345641, &(0x7f0000000240)={0x1, "f2ed032c11be481bd8f370ceb4f42ed745dc5051d399e1d03acd64b20c10319b", 0x1, 0x1}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000380)=""/46, 0xfffffe51) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4}, 0x0, 0x0) [ 662.934197][ T26] audit: type=1804 audit(1574140936.205:217): pid=19874 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/364/file0" dev="sda1" ino=16609 res=1 05:22:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 663.003045][ T26] audit: type=1800 audit(1574140936.205:218): pid=19874 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16609 res=0 05:22:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffffa, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:16 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100900, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:16 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000400)={0x10001, 0x3, 0x1}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:16 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000011, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:17 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4}, 0x0, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-control\x00', 0x108400, 0x0) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) 05:22:17 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) timer_create(0x0, &(0x7f0000000000)={0x0, 0x8014, 0x0, @thr={&(0x7f00000002c0)="564b88b6f723e2a23657babefb5401cc2c61255ad33beab3772c3246ff31fcd84fc535d0c49063e6865c035e70c86afd4110e224cbdac3fd1783390e47f2743860dd8d8e00007bba7c8428ec3951dbe6090c8ead6c573f1d9b00e0dc53cfd5084d4bbc80f2c25d3bb68f00ca9ad2586b7772a2ec5f05dc7557c0a93958fc950b4c60512ec517d9c81f5420f4d20c4a01c9e06c6ab85ff3173e809f7d41c8dc9ab39ecc8d4266d6a4e9d2cf1a13c1", &(0x7f0000000380)="927d4bd0b27067f109872db6fc5e5855db2fee988d1065eb2bbf754406c440b16a21f54679f6a4a4083599b0d838803b5a19ea3858879510a5077203d5779d989bde4ae444b8274df7d6f026f85b41fdcfcba3c2854f008f9db74237314619362f3b6032846fde71384f24"}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = syz_open_dev$media(&(0x7f0000000240)='/dev/media#\x00', 0x3, 0x4000) setsockopt$bt_BT_CHANNEL_POLICY(r2, 0x112, 0xa, &(0x7f0000000200)=0x7fff, 0x2) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4}, 0x0, 0x0) 05:22:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f7766697368290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007c26958f2d1f1c93234884f7141b0fab5c62f53e1e1739cfd89154b0e93d7a29341c900be241d7846b581f40853313b2b4e90e915f1f6a1774a95b04cf93f585a286bcb3964f94684cb0c467456d23ced5d0d72da019b08f6ce41347ff073c5209f629ebdd104ffa6274e7df385a35f3ba1a1342280a96d8154df436e6ae1ae75a2cbe730b2453b4cbcd0d89e25067015ce5b879de8cd03d71"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r3 = socket(0x10, 0x2, 0x5) bind$inet6(r3, &(0x7f0000000380)={0xa, 0x4e24, 0xca, @remote, 0x2}, 0x1c) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffffb, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:17 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100a00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:18 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100900, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:18 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:18 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000f, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:18 executing program 2: perf_event_open(&(0x7f000001d000)={0x2, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd, 0x4000000}}, 0x0, 0x10000000, 0xffffffffffffffff, 0x1) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000400)={{0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r3, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000006c0)={0x4, &(0x7f0000000680)=[{0x100, 0x9, 0x7f, 0x6}, {0x3, 0x0, 0x85, 0x8}, {0x9, 0x8e, 0x2, 0x5}, {0x80, 0xd1, 0x2, 0x2}]}, 0x10) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 665.533483][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 665.533506][ T26] audit: type=1804 audit(1574140938.805:223): pid=19958 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/350/file0/file0" dev="loop0" ino=463 res=1 [ 665.734622][ T26] audit: type=1804 audit(1574140938.885:224): pid=19987 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/366/file0/file0" dev="loop4" ino=462 res=1 [ 665.847916][ T26] audit: type=1800 audit(1574140938.885:225): pid=19987 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=462 res=0 05:22:19 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffffc, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:19 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100c00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 665.950264][ T26] audit: type=1804 audit(1574140938.895:226): pid=19989 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/366/file0/file0" dev="loop4" ino=462 res=1 05:22:19 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x1, 0x1e, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_FPEXC(0xc, 0x20000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)=0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000400)='keyring\x00', 0x0, 0x0, 0x0, r2) r3 = add_key$keyring(&(0x7f0000000880)='keyring\x00', &(0x7f00000008c0)={'syz', 0x2}, 0x0, 0x0, r2) r4 = request_key(&(0x7f0000000840)='user\xed}\xd3\xf6`\xe8o\xf2A\xa1\xdd~\x9c)\x86O\xb3u\xfa{\xb9\xb1jo\x87\xa9\nWW*\xb0\xcaK\xba\x9c^\x94\xdc\xcc\x81C\x14\x95', &(0x7f00000002c0)={'syz', 0x0}, &(0x7f0000000300)='sywtem\x00', r3) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r4, 0xc7, 0xfd}, &(0x7f0000000940)=ANY=[@ANYBLOB="656e16ed51275eb0633d6f61657020686173683d6362636d616328626c6f776669736829000000000000000000000000000066e1ac190000000000000000000000000000000000000000000000000000000000dac60c8c6fcc591f751e53ca2a90626c46afd65fba6db82d80c74bc4e55a85bf7933ee95c76d5ed68b5dabf2f85be6df847fc9cc0a2dc0eceae32733e43117f53081c87989ae7a902b9aaddb597634a0f99bcda49b29b08e85e0a13800f8dc4074f924c25e9baf4d69714396b2fd04e9d7f1885c6c245c7708e5ac0d0d9d939eaa3ccb20595db77eec88d769b986b8583ede88a7baf66cc2bb4d"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) r5 = socket$caif_seqpacket(0x25, 0x5, 0x1) r6 = getpid() sched_setscheduler(r6, 0x5, &(0x7f0000000380)) timer_create(0x2, &(0x7f0000000680)={0x0, 0x15, 0x4, @tid=r6}, &(0x7f0000000900)) timer_create(0x2, &(0x7f0000000300)={0x0, 0x1b, 0x4, @thr={0x0, &(0x7f00000000c0)}}, &(0x7f0000000340)=0x0) timer_getoverrun(r7) timer_settime(r0, 0x3, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r8, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xf, &(0x7f0000000280)={0xeebf, 0xff}, 0x0) socketpair(0x8, 0x6, 0x4, &(0x7f00000007c0)={0xffffffffffffffff}) setsockopt$bt_hci_HCI_TIME_STAMP(r9, 0x0, 0x3, &(0x7f0000000800)=0x4, 0x4) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000240)=0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000400)={0x0, 0x0}) r12 = io_uring_setup(0x8f0, &(0x7f00000006c0)={0x0, 0x0, 0x8, 0x3, 0x100}) r13 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000740)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) r14 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r14, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) ioctl$ION_IOC_ALLOC(r13, 0xc0184900, &(0x7f0000000780)={0x3b, 0x4, 0x0, r14}) kcmp(r10, r11, 0x1, r12, 0xffffffffffffffff) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r15 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r15, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 666.074579][ T26] audit: type=1804 audit(1574140938.985:227): pid=19988 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/350/file0/file0" dev="loop0" ino=463 res=1 [ 666.226973][ T26] audit: type=1800 audit(1574140938.985:228): pid=19958 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=463 res=0 05:22:19 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:19 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000f, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:20 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f0000000140), &(0x7f00000001c0)) r0 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r0, 0xc7, 0xfd}, &(0x7f0000000380)=ANY=[@ANYBLOB="656e633d6f61657020686173636d616328624431a1d52d6c6f77662e138ef70000000000000000000000004001000100"/68], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) write(r1, &(0x7f0000000340), 0x41395527) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x800, 0x0) r3 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "07a30cd41929926a9335701c068b17b9fc07cd039f5a47009833063800"}}) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000440)={0x0}) ioctl$DRM_IOCTL_GET_SAREA_CTX(0xffffffffffffffff, 0xc010641d, &(0x7f0000000500)={r4, &(0x7f0000000480)=""/69}) ioctl$DRM_IOCTL_LOCK(r3, 0x4008642a, &(0x7f0000000300)={r4, 0x17}) ioctl$DRM_IOCTL_NEW_CTX(r2, 0x40086425, &(0x7f0000000040)={r4}) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000100)={r4, 0x1}) socket$caif_seqpacket(0x25, 0x5, 0x1) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) sendfile(0xffffffffffffffff, r5, &(0x7f0000000400)=0x7, 0x9) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r6, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) 05:22:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000400)='/dev/dlm-monitor\x00', 0x200, 0x0) ioctl$KDSKBLED(r2, 0x4b65, 0x9) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r4 = open(0x0, 0x8001141042, 0x0) write(r4, &(0x7f0000000000)="b6", 0xfffffe7e) ioctl$FS_IOC_GETVERSION(r4, 0x80087601, &(0x7f0000000680)) sched_setattr(0x0, &(0x7f00000006c0)={0x8, 0x3, 0x3, 0x20000003, 0x4, 0xf586, 0xc, 0x1000100000000}, 0x1cd19b432b90c1d9) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 667.174137][ T26] audit: type=1804 audit(1574140940.445:229): pid=20039 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/367/file0/file0" dev="sda1" ino=16704 res=1 [ 667.243128][ T26] audit: type=1800 audit(1574140940.445:230): pid=20039 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16704 res=0 05:22:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000d, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 667.295305][ T26] audit: type=1804 audit(1574140940.445:231): pid=20044 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/367/file0/file0" dev="sda1" ino=16704 res=1 [ 667.361765][ T26] audit: type=1804 audit(1574140940.555:232): pid=20045 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/351/file0/file0" dev="loop0" ino=466 res=1 05:22:20 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100c02, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffffd, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mISDNtimer\x00', 0x19080, 0x0) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:21 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000f, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dmmidi(&(0x7f0000000240)='/dev/dmmidi#\x00', 0x2, 0x760e04dec1d4684f) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vcs\x00', 0x95ee469e908ea736, 0x0) perf_event_open(0x0, r0, 0xb, r1, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) prctl$PR_SET_KEEPCAPS(0x8, 0x1) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r2+30000000}, &(0x7f00000001c0)) add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000680)={'syz', 0x0}, 0x0, 0x0, 0x0) r3 = request_key(&(0x7f0000000740)='syzkaller\x00', &(0x7f0000000700)={'Wy^', 0x1}, &(0x7f00000006c0)='/dev/ptmx\x00', 0xfffffffffffffff9) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r3, 0xc7, 0xfd}, &(0x7f0000000780)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d6163286200010000000000000000000000000000000000073f0000000000000000000000000000000000000000000000000000000000000000000000ea0c4f59147663f01cd20e717de121e1f50fb18d9950d3ba2504bf01314f5197a59c369bc1417c29c6af4d346f554fe00a00006edaaa964940922902dd0c60b10d53f42d1b2ec63c5e77cc945192201588414fceb4fb5664fc359b218b9cbda6fe8338e1334f8ebc6f1dd3"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}}, 0x0) uname(&(0x7f0000000400)) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:22 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000d, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:22 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100e00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'e\x01\x00=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:22 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000fffffffe, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) r2 = syz_open_dev$adsp(&(0x7f0000000400)='/dev/adsp#\x00', 0x1, 0x111100) waitid$P_PIDFD(0x3, r2, &(0x7f0000000680), 0x30000008, &(0x7f0000000700)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:23 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x120, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:23 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000d, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:23 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000d, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:23 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100ff6, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r3, 0xc008551b, &(0x7f0000000400)=ANY=[@ANYBLOB="010000002000000001000000fd02000000000000000000000400000006000000ff07000007000000"]) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) r6 = open(0x0, 0x8001141042, 0x0) write(r6, &(0x7f0000000000)="b6", 0xfffffe7e) flock(r6, 0x1) write(r5, &(0x7f0000000340), 0x41395527) ioctl$VIDIOC_ENUM_DV_TIMINGS(r5, 0xc0945662, &(0x7f0000000680)={0xffff23bc, 0x0, [], {0x0, @reserved}}) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) r3 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r3, &(0x7f0000008880), 0x62a, 0x0, 0x0) bind$inet6(r3, &(0x7f0000000400)={0xa, 0x4e22, 0x101, @rand_addr="2d69fb979b465cf4e6dfd668e765c33d", 0x1000}, 0x1c) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:24 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 671.461391][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 671.461427][ T26] audit: type=1804 audit(1574140944.735:241): pid=20201 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/370/file0/file0" dev="loop4" ino=476 res=1 [ 671.626953][ T26] audit: type=1800 audit(1574140944.735:242): pid=20201 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=476 res=0 [ 671.721143][ T26] audit: type=1804 audit(1574140944.775:243): pid=20202 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/370/file0/file0" dev="loop4" ino=476 res=1 05:22:25 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100002, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:25 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101100, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 671.832607][ T26] audit: type=1804 audit(1574140944.815:244): pid=20215 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/354/file0/file0" dev="sda1" ino=16717 res=1 05:22:25 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) r2 = syz_open_dev$adsp(&(0x7f0000000400)='/dev/adsp#\x00', 0x1, 0x111100) waitid$P_PIDFD(0x3, r2, &(0x7f0000000680), 0x30000008, &(0x7f0000000700)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 671.980643][ T26] audit: type=1800 audit(1574140944.815:245): pid=20215 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16717 res=0 [ 672.076951][ T26] audit: type=1804 audit(1574140944.815:246): pid=20213 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/354/file0/file0" dev="sda1" ino=16717 res=1 05:22:25 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000d, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) r0 = semget$private(0x0, 0x1, 0x4) semctl$SEM_INFO(r0, 0x4, 0x13, &(0x7f0000000400)=""/4) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 672.884141][ T26] audit: type=1800 audit(1574140946.145:247): pid=20261 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=478 res=0 [ 672.997607][ T26] audit: type=1804 audit(1574140946.275:248): pid=20269 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/355/file0/file0" dev="sda1" ino=16702 res=1 05:22:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100003, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100002, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 673.112835][ T26] audit: type=1800 audit(1574140946.305:249): pid=20269 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16702 res=0 05:22:26 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10f60f, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e633d6f624be81bf4060000006362636d616328626c6f776669736829000000000000000000000085cab976afbacd8885fcbb00000000210010e2c022aa9d0000000000000000000000000000008cfef82d72630020a405ca22f13d08e8476fa115e178d2dc86e6f293aef59c76caeae7cbd81d47435e2a9c0dcee352022c5de1aab13bb1b3aeed5e2bb3ba3a9e6c8a7497582aff43715e362fd3771b1ea7e27c9bb13e11128babe2ed000000000000000000"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = add_key$user(&(0x7f0000000240)='user\x00', 0x0, &(0x7f00000003c0)="f1d6275ef617a6431d89429288e0ac455d00867174541165cd16bb6d1e0c518e99686266942a368982062f14bf14b371f7c145615ce8b80270dfb3cfb2b3ba99b194f601cb40eb1d7d5a61c930794e97bbf467400a2607be65ddd8e7d0e6e8ad3dbe1a058f0bfa935f8e000cfc89ab0a680ce1995c79c96d75ffed5fa0c3ea145c05b486edff5720e527ffa7fb16edc136bc8f270eeed4ad3842ae9f912c747bdbd65923ce3ffd193d15d09649f199b4a3133e8b44b04c2f554be4fc296fca5132726b13685477328045", 0xca, 0xfffffffffffffffd) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000004c0)={r4, 0x0, 0xe}, 0x0, 0xffffffffffffffff, &(0x7f0000000500)="088237799872f22c7b66ac336315") keyctl$invalidate(0x15, r4) sched_setattr(r3, &(0x7f0000000400)={0x30, 0x4, 0x2, 0x0, 0x5, 0x0, 0x40003, 0xffffeffffffffffd}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:26 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000680)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:27 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000d, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 674.427643][ T26] audit: type=1804 audit(1574140947.705:250): pid=20313 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/356/file0/file0" dev="loop0" ino=484 res=1 05:22:27 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x50, 0x4, 0x40000000000008, 0x319, 0x0, 0x0, {}, [@typed={0x8, 0x2, @pid}, @typed={0x34, 0x3, @str='/eyringeth0vmnet1cgroupppp1[eth0vboxnet1user\x00'}]}, 0x50}}, 0x0) clock_gettime(0x0, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f0000000140), &(0x7f00000001c0)) request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) ioctl$KVM_DEASSIGN_DEV_IRQ(r2, 0x4040ae75, &(0x7f0000000100)={0x10000, 0x6, 0x2, 0x100}) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='cpuacct.usage_user\x00', 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)=0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0xc0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x5, 0x7, 0x8, 0x2}, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=0x81}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000300)={r5}, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000980)={0x0, 0xffffffffffffffff, 0x0, 0x5, &(0x7f0000000440)='f2fs\x00', r5}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={r4, r3, 0x0, 0xc, &(0x7f0000000400)='/\x02roup.stap\x00', r5}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000340)={r5}, 0xc) 05:22:27 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10ff0f, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:28 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100004, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 674.962837][T20338] netlink: 'syz-executor.3': attribute type 2 has an invalid length. [ 675.006671][T20338] netlink: 'syz-executor.3': attribute type 3 has an invalid length. 05:22:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000380)) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) tgkill(r2, r3, 0x10) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) ioctl$KDGKBLED(r5, 0x4b64, &(0x7f0000000400)) 05:22:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000240)='/dev/snd/pcmC#D#p\x00', 0x4, 0x280) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x800, 0x0) r3 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f0000000000)={0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "07a30cd41929926a9335701c068b17b9fc07cd039f5a47009833063800"}}) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000440)={0x0}) ioctl$DRM_IOCTL_GET_SAREA_CTX(0xffffffffffffffff, 0xc010641d, &(0x7f0000000500)={r4, &(0x7f0000000480)=""/69}) ioctl$DRM_IOCTL_LOCK(r3, 0x4008642a, &(0x7f0000000300)={r4, 0x17}) ioctl$DRM_IOCTL_NEW_CTX(r2, 0x40086425, &(0x7f0000000040)={r4}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r1, 0x4010641c, &(0x7f0000000300)={r4, &(0x7f00000002c0)=""/53}) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b4}, 0x0, 0x0) 05:22:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) r2 = socket$pptp(0x18, 0x1, 0x2) recvmmsg(r2, &(0x7f0000002640)=[{{&(0x7f0000000680)=@hci, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000400)=""/46, 0x2e}, {&(0x7f0000000700)=""/46, 0x2e}, {&(0x7f0000000740)=""/72, 0x48}, {&(0x7f00000007c0)=""/174, 0xae}, {&(0x7f0000000880)=""/166, 0xa6}, {&(0x7f0000000940)=""/236, 0xec}], 0x6, &(0x7f0000000ac0)=""/232, 0xe8}, 0xffffff8b}, {{&(0x7f0000000bc0)=@xdp, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000c40)=""/7, 0x7}, {&(0x7f0000000c80)=""/57, 0x39}, {&(0x7f0000000cc0)=""/164, 0xa4}, {&(0x7f0000000d80)=""/14, 0xc}], 0x4, &(0x7f0000000e00)=""/251, 0xfb}, 0x80000001}, {{&(0x7f0000000f00)=@can, 0x80, &(0x7f0000002200)=[{&(0x7f0000000f80)=""/21, 0x15}, {&(0x7f0000000fc0)=""/120, 0x78}, {&(0x7f0000001040)=""/169, 0xa9}, {&(0x7f0000001100)=""/193, 0xc1}, {&(0x7f0000001200)=""/4096, 0x1000}], 0x5}, 0x2}, {{&(0x7f0000002280)=@x25, 0x80, &(0x7f00000024c0)=[{&(0x7f0000002300)=""/175, 0xaf}, {&(0x7f00000023c0)=""/134, 0x86}, {&(0x7f0000002480)=""/42, 0x2a}], 0x3}, 0x40}, {{&(0x7f0000002500)=@xdp, 0x80, &(0x7f0000002600)=[{&(0x7f0000002580)=""/118, 0x76}], 0x1}, 0x4008}], 0x5, 0x20, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) socket$pppoe(0x18, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r4 = syz_open_dev$dri(&(0x7f0000002780)='/dev/dri/card#\x00', 0x9, 0x40) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000027c0)={0x1, 0x0, 0x1, 0xd0}) ioctl$DRM_IOCTL_AGP_FREE(r4, 0x40206435, &(0x7f0000002800)={0x5, r5, 0x0, 0x2}) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000002840)='/dev/dlm_plock\x00', 0x2c08ac6afd3afc4e, 0x0) inotify_rm_watch(r6, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r7, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:29 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100005, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:29 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:29 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x200000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:30 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x90000000000000b, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) pipe2(&(0x7f0000000400)={0xffffffffffffffff}, 0x80000) ioctl$LOOP_GET_STATUS(r3, 0x4c03, &(0x7f0000000680)) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 676.951692][ T26] kauditd_printk_skb: 9 callbacks suppressed [ 676.951711][ T26] audit: type=1804 audit(1574140950.215:260): pid=20384 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/374/file0/file0" dev="loop4" ino=488 res=1 [ 677.082156][ T26] audit: type=1800 audit(1574140950.235:261): pid=20403 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=488 res=0 [ 677.154369][ T26] audit: type=1804 audit(1574140950.345:262): pid=20412 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/358/file0/file0" dev="sda1" ino=16703 res=1 [ 677.247153][ T26] audit: type=1800 audit(1574140950.345:263): pid=20412 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16703 res=0 [ 677.299242][ T26] audit: type=1804 audit(1574140950.345:264): pid=20414 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/358/file0/file0" dev="sda1" ino=16703 res=1 05:22:31 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) pipe2$9p(0x0, 0x4800) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x2, 0x2, [@local, @random="1484883fd015"]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 05:22:31 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:31 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100006, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:31 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x200020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:31 executing program 1: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = memfd_create(&(0x7f0000001540)='}\xbf*x\x89-vO\xd3JUk\x88O\xc4N\xa2\rqI\r\xb3\xd9Q(\n\x1a\x9f/X\x1d9\x03\xc2\x16\xaf\x9d\xffl\xdcC\xeb\xa6\x96\x12$\xd15[z\x85\xf4\x1e\xcc\xfc\xf64\x00\x00\x00\x00\x00\x00\x00Pw\x1bN[\x81\x92\x15P\xc5\x0e\x06\x17\b\xaf\nu\xd8D9z\x9eR\bjh\xce\xa9j\xda\xf8B\x84\x8d\x12.\xeb\x95\x9a\n\xb2M\xc7\xd1\x87N\xc5Os?T\"\xfc\fc\x92\xbb>\xa3l\x9a\xc9\'\x14\xd5+\xb1\xa6\xf5\x9e\xd1\xea%\xd8l\xae\xd6\\dZ\x17/\xe7$(\x8ax\xdc\xc4\xb7\xa4\x9b\x92\xd8\x16Lz\x9e\xfc\xf8\xf1\xdc\xb9+F~%\x16e\x81\x1b\x11vw1:\xdd]\xb9\xe8\x99\xea\xd1O\x83\xf3WA\xad\xaa\xdc\r~[I\x9f\xac\x03\xf9\xe2\x12Je\xe9$\xd2\x00\xef\r\x9dQ2\xa1T4\xb4\x116RO+\x0e\x98\x8b\x1b\xc1\x81\xf0U\x93\xd1\xf7\xbb}N\'\xea\x8f\xbbdd\xda\xb5\x7f\xff\xef\xfd\xd5\x9b\x01?\xad \xa8\xe3l\x86\"\x94M\xd5\xfa]\x9f\x1d\xad\xf9y\xfc\x03=$Z\x00Oa#`qHd\xcc\x8f\x80\xa1\xed\x81 \x85\xe7\x1f\x99\xbe\xe8\xe5\xcey\n\xab\x8b\xa0yM\xba\xcf7}\x8eVQ\xe6d.S\x9e\xb1\x98\xd9\xc8;\xcc\xd5\xf2)\xf7Zh)\xffF\xb8\xc7\xd2%\xe9\xc7\x05\xefq\\\x97]\xd7\x1b\xdf\"o\xca\xd4\xe0\xd5\x125\xefz1\xcc\xe1nZ\xbe\x16\xa1\x8f\xc8)9\xb8\xc6\xc2\xdd8.*U\xe0\xc5\x04\x00\xd9\xfd{ZT\xf2\xe4\xb9\x95x\xa5\xbd\x04\x0f\x8eky\xd8\x8e\xd77\xd7\x0fp\n\x11\x13)\x9b\xf3D\xb2\x88*(\x02{\xb2`:\x01\x00\x00\x00\x00\x00\x00\xee\xff\xff\xffV2\xaa\x82', 0x0) r1 = memfd_create(&(0x7f0000001540)='}\xbf*x\x89-vO\xd3JUk\x88O\xc4N\xa2\rqI\r\xb3\xd9Q(\n\x1a\x9f/X\x1d9\x03\xc2\x16\xaf\x9d\xffl\xdcC\xeb\xa6\x96\x12$\xd15[z\x85\xf4\x1e\xcc\xfc\xf64\x00\x00\x00\x00\x00\x00\x00Pw\x1bN[\x81\x92\x15P\xc5\x0e\x06\x17\b\xaf\nu\xd8D9z\x9eR\bjh\xce\xa9j\xda\xf8B\x84\x8d\x12.\xeb\x95\x9a\n\xb2M\xc7\xd1\x87N\xc5Os?T\"\xfc\fc\x92\xbb>\xa3l\x9a\xc9\'\x14\xd5+\xb1\xa6\xf5\x9e\xd1\xea%\xd8l\xae\xd6\\dZ\x17/\xe7$(\x8ax\xdc\xc4\xb7\xa4\x9b\x92\xd8\x16Lz\x9e\xfc\xf8\xf1\xdc\xb9+F~%\x16e\x81\x1b\x11vw1:\xdd]\xb9\xe8\x99\xea\xd1O\x83\xf3WA\xad\xaa\xdc\r~[I\x9f\xac\x03\xf9\xe2\x12Je\xe9$\xd2\x00\xef\r\xbbQ2\xa1T4\xb4\x116RO+\x0e\x98\x8b\x1b\xc1\x81\xf0U\x93\xd1\xf7\xbb}N\'\xea\x8f\xbbdd\xda\xb5\x7f\xff\xef\xfd\xd5\x9b\x01?\xad \xa8\xe3l\x86\"\x94M\xd5\xfa]\x9f\x1d\xad\xf9y\xfc\x03=$Z\x00Oa#`qHd\xcc\x8f\x80\xa1\xed\x81 \x85\xe7\x1f\x99\xbe\xe8\xe5\xcey\n\xab\x8b\xa0yM\xba\xcf7}\x8eVQ\xe6d.S\x9e\xb1\x98\xd9\xc8;\xcc\xd5\xf2)\xf7Zh)\xffF\xb8\xc7\xd2%\xcd\xc7\x05\xefq\\\x97]\xd7\x1b\xdf\"o\xca\xd4\xe0\xd5\x125\xefz1\xcc\xe1nZ\xbe\x16\xa1\x8f\xc8)9\xb8\xc6\xc2\xdd8.*U\xe0\xc5\x04\x00\xd9\xfd{ZT\xf2\xe4\xb9\x95x\xa5\xbd\x04\x0f\x8eky\xd8\x8e\xd77p\n\x11\x13)\x9b\xf3D\xb2\x88*(\x02{\xb2`:\x01\x00\x00\x00\x00\x00\x00\xee\xff\xff\xffV2\xaa\x82', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') sendfile(r1, r4, 0x0, 0x40d5) gettid() tkill(0x0, 0x0) sendfile(r0, r4, 0x0, 0x40d7) [ 678.184588][T20451] picdev_read: 197 callbacks suppressed [ 678.184594][T20451] kvm: pic: non byte read [ 678.219654][T20451] kvm: pic: non byte write 05:22:31 executing program 1: creat(&(0x7f0000000100)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x800000, &(0x7f0000000240)='/selinux/policy\x00') gettid() tkill(0x0, 0x3c) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x8, 0x0, 0x1, 0x4000000000}, 0x0) ioctl$RTC_WIE_ON(0xffffffffffffffff, 0x700f) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) recvmmsg(0xffffffffffffffff, &(0x7f0000001e00)=[{{0x0, 0x0, 0x0, 0xfffffffffffffea3}}, {{&(0x7f0000001bc0)=@hci, 0x80, &(0x7f0000001d40), 0x0, &(0x7f0000001d80)=""/85, 0x55}, 0xffffffff}], 0x2, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4048000}, 0x44001) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r3 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r4, r3) r5 = perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x4, 0x8, 0x81, 0xf9, 0x0, 0x10000, 0x40, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x2, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x4, 0x4, @perf_bp={&(0x7f00000003c0), 0xb}, 0x20, 0x100000000, 0x1, 0x9, 0x20, 0xffff, 0x7f}, 0x0, 0xe, r3, 0x1) fadvise64(r5, 0x166, 0x1, 0x0) r6 = open(&(0x7f00000000c0)='./file0\x00', 0x1ada42, 0x0) ftruncate(r6, 0x28007d) [ 678.250009][T20451] kvm: pic: non byte read [ 678.260726][T20451] kvm: pic: non byte write [ 678.271571][T20451] kvm: pic: non byte read [ 678.280111][T20451] kvm: pic: non byte write [ 678.290068][T20451] kvm: pic: non byte read [ 678.297631][T20451] kvm: pic: non byte write [ 678.305810][T20451] kvm: pic: non byte read [ 678.315660][T20451] kvm: pic: non byte write [ 678.342961][T20451] kvm: pic: non byte read [ 678.369369][T20451] kvm: pic: non byte write [ 678.409543][T20451] kvm: pic: non byte read [ 678.414205][T20451] kvm: pic: non byte write [ 678.454926][T20451] kvm: pic: non byte read [ 678.458678][T20458] devpts: called with bogus options [ 678.468138][T20451] kvm: pic: non byte write [ 678.472925][T20451] kvm: pic: non byte read 05:22:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000400)=0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r2+30000000}, &(0x7f00000001c0)) r3 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r3, 0xc7, 0xfd}, &(0x7f0000000380)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f776669736829000000000000000000000000000000000000e7ffffffffffffff00"/78], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) r5 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r5, &(0x7f0000008880), 0x62a, 0x0, 0x0) r6 = openat$vimc0(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/video0\x00', 0x2, 0x0) ioctl$FS_IOC_GETFSMAP(r6, 0xc0c0583b, &(0x7f0000000680)={0x0, 0x0, 0x2, 0x0, [], [{0x7f5f, 0x9441, 0x7bffffff, 0x0, 0x4, 0x40}, {0x3ff00, 0x8000, 0x100000001, 0x4d, 0x7e, 0x2}], [[], []]}) pipe(0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r7, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) perf_event_open(&(0x7f0000000840)={0x1, 0x70, 0x37, 0x2, 0x3, 0x0, 0x0, 0x1, 0x4, 0x7, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x101, 0x0, @perf_bp={&(0x7f0000000800), 0x1}, 0x80, 0xc0, 0x3, 0x9, 0x3, 0x3d, 0x4}, r1, 0x10, 0xffffffffffffffff, 0x8) [ 678.520249][T20451] kvm: pic: non byte write [ 678.540390][T20451] kvm: pic: non byte read [ 678.544984][T20451] kvm: pic: non byte write [ 678.600494][ T26] audit: type=1800 audit(1574140951.875:265): pid=20461 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=16774 res=0 [ 678.778462][T20460] devpts: called with bogus options 05:22:32 executing program 1: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000180)='stat\x00') sendfile(r1, r2, 0x0, 0x1) [ 678.832581][ T26] audit: type=1800 audit(1574140952.105:266): pid=20460 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=16774 res=0 05:22:32 executing program 3: r0 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0xd, 0x0, 0x0) [ 678.974462][ T26] audit: type=1804 audit(1574140952.245:267): pid=20477 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/375/file0/file0" dev="sda1" ino=16770 res=1 [ 679.005671][ T26] audit: type=1800 audit(1574140952.245:268): pid=20477 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16770 res=0 05:22:32 executing program 3: openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) unshare(0x2000400) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0xaf01, 0x0) r1 = dup(r0) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f0000000100)={0x9, 0x0, 0x0, 0x0, 0x0, 0x3}) 05:22:32 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 679.117112][ T26] audit: type=1804 audit(1574140952.245:269): pid=20471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/375/file0/file0" dev="sda1" ino=16770 res=1 05:22:32 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x300020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:32 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100007, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) pipe2$9p(0x0, 0x4800) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x2, 0x2, [@local, @random="1484883fd015"]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 05:22:33 executing program 1: openat$md(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000540)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000340)='cgroup.subtree_control\x00', 0x2, 0x0) recvmsg$kcm(r0, 0x0, 0x0) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="2d63707520ff92b2f197d86ad80547edb4cd282eaa6ef7ad6224d7b3ecb7b7a2436978ac3aad2814b44d3d3a4a9f84247308000000cb95c665a50bd1a286b2445614306acda1963025e1dfa600a8713bc838b04a459a4600db8401f170d92e"], 0x5f) r2 = open(0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f00000001c0)=ANY=[], 0x0) syz_open_dev$sndpcmc(&(0x7f0000000480)='/dev/snd/pcmC#D#c\x00', 0x8, 0x0) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0xe850f50af522f5d) write$cgroup_subtree(r1, &(0x7f00000000c0)={[{0x2b, 'cpu'}]}, 0x5) open(0x0, 0x0, 0x0) 05:22:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) write(r1, &(0x7f0000000340), 0x41395527) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000400)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfffffffffffffd80}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:33 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$RTC_PLL_GET(r0, 0x801c7011, &(0x7f00000001c0)) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socket$inet_udp(0x2, 0x2, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r1, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0xfdea}], 0x1, 0x0) mbind(&(0x7f00003b5000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 05:22:33 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:33 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$RTC_PLL_GET(r0, 0x801c7011, &(0x7f00000001c0)) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socket$inet_udp(0x2, 0x2, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r1, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0xfdea}], 0x1, 0x0) mbind(&(0x7f00003b5000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 05:22:33 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x400020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:33 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100008, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e63e6837d27248c3d6f61a31620686173683d6362636d616328626c6f7566692518736829000000000000000000000000000000000000000000000000c1613942234eb7656d29d0b0b989c6922ee1538511f9d0691ef08bc8e7b829dae096e4e743e98b9c0b95e6f7d0de790fccbb4970099a20dc1951cdbe6964ece9722cc9e0fa33ac51d3f9dabd604b7d2c5ca47950d3ba73311d5fb0294aa3d5991bd476efb2710aa29fb5ed0e2e0e5575716ad69aa987da978a4537a6e9bd1bde53eb0af51932cb4cf7a6b8772b288d59e4dcf9769892500cf407eda7d0ed712b800442925a"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:34 executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x7c, &(0x7f0000000100)={r2}, &(0x7f0000000140)=0x14) 05:22:34 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) socket$inet6(0xa, 0x400000000001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x141042, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000080)) ioctl(r1, 0x1, &(0x7f0000000100)="814a") socket$inet(0x2, 0x0, 0x0) 05:22:34 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) flistxattr(r0, 0x0, 0x0) 05:22:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f776669736829000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c8d33126f9f0a1c32a0db1c73bde21d36690e15e5e39ea92b008aaa3ef168ed8ac7b8bb3cb3e55b21a6458e284fcf3e9d9613f404bb83389dd0f7d8dbe1116b81bacd8d6f914493ba2c3a4d070f314344144e65c22a68d194ca830e320ceac4cf0"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:34 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000002046, 0x0) dup2(r0, r0) socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000340), 0x41395527) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000400)=ANY=[], 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000600)) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x5) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') r3 = syz_open_procfs(0x0, &(0x7f0000000180)='stat\x00') sendfile(r2, r3, 0x0, 0x1) 05:22:34 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:34 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129cde3}], 0x1, &(0x7f00000001c0)=""/17, 0x10036, 0x7301}, 0x3f00) socketpair(0x0, 0x0, 0x0, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) r2 = gettid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00\xc7\xec\xac\xd9&{\x0f\x96\xad\xd1\x8fl![\x8f\xb9\f\xca\x1d\xc2{\xee\xb7\x03K\x0f\xa6\xaa;\xf6\x89\xf7b^\xa5\xafI\r\xc4\x9f\v\xf2\x1c\xdc\xddp2\xb7\xbb\x1b\xfev\xea\xed\xe0\xaa\xe8\xceR`\xbb\xf2\xed;pC\x19\xbfn\x16\xaa\x199\xfe.Q\xebvB\xd2\x19&l?\x87\x17H\x1f.\xdbA\x1b\xafz\xe3\xdc};*\xec\xfe\xfa\xfb/\x18g\x80y\xfe\x89', 0x26e1, 0x0) close(r3) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r3) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) perf_event_open(0x0, r2, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) 05:22:35 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x500020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:35 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129cde3}], 0x1, &(0x7f00000001c0)=""/17, 0x10036, 0x7301}, 0x3f00) socketpair(0x0, 0x0, 0x0, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) r2 = gettid() r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00\xc7\xec\xac\xd9&{\x0f\x96\xad\xd1\x8fl![\x8f\xb9\f\xca\x1d\xc2{\xee\xb7\x03K\x0f\xa6\xaa;\xf6\x89\xf7b^\xa5\xafI\r\xc4\x9f\v\xf2\x1c\xdc\xddp2\xb7\xbb\x1b\xfev\xea\xed\xe0\xaa\xe8\xceR`\xbb\xf2\xed;pC\x19\xbfn\x16\xaa\x199\xfe.Q\xebvB\xd2\x19&l?\x87\x17H\x1f.\xdbA\x1b\xafz\xe3\xdc};*\xec\xfe\xfa\xfb/\x18g\x80y\xfe\x89', 0x26e1, 0x0) close(r3) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r3) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) perf_event_open(0x0, r2, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) 05:22:35 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100009, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:35 executing program 5: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x8, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8000000}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000400)='/dev/qat_adf_ctl\x00', 0x533001, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000800)={r4, &(0x7f0000000680)="504b963a023ffb6c17a69c439c08c7db6746ccda3b0713797a208bc7fabbb87157a80d2c4e6b169ad68fa2919604606367e1761c5857475fadf0537250de02e8eff82e3275600b8139d67e88bfcb3181eb7febf9a5fa195088826fba75b4d3a3e6165ace1c5608be21c425c31d10ae29c6b9dc7e101167203c7904f2f6ee9f4885ae15c41408ee65e28e52cc09625084a0adefa7e7662ceabf23cc7150f4ecd045ec314045236040cc89b945e4a1abd505600fe6359ed3451a1ee45d6abff4a572", &(0x7f0000000780)=""/89}, 0x20) 05:22:35 executing program 1: syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl$RTC_EPOCH_SET(r0, 0x4122, 0x0) 05:22:36 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) open(0x0, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl(r1, 0x1, &(0x7f0000000100)) socket$inet(0x2, 0x0, 0x0) 05:22:36 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$kcm(0x10, 0x2, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r4, 0x5}, 0x1c}}, 0x0) [ 683.129342][ T26] kauditd_printk_skb: 12 callbacks suppressed [ 683.129362][ T26] audit: type=1804 audit(1574140956.405:282): pid=20679 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/362/file0/file0" dev="sda1" ino=16787 res=1 05:22:36 executing program 1: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000280)=[{&(0x7f0000000040)="480000001400190d09004beafd0d8c560284ed7a80ffe00600000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed4e00009052946f02", 0x48}], 0x1) 05:22:36 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129cde3}], 0x1, &(0x7f00000001c0)=""/17, 0x10036, 0x7301}, 0x3f00) socketpair(0x0, 0x0, 0x0, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00\xc7\xec\xac\xd9&{\x0f\x96\xad\xd1\x8fl![\x8f\xb9\f\xca\x1d\xc2{\xee\xb7\x03K\x0f\xa6\xaa;\xf6\x89\xf7b^\xa5\xafI\r\xc4\x9f\v\xf2\x1c\xdc\xddp2\xb7\xbb\x1b\xfev\xea\xed\xe0\xaa\xe8\xceR`\xbb\xf2\xed;pC\x19\xbfn\x16\xaa\x199\xfe.Q\xebvB\xd2\x19&l?\x87\x17H\x1f.\xdbA\x1b\xafz\xe3\xdc};*\xec\xfe\xfa\xfb/\x18g\x80y\xfe\x89', 0x26e1, 0x0) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 683.293392][ T26] audit: type=1800 audit(1574140956.445:283): pid=20679 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16787 res=0 [ 683.390718][ T26] audit: type=1804 audit(1574140956.445:284): pid=20681 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/362/file0/file0" dev="sda1" ino=16787 res=1 05:22:36 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x600020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 683.443684][ T26] audit: type=1804 audit(1574140956.455:285): pid=20690 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/378/file0/file0" dev="sda1" ino=16792 res=1 05:22:36 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10000a, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 683.504310][ T26] audit: type=1800 audit(1574140956.455:286): pid=20690 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16792 res=0 [ 683.561469][ T26] audit: type=1804 audit(1574140956.455:287): pid=20693 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/378/file0/file0" dev="sda1" ino=16792 res=1 05:22:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000800)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f776669736829000000000000000000000000000000000000000000000000040000000000000000326eb1e49e02fb0000000000000000000000000000005d514dd06c497fa6d5f9c46eb211dc3de47ca7e3e223a580066f3bc9e28453aa80549d48d671dbdaf4d8453d8121a5c11212b70938454b6f131d707505e61e2880412b3364027167757dda7640cbf122015f830342b9c29c1d0f91fcb024813f8ee94e131ed3a05da21ce46d71b7712a86430db9469e3276a004545c54964ec338135adf45501350e3bb9f2a1ed763a9956b3408a9427b4afffe2629f2adfa227987f1096a7ef3e92f02bf"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mixer\x00', 0x181880, 0x0) setns(r2, 0x2000000) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(0xffffffffffffffff, 0x28, 0x1, &(0x7f0000000380)=0x5, 0x8) sched_setattr(0x0, &(0x7f0000000040)={0xffffffffffffff7d, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/ptmx\x00', 0x50b6c0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000680)='/proc/self/net/pfkey\x00', 0x496829ffc6d8d274, 0x0) r4 = open(0x0, 0x8001141042, 0x0) chdir(&(0x7f0000000640)='./file0\x00') write(r4, &(0x7f0000000000)="b6", 0xfffffe7e) read(r4, &(0x7f00000003c0)=""/41, 0x29) 05:22:37 executing program 5: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:37 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[@ANYRES32], 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r1, 0x104, 0x4, &(0x7f0000000100), 0x4) 05:22:37 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) recvmmsg(r0, &(0x7f0000005540)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000001340)=""/4067, 0xfffffd89}], 0x1}}], 0x1, 0x100, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600), 0x4) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x170) 05:22:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r3 = open(0x0, 0x8001141042, 0x0) write(r3, &(0x7f0000000000)="b6", 0xfffffe7e) ioctl$KVM_S390_UCAS_MAP(r3, 0x4018ae50, &(0x7f00000006c0)={0x2, 0x9, 0xab9e}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000600)='Cpuacct.stE\xae\x00\xe7\xb5l4\x03U\xff\xf7\x02\xc0\x12\xce\xac\xbd\x04\x88cn\xb1\xa4\x81\xc0\x06\xfe\x1ct\x8e_\xd03\x90\x96\x01\x99YL\x1faq;\x1d-\x1b\a\x04\xe8`\xecv\xb9\xabW}e\x990\x9c@\x85\xba\xc8\xf0O\x8c\xff\x8b+O\'\x14\xe0\x1e4\xc0\bW8\x06\x1e\xc4\x8e\xb4>\xbf\xc8\x8a\xad\xf7}\xa2\x1a\xf8\x83\xc5\xe4\a\xc1\xcaK\'\xe4\xbb_\xfc\x1c\x11\x1f\x83?\x1dm\xbf\xbd\x80q7\xf0\xc1\x00\x90\xa3\xcb\rH\xefm\xa6\x8c\xc0q\xe6I\xe1]\xeb\xc6\xd3\xd9E\x04\xb7\xc3-F\xe6\xf7\x12\x1a63\x84\xc3\xa1w\x96\x9e\x8d\xb9\x96\x87\"O\x11x\xda', 0x275a, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)=0xc) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400014}, 0xc, &(0x7f0000000340)={&(0x7f0000001ac0)={0x14d8, 0x0, 0x0, 0x0, 0x25dfdbfe, {0x5}, [@generic="459830fd468e8830220e4bff13557a9bf92cdc5a825821dabf9cbfc92e2dda027aa02e56bf250d644f016543d8d173cbb897192526ed13d1634fd60daecd40bfee1f3e79cd1ddabd2ff7316385c04e82476850a665ebffdc17be51ddb1f4d0e7f6e7172a28aa8cde6df3be52750c21b4718e81f8bf1ac909ab239db04acdab6ec05947e87693d884a60225e1a5958b4599604e1c8b25e277adf5f809800e3ea37fe54f260dfc856619994539b13a88813930902789fb0e10f9fcea009f24914160de29ba703fb55c0c4793ee546ee892d8b731e6d2e0144913be0352b860bc7d4d08fa0940d6a55790855a0af11a41eefbdae89619a77717b933501ab33283903e8db507fab80f3eccdbb1f0bf3ed080a229115f9be816b476aac52767007b652716f75962f28a849a7a385602b1d92d5ccbdacf775ede63d4e148c24ae75651ee1b6cdd9cfe843d4ce3830604c0a4b6175c42160a814f802cee785d845bc24164c07c5e767aef386fe2281e22a5328015a9e9a59e21b6dc0075eb011e0f483959ba683b20e79f26feb2fa951f9235d81a0787e75db3bc6628133bd974462ef804df34682da9860eec335914866e7aecd41c841b2b938900f307ecdafa84a325d62eb9a8ab7ea449b18132eb634f59a81450c7598a784ed75ad5d596f9f52086e42dba9e424f537bef19225216710c5a04570a4ab2e87b01b72b5f2e5b3519652d5dc1fd035dd98358d4147469b9b810827f3e4d8b956e4ae37f71e35e1853a70e69bbe0c3f47174649f2f9360ddfac39a071609c5b205cb5e4763a40e4e58b50b8704354997bb60185d419b61f7617f5cc8428fb08e8dbc327b92ede6036ce94f475988a492b1728e77ee8cb2fff7bb6e401bffb69855aed42fac564cfca7ac214300a8cbab8506dd66b8c3d291db00d172e08f2933b90375d5c0a962605223f8588054043871ec5e5a76c19ac2c97660548699542c859dcd3d110b09575570d3ec46adc6b772f7f4b15962e61c3915b3582679c37488506d4e327cb80fbe19015c383ded63fcf5da80b77a2b843abae6324a46c324c60171e822a36054158c3f547e1846374e949bfc651068e3b65295bd844af9126ed38042d5b498fafa18eeab3aae8d40f17b91766ec65146ab2c5f3f508ec0d83d843367f1e7f31d5b47cb941057df6b0a9551b95254bf503c5490f41e1eddc0af75936977f5cde587a00c12d03d47c0cc5997e36c512cb6830f1260a7f571bb46281c549f568c2e651ed265997df1411cef280d86ae0825290378fc127706a90f59e8262803ab29e3c91c3d507d8ead7105e7f9dcc569061769803a6e8bd653b89edbd6b7fb1c5c042d36ddb2fc144365f580f55c33b03bd76a1abc91e4ce7d93736cdfb377712e5592d01c944760639a870268e4510fede8d821894396f1a9c9250815592bc15a7d3e991b9b77ef4a33b335cafca911db41e9a8c370a9abd038419c88d75f950c098d814f662fc99d5b1f55b22e3903f1a20f69b605c427db174b51660c67bc72cd8f5919de92dd14532d9d55ba085800775f9fd6dfc33f5a6cc1c1b0e7ad8ad9b569b251f2217cb6440749a8dee0ae85f50a1f4b5f5bd2b60aafd909c7cb6a7f5d9279ce416be9e230abc84ce7003386f1ff26e86f5f30f70d7b378cb295fc60db358b7c315c0fc10927b72ac18afa0ca93f915fcc010c1b6aa48179e6c2c8d5f066b1dac3131d88c64716ca626afa1418726e51dc699469f239242c4ca83057e8f9ae1a655c90548371d924a386094c2f2705b1abbd7a1966105cc21146b16111e131a1dd48cf6395277f7fd7f3ee8ad0dd9320b5efa474e800f146d50500674c14d5ee7136611ec72cf3f5eabd7bce22bce6a7c82aa451edc96d872fe649c20ba46ba1f4f22724d0f1cb08e138ebf62cb4c2a45fa1b7a415c416c0f81b5c6d8db6b41dee25fa8def08be26c15091402c4b27369beb33ea8ac54a1f5c77dba89ee4b659faec9bc3329b2647d0191215acbcd2c95d024327676313b933db1d8ecebc93373f4eca3a8c5e3489e171e539b56c2aa99b0e1dbe379d912e1f8f6f82adb652629c14c1d8750288edcb13784be403c759cf35ce63b0e29bb520ef985f33ead808cfceaab1591b46abdb54ce5a5b60f5c1926b059fae6c9801274eb0ec164c64562f396bec1f4e0938887b4dc9cb911ba02cb49c870270fe367af450f3b807bb461cc933096a68f64d7a8641d7d266d167d340b4f591330ca76d5cecd161f3d87aef288d3fd8f03251d93ed4319a2c2daf38e59cf049d9072534a2926835c6cf5e1c4fecea574a8f12690af69d57357a24c79af632cf8c909585575d9acead9a8e6665888f09df78785960697eb7079abc1e21c7b30f840233af8c8bdfa506d6b05c3a16975505b9cdc28cdc95ee6d9372fa7fa937fb4d0f1b376b4a9ba368bd1ccb17c561c581466f0fcd15648ccc01b1bd6ecbcc884f0c4fb83692d5de5dd108c4b917ff0f792e83b553768a5f59d34768ffc5b82d90a7f840d8b5aa8fe6dc271da12d0fc765965a8c215b592ca8ab31573b55d590a0c7f0fa50503e2f7d6bdfb34a3c62cf183a61a075086865275997afb13325438f9442f6aade29d1808036c3649437", @nested={0xd7c, 0x0, [@generic="bbef72aa38f13962ef7f279c228e2d8ef3dbcd2671d5358abde943ab15f130742998d351a1872c1c88998340dfca28b8c4a633e70583d568120b3303240d829570012afc4b721bbf492d9a054712a56d11862219786f06e8b37f7b0fef2ac911d05dc266166211293923fae6bc975e09af932446f2265bfaa8f9f140ace69f1bf8d8a3a6096087c0cb7bddc104cd74b8b9f4e3de2d4c8a7350c760f46af876f552f4d0b13a6e8f7f71f77136a64955bba374c9ba19e61003adab52e9548e6e8d2948397d69756cb66b38fe3f6f6d7cad0f88dd389bf7355e55ead279c066ef20e23f6b22a19ef40842850107963f983e92a95c397b87a092a1042a0e853472033e8cf235c2771ecf165590a0761ed6888df17af4e44f62a2d019a3dc115c02ce74d10162d2cf05b43361bf48c312af74277f6366055d78dfb7838ae5cd8f48a83511d4f836c5fa02132c190d3b1566e6a9aaaedbad88d97fac472e298d51333de46390440e0b01e8cce948dc7188f9d8de9fad8fbe202102a28f5a1799860d607bb3d99ce81dbe69f0e2989a5e194f56a0a0e1a4c0e652ab07333686ccc821ac40dbc4bc09c1b2c6950b97575527cc0a4700781d2985b4be66b8cb55dddbccf5534642b78a6e3d806fdf9ba3c552fb6fbaa29407b5cd9d527396815c4ebfa234ff78c6c31a8e2d646db79946da93efdb8b86645ca831f67840c47dd23e7e7d72250ce6913eb9f6acb8c51e2f7ca453307c5100aecca3b2eb423c37702a3f2460d13642ea94a8e1734aa8b4a3584455130edd722c24eda07959aff7ecaa4efbdfaced62e61292fe9fec1bbfe5527961e85b18d5752edb20578ce866d184d99922d61b54e7cde6eac8ffd4e350b7badf2619b18901194496bed20f945ecea1fc2370b1f14f17ea3da99b25d039e1c13fd207af9bde20bd85d17424e5bca7e0afc057ca9c2c17dca59cd9a2397d987136323362f43d2c0fa96645101a86811e399d680a668e803baeeee2619e88ed3ce47c88788c34dde569e67a611f478a656ef4475e489d673c8e69cd5057852ac3785c29e256f410a5027e2bcdab043e518842cf5b379fcb38b16770b1fa231c943a20e7efc7ff784ebda4580bae72beeb317c78b6cf6923395a1e23417ba7dda6ec33e9af6fdde2c907365d1c22740a476437527a0013ca19f5e2ff5bb68d2b428c8d890927de6db325a0a3162a4519c47ca0754d4e97ec4dab37ac1c89dcf05b622714501038362f89bbe1a2b1f5acb98854f81b145cd11ff8ca20915758707e1623a2d417f7ac8fcaf42c260a9dc92a6a74e3dba7d2a41ac098fe8e3120d20ec6586b06a649b4f05c52e307cbc6cecbaf1a95c3a603492df8764f8eed8c0e7bf6173d159924afa13d517e3c78370ffa9c602f611474519c4e5ac912fb7e61d9bb0f9428030984bae8959c03d7244e4c70b837ee9e60b6c36c9889c224002b0b5bd0424779612580f618203c07d8fee9898e6729a6516eb6ce2d83f3ae73c5b95aec1f0cbd8437c18bcdb4a49eca677fdbebacb0728a6c0f2e74edf763fd08f922efbeb7d6a844c19235a67c2df50ca9b5b29a6f9a65986460de65c246a7ea6df5f9f275fb1a3a9f38ed74e48cb31b14bc345e563ba4e117a2d3639545093a02cd96316a47394971985179187e02a66b5ec31105ba2a89ab2fb610ec0b5c172a13c58db850d6aec5714c816460b6fa6b319d74bfed73309fb85b27c7578280aef2c9cc1fc5c047dfeccb85e4ecbc2e0a9e67c92e65b00eec4ad9764e765af94fcda30fcb403532d76dc37eaecea35f119a13d931551ae62a56c137d5816f96847ea31b2c2bca705f29b2a9a449a61f64a8c3daa8d6f99dd46ed879bfc4f414e3651206f35e8436d89c488ea33a38d833aea14a68aa25c1c52a591e0c2ac88ddfdb04cd03a482306e8e594299fba24e913cf14bf657a2e0f62902e7a19f4a8947ca9ca1616e13b35508b8e9133504921cea6db0c1df1f5494bd5c2fef8b6a5a0848a5e3cd331d6ee84e00f0850a50509e3a1f10327d12523f5397ad2fa6a94533f8e7cc38e327deae4bd3cd3b31252194ca8813db4f3d2359fc1e690a4051115d9245ed84f824a3b95a9afdd8bd043c0802ebe4e07b96e040a90d5cdd3c5d3a452e413be1251240d9e177ff81ec3f8564c3b07eb79de44ff3706c52b0cfa1b2256a051a807b0a0a427c3ac8029b503b469e1466c22f74f869d5794096305721167ce6d974cc869bdb25ed15f1f7d4efb14395741b68b0218532655a8a219b11944243ca4e722ee0a95bc75cf5317814fe9713f36c645a469c06171b679a27adaa617e38c5577c22d70f493fee7a9e3313d531c647b3ddc982828bab9786fabeed08097a6d4517e0df617201cdbaf2e936f3f55556589f2d9c5d3cf754821349728ef9d7e7dac2d3e474f914da25b352fae59356679d7b8b3e8db19614e21b93168dbdfe0ff58add5c477003f5be5c66cd91f09b2928da3b458dbd3043e1f707099f34562c19c50779922226dbdfe3c998083f46f60cafbd708ff2640bdd046a99295169cf8d4caac140f1d0b266ca0de3c2dec408f4aba9c39ea40220851cfe2e0f6a332b827754e5345b5d2d525f62c07e46143f25db72e6b49c3b8b4cf023bc555360b4509b878f48b114292e80acaca81c741f685858376a929cde65c7fd93a1b23f1f37d5ba6f4eafbb640dba8c566e3c260fbff55090b0880804e28f829825dc2424cce9b566ca112ee5cf5f2e6c8f5371249306dd0b387f7f2c9548d2c53bc1f9fad9880ebbf59fd5f3f6d1a48663daef2e89bbb9fde75c9bb325affa1c9786f4c57a51d194f676c4cb1875377d843d7ede2e491e9bb876608e601964ae7375bece4697c38a457e433b9331954229b066d33f6b045a113f52cc842416c27fd5772a1dea5e09445d2d9631ff9835213d2cb80db1a5a6dfa9fb11037827a028b062bd2c9765035d9b7cbf24c225001af44aafc263b7fef390389a8a8da49001ba273a5166b4545eb31d28cbd155e76cd40afe99a08ef7fb9a61e4cae1a616b1c29df029739bd5713395382ea10d9ba708746f93303e90e98f46ecbc2fd0083c48b1f3955ad0767dc57affd8d240c52e9af78dd4ed6fe8cc259c5081e1f371b059a1e35373b038d29575b0a4aa4669d82e2e5e551f2514d21106701aa47b06049c9f47aaac93c846264a155258c2d04e5dcea8a344d3541fa10d4bc6d6624086feabc3f50f29800eba441b81494f57a4c9cb176d733320c63dd2c64edda3243b00984196134f7954251a787fd71ffc55d63c15a5a928ebbada7110b1c41626f2204d2243eb0ded17e29fba6d6946b991c4d98b9867dcf3c18ddf5db72cccc43570216374c9dc4920196c187d5325acd047b033e90fd64446c2befb2d356a7e38d6a4984a4362cee9cb4dc8aed8c569f576ca919bd236397974531b552ccf1d06db34f7e6e81672eb47bd994b1fef4e4f5187d7ce08408412b951c6f0fb8e96198e4e48285c7cb79ae04ecbd02e8d9b8e25790a3cabaa1acb6f74da78a23ee81c184d65330f8f74c48e76142aa6fbea432bab5e3cfb3c43514f2a2da4d4f1e8ac72829a9259aa9e664e87ddaaf443f294f8233fcad21b62008de6d963530f8a199ec3a5a07c2e28c09b30c897f26307fe2b2e22fc501036d5f0d93f2779f4b7824a9cb766773d1e617fa58a85e9419a6470fe7c6c6186c6637871ffd3d218b92e509220225bf2227104c8728f4d6ef5759b4360cf7924ed8973e5f03c9415a5824771cd1d47181aa27358effac56a8cbc648fb149f0ea4178e5dc5141d578ee1a5833f62801d693d4f53378dd7a2de912518bf65b9de6090324e14827f0b0f108768bd83d835c9e372fe21c9845e3fb6a248de8e9b7547751fbc519ac77453f5e2b15a37dd7801c4e60a8a27b853de5f09187e196719f78030b7b3244fbaf3832f41e40b90c71ba09cb4f0200e59a1f83a4005688014176c3029e09bf9e66f44b36db76b37a0bedf8753d8b84aabde7b947fc18c4c590013ac60c4a6d13f868a39e72d9ce9018575d20062b98ea49421451f240fc3acb5dc06fca6c61e82ac7990f34f48b95e29581a893f348222abd82fa670093557bb85f43cb164f3371aaf60ddcda741ef27813a3eb64c85c906b7cbe5c17774632d3f513840ab311eb5cac0986d29d57dd0224179f4abb878e0ab2f3e4cb5e05f49720b353eaa5aa3e625a33b5ffc037e707226f3c5f9c4c9c8038b8aa74e714c7a360f62b0f5203c41bd10fbcd82c4b863d439fc473f271e03ab529bcb076b410fa90a27cfdcf4ba344c125896dc9ace38bbfc1a5c6523449fe89b9cbed48f99184745a9240fe8e7cb3aed1ed29b305b8db5712ce6f374d39f419c54018215e95d65d6c4fb52dc292daff06ad2f2753395590b0db36f169fd3b934efdafd50bd369a6874eaaff89d3f6b597ec8499a6d831ac484d7561a5dabebfbc4ffec7a7f8e2226782f74658ad435b469f077cc27e3b54900c6208b33a70d5252fd92a8455c768ece212debd1313b51976c38eb56594539b9e0af3f4ab4fcdab85f234231e417b9616721cd440bd5a451306275027669ce926e33714a0b3fe9d948478e425707a076078f3b2f21ec7aa86c8bc002e6917b9e626d5bc8f817f60c006c9178dfe2220f005496a60fa93e91fe4b24c47e5f0c41a5a77fc35b5954c1be40bb0b5e7afa009ccb70225527515910870a598c9b457772b86e189e6d73cbad6e1077c0ad71c2c7be77c8c98202e68beefa27ae436050ecb3b6ba8836b87e844a0c7cb3d610be31f31a0a12f30b28fb6bb47c5dd35f58a4e90", @typed={0x14, 0x0, @ipv6=@remote}, @typed={0x8, 0x2, @uid=r6}]}]}, 0x14d8}}, 0x80) ioctl$SIOCAX25DELUID(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r6}) syz_mount_image$ext4(&(0x7f0000000400)='ext3\x00', &(0x7f0000000680)='./file0\x00', 0x5, 0x9, &(0x7f0000004940)=[{&(0x7f00000006c0), 0x0, 0x7ff}, {&(0x7f0000000700)="51ab9a43df1c3c3e02ba35b45202bcf1312584a53d1df3d10cc597ec1c2bb082be958fa4b24be70bc2ecd04805ce5530f6a81acbdf15dfc5234cc90aaf33fd16ddcde5c7ab828bebc8b5dd9bb6566658f0", 0x51}, {&(0x7f0000000780)="1c6093a55e4ed831f9120e728a453939798c2d01ecbdb8b4494b83c14ca2b8daad90dc5cd70f6ff8618fc0ee29570d35c86995c2de0e099f634d86c5cd7fac10f964580f3f3af25d65b3d426cccca5815663b39986e0d729851af46c81a90f6ead225516389a54ea0278ea1cd90bc433deb7663cef8d294e82ad4807c16e3fc9eb775404402cf9100ad65e3e548dc886ff42a965033d76648072a9b581d56af7e6abeaa04b047b664ea1059abb2760f8954bbc3e4996c147da41a9a7b843fd398a35103329df05de0dd5c76f3cb428ec97c67ffff71130e48e1b60e30a9bfc0c8412950a7008898831ed2d412fa7fbdfe56c767f7a1ffb8dc3f7c7ecd7a6133806d4016291c81b3e0e230b0685f24a74388120e2e9d17522a08092fa3a6bfcf6e6327713b48ae495a7e604e5210d50b820eed88ab938166a42db5754dab4586dd845c07b32023d733d04e812b351d285dc33f25825789ec08e2bc0547b69157cf3323ea772cc1d584a2bdb077f38b347b4f9926933a91059d020a06b5e053e2836501edbb9c904691973d04a6645728182ae147114d228a9348c15ed27a2a1e759a09f4c82e7aae81bf19d30f98e8eb09518228aa4a060cffc9d643dad1607a648a89ba0f9e9c1df1f3dea3f13ec4ba67b05800f314f08f78c08f741f72dbe926a8aafae02b69f24249c3978382c5f9815cc543fe772f48da409bbdcad9b4778b1c9c7f2d0cccb96d0a214042bd96148ed59d7be54c2eea0e44c40fed891b8e26054acd065a76605c753cc7a05fc57cc3feb00cc44aa33fe6087fbe3ab44591ac2cf22d6a09705fc32ed5ee33fa36a35098e9b26d32255b0506ce37f3db212eee570d850a6fea997d39c9e4b9ab5a38f0920332b642a8167a3cded28aa381360d891556978a3a171e8900fcac26b3a0792cb12fceac26968b79f399dc912566ce6dabd54ab062f8e5d09b2e1bacd24f74b0c3a262c59103002105e1ed908fd3cd3eb2f5a25f98a6247e7b93e497249e65eaee48b2d2238438d6844acae52b5361ed009c03c2b6013cdea464ccec0b3bdd414f0b3eb781b1f97cd52ba4ea3244643ff6ca04363d9422ea9a377040e93dcc46e0710899113a5d87a4acc472813eb7efd8c019d59a1fb76acbc7db2007e4fa8df53a4e2958bf4202736d6160109dcded5f671d4cd3364ec8dc82b8ba6243f87394f9cf59c24c9f4f9da358952db700a0bf12deeef6164d45b72687188264a6f0653c1221c204a186696d8b697ab8ac18033e8b549bf284ea8b30e36faf0334fb11b0fa28f0ee34d40e5ea7e1bd8124c534645fe2836a76c9fb2ecef9b97339fd832e2cc4ac7beba1e5e2e4bcf49172a8ab4acf24ab15b5cde17dd568c50b2356554630435525b83e8531743879a7f367d8a9e55318c51b75db2abf221d437e433411d9365d5949fe3d76eef6fa80d5e7460729b9660361034fd4b49dd54b95f658a1140a432d5df93e7518d0bb5db84600f01fa4a7133e3c3ba5db892cf8ff0fe0dbe51a6502d046eedb4ab7093e8da588e555a82bab09159a06e03769a1ea93314dee3c85ad86ea86a76c6d21fd6084e2b1f68c033f46c08fd050fea9bc9cae2c945f0dd9045b014594afa2a6b879f1cd7b8698921e79de4e09cd50e64eb75c24d7793e94720af4a8b5e538f15b3037187bba6a88b40d0ac23248de851e1a1e7791a6754d98613501eef9f018a7da37829d9e076e29b5b5869f9e3ef5e52375eb519d673b255294906c11569ec28438bcecd06a6a73bec92b216837d8f2d4a49797560be9a43f1f0fb7bbe488dba12a287ed24c3f3329e52c4913b1367f419989b8dcbacc662476f52d753471927a58fc0af0bcb077abd99d130c3d6f2148a69eb3c24328efe9b286f68b06ec9ed5ffabf49e9b1b91e184bbabb745e2e68fdca0b7acd75a1517de313ef1127bcdd1d15d45841bc0b8982111f6f855aaee445105eb4b17c660b6fb6d4452e22d619c656e3679e92d806f26c920b4b79791367f2c0ba4ef57d410fd3baf69edeeb43c06c332245c74d34ae7875160577cf9cec520d7d58cb717f39abe1ad7769595bed9215680ac9b8ade185b99078c54cf984f6394cf501c1fa01f13120918f791fd36b466b62969c00fddc583cbc069d3cd95f9a705c1489f57bd17d31315b90db81918e789d966506e2a3ddea17557c2d9344845437eb81ae51fd801061842b917ece448dd87c0823405f4ca964a3f94f8cf9f2c4e55d278a6310b014b85e5628911507406eb084455c4ed3628a84a6ae21a01752aebe465801f0b9aa2b1d6c8cdc5d3da7102eacb2857b2f5dcc65e11c43a82715fd7492eb1c6963ad7b3b353344541259ff23af49ce29148dd7fdb1c618d314340defc0dd74df203d7cde62546cf5481b3c09a50f9ab042bd6c38fc9477d54a17eb9f9fbcdc19ef3ce9254ed8ea1872753d8bbfdd8837b0f1981332233eb6d805459a0f69c13bd0b3bae34cec165cafa3d516e95edfe28e062ef57aefe120e3d954aab74b4a883babccd1b9a1ad611b4118e7545aa19ff60a1a823d31c3faacf6cd771c785601937ceca1d31fa5bd1e65ca1986dc07baf66300c0d763ef34e71b018ad2316c4720621350cc3dda5bc6f96a8d98131d15263492478ca1720a8b67fe08f4763557ca91ab183fb850a98e3c15a2f1e4abc682f5be9211862477eb0853d791f421d85282a4e68d86ab035732e104ef5084ed9a26836d4fc09d2f91368c8d224b713e92c4fba0eb11c1d71dfde5c70ed8282f9b959caa475f1f786f1691de5a22f3aea054e429161aaa4b2e8cd3f62821cdfc887596980993e849cc24f1a3972f945c7cdf146e2df97a211d76971ea001d554471c2c34f7b4dfd716fe985358f83299d92ce51a383b5b144228a1a2de66c4c09f40239b6da6f3bade730c8a678e05834c6d7374de2ac4d863b6bf8524fefe0f920c41399b5716df0a13668c1488ce38da88f279dfaace369f49b19d8bcf0dc484dd69b08ca69c75cb220ef48214e59b47588f22230d32008329fe640fd71a1242e2e72745d2fdd4fdc527965042e22bd7e379e9248f546905c3855bfad2536e82b6269e35197f9ec83d90088f526135025384da96e0d6a470ffe710d27e9945a01c49a14f0db2d82acbbc2b2010c8e2d9c6b2083623bd5c1f80443e90e09e220b6cb9c64659c2d2602b0066e1458b30a904b0cccb4de8fba2cc47a1ed6658a8e954dcc63545cd8e562b6657fc15e0f691c3fa8f8963a927f253073d63f3a975574665e1aeb011a62b2dc8405ebb7fb3fc8965727358be66301cfecc68efc6b675e580a6981ce19cdda951cfefe63acec34def8e25b1b4c682df2a4febf36b5c3f097d6c69c1cab210f3f469e9d558497051af23513a07b7b7e40a634f24b3dba561dbcd54e608dff751a01bdc65d9ad8f2e83ba47eb901b3ac8dfae7357fdd98ed7a3514c14c33b84074e578c671974d19507f2db1074469733ca291cad688769949a117b08eb610c6f08db8608d663d74b34885a9fb640153f6dae10cbd64ad79759c48e5b9ba8647258d632b1b8f0a5b053474cf15d1a05412fefb6653226572c71008c687d79312e5969ec5fa4ea6de4f5c8d7f61dea8c3cf2743024447c8c2d6d42eea8db193e8431626056a149c93c707bfc59fb3f32ff24f1622cb7082892216f055ca18b8a22c096fcfc4c42958954ad9f123efe1375c8f2d0c43a81eaf081e6420489cac41b3383481e8c45892423b6a8c5d60ddbb196d3cfad95f88993ec1dc945f4e62bc46e72f155a8004819d5b9f719be6b96b7d6c41adb756bb9d1681f125dcb9a2fa055f3374190d761805183fb1b4a638536a4d9279a2c9e513a46949878854069a6284d3d0248afe0f9b7bd1eae086f8a0ad318b2a01b1846be737a5b5774b4063cd6bdf0f2f6ae2e51807e54e2c4a16ceace53a885203aa7cb4e8961cb902658954abe42179b3579dc0707e1630ded79183f2ce886a44506b68644d589cf47b549681284f9061d433f35a466ab04fa9a83c2c142fe79adb68302b6d4be2b5c6a33660536ee5d600cd95eedbced574457d2c3adfc54a53697725089f36ca194297acdc407b1bbcb44e57f0b49ec2c7c1ecc589676f293e48bef05d266b96b023ba3f2f48e4f619281ef05607588ab25022a91d662b80b1de5c9bf6dd6d9b69c15e786c5aa54a939b8a95f8dd1c6244d7a5aef40e6a29ecfe1deedba44c6cd5a567a9f8eaf7fe39cef015e98cea0303d2473097772f0dded11bbc60ba4268dffc02a26b07d8b4eaa47c979ba65eb73ae7de5eb4915edcb8486d2a2cd92171e49a8bb425bbbc1f9f1d0aebd2a99d612275923be676cab9f04c914ed820fccc41a5c81f4c534bee97b913b3fe0e38ccae48623f778dd5b44ddb49c03c4000154696df259f573fbef1e5d0aca4ea832d9309e9a231d6b6914b48d7edaeb563a678973b13bb00ca03f131b8c3b278010562ed11beffde84b2d48f8b2276db325066a004f2fb9ec183b5c20fc6a022b61f99d015f95552145578a24a35e0bbd17143647c2c08dd3affba1a639775f8015d7ca11ddda568ae4d594293a8fa2925a91e968addd385e73e827f3059596801bd3a80ced4d6f3c45776d30dc1e28dec3865b0193e6fbcd1af02607e774be25639224b697ee408bf3f7087bafe98c183086a34ed2d9228ba5c52d05d7559de8dd7ba4804d9569f6e7604b2c164356a21f167bce8170fb69b45b7ffd81d10c30183c4e25309aa6664fd6303a04b59a385740d0215de1e76bd40a722e351a57a6c5a3c1533b46017b943696e9ab932b1a385831c6e8596535079e8e919485bb4e6327e0a1b2dd2336b0e646caa1d011b150570c77392e73f6ef6970872e568d19b71fa0eec31171b865c6f2e022b23fc057be63d16865cb437ea6646483901bf9155c6c080b70bce179e59213f7c36acc21aa0144dea1e10846af197aa945d98fbed6afb5c143542af1577417f9d7fb50eb1d0e4cfee1dbbe9ed7f95c363c94b089e98886936949b3d937d6f0c7554b97dbffa70b3d5d9894352cb0b1db3dba523c7e00fd3e12bfc52974a70cf3929a63b638d21e20db45e8da844f4c8aaf11f6d35c3befd7f9e3ec46a26c3bc38c7632be18fc784be01732b4f91ef9b3bf1b86ab06bdb60ca6f6d537589044d103ad6fc50e4b7d969701c375850745a7d52c012c60b154844fc510d50b68a27f169588127e8462957812e1202c78810982b49d7b34de2f6eb10ccf3acd1e0d8af3578f6e218d9347b9856da78423fdaa715b719a875cfdf485d035583333e23e6ee655609ecf1d44bb7c5d208c001e4f1e437b224f7b1d33dc8a2d368ea8cca217f9fe9529d7ffe47a306d664e777081fb035d49891f6de15403211628fc9cbb42faabc4c0314b46203df8ae7ade106726d5606ea51184e594e87d69c956eb407dcf15e425e7addb777033ad5168aca18912b6375f44bf6b8f188a6047b52b6bb28dd57c2f5eced5d2c6fddd6da953af82b2d9c5e2cf94678b6c0b2abc74cde33fd74c0c4e55908f2f319b9b645e689a6eec8bea6a8f9812ff8de823c0b21e89fe784b18a82e33c580b9796c5409e9748b47adc461a3b4fc3cde61b850667c36a3ba0cde4c563b11561de0daadfc5428e1991c322f75c8d9493419a43e6dcf90d68b93cacb4e445759bbd7d3e7c5c868fabd4a7d404081fb67f22d436656a1ef60d093d32fc6b44ba7d27996a716d7233030b11d35179b1056329633592e9a23c1bc5a1cad5a87d3ad9881c77a8d7f2dd73b0f08", 0x1000, 0x30}, {&(0x7f0000001780)="8ed5d3d2f2f60a70eaf026c79c2f2c8344ff311a0c8deb93daa9f030a1628a226862849dd9fed346ac43a1474eb6625aa4eb68006317be05b5f1381e869f35b35d", 0x41, 0x7f}, {&(0x7f0000001800)="f10020a137da6e4f0b9d9213cb0c4c94a24ef45a10427051fb35d2a2c3bc88af7457e7676d730d3dcd9bf44ba85397062ca86dff1bd890cd76eabe05c5c1daee95146f925bd64a1a3c522a66129c0262e2072c54396af2cd57d6515f2b7eac0b5fda0ca99fab8415a5bdd8b8f37b20d3941c6a90e33c8944dffd82cfc802a3d5f90d491259bce85f23a4fe4cc8b25f356657770d47b5b4a0ca7abf9fd2aac85e5495c4da1a5756d90c7e3356e278ab4e0da4e2f0b5fb5dcbed142c9cadd74e0df837602242dd60ddf4164e1545858d1dccb0f4d2bed54fe6162a18a2b7c393bf24219d07b00292ea5d87fb2388f2b48e97a46864df5ef7602d62ac28d7ef50fb117516351913c3c5977e5b8833eaf1d4a0da7d8a6b8ec6aecddab37738b2b9280b1381a2ac78ee11db0eeb0a02087bf43f8de248af229e79f05a70717b06226dd9f2a64a6dc52c3f4f28c483e79455417a011f994fd0a42d5a139e36b5672c919214a3c7b897d28c3b43613bc9ba17bf0aedc3306a51c90d131e08f06022afe6534d95d6e5ec25fdcf26aa47316bb69f12d86e0262c0381f03deb0dc981fee708c833751ba4309dd826496f2cf4873a2a888af69198826e6b09711fd2230bd02a8c87cb6d77ac3c5c5aa5faadded584974ea65a489987e4f3ec5aa21450c39d9c59f2a8b79d4ad721647db36d7ce5ea31657b7d060df9db6ab1ae217d0e37a873b2f2630df6cdd24376971b459a02c0bfe132bf376a8e897988a7466f81ddb179b3c09aa0daf8df7c9da689e0b135caa58ad750cc414db72afb40cbe50af4c1c3b8d4344a2530d077953722f7630f75b8b5f91dbfecb36d53b68b69defd6a147419aa35774bd20afcbed26694202fbcfe0866fb40a29e9cec20ee625f7526a8c17f25430a3778f97a80769b144f828db8ec14db1af75b99ce88d2c70080b5a4cb3816acad9addb74712e45c2789b82d078b8d770bcac1060b3d3c4c2717c53d37cb4324e149d9dcca3885005794203521e13585ff361bea3c3487a27ac80c35256befdbf6071f8a2f43c1173d3a4429f313cac71412e7578ecd6e6aee1a02db339db31d127b7b8a934de70c48f7b32872b1e20db2b3d38cb3964051f8ba7ad25435f366ed1d685ddaee6a0baeb863ba7c8900fc7805d95a322e17c1f629ed380ccf6b4250f57fe38faaad895b1043de4c1a4f222a39ab43a69257c4a1fc62b09d0a294abeec290ce5496f0e988e1aa4121bf250ee53a6ced8a7e645f1cfc2a07e262291b2df93bc4dcae18e92d7347a919f93b035242f17ff21979e4b8676501cd350bbb77dcb508c4ac1014055e4cd54ed21bba9a7dda35880f64fa2aa52c14e41b8090088f394ca4140f8e7c883b5ec040e49ca0deabb1eaac79b1272828579fb4e93d4c185f8eca6d8fab93631fd52ac5c0607f9990fc81a418aa92c115ce22698e67b54a0bf7dc83c8b5f75542d53ce8444b5a4e9d684146db92f54d7eda4fa7d4f856ef02fd76980ee20ce4f02210a804c0074f26c4a25808e5c7255f0047f31c899b2dcfabebfd1854edc141ead783c71505ac0da952dcc1a8792b8b7813e7d4d28e80beeba4dbd9d5ea4bd22a1dfc960a53d7592959c8fce90763f9457e2a6932be723235c8f21d6f7278a783b4576eed2f086cea79e86d6998799083375c3ede5760496ad36449ef15afc2f1605f100a86aeb2f0717b4a00eaa6a68e70f12a9078ba2da523ae79a7fc25740c9b53d08bb9f15dfc5b8a3a06e0e6155351157188142f7554b8545dbda94f03b718ed6699b306b5471cf6de98b7eeafd257958f9a0d5b0e022bc666914514928d87fada4a14c6abbfcba1453a314a29bf896e3759e8f71a41f1924c54d5f99f9ceea806c7591492c546f0c0bb62cf3647e00d67643100f21a00b4ccdb8a09c5913df4645db810a5bc82d1acf9f41b747bc50955eeccbd564188c3a15124abb2b79634c2ff0fc64bf850a9fa647c9870158a536a67e1d9b5070ff983e86f420ac1d68ef1e9905316541744127f0d45f87379697d7d442e406694517e1e6dd55e51272a7fe1780b9bb38f50ae68b641b99393f50affcd177c06866264d2e294e8c74d95000fcae5a8b724870e95a4272c566ec46ffd84f4b639aa7473677a28902e4d8c19c4cb05af676d323915240f50d1ec24a8dd75680f7af42d0be3f703c3fea573502917e89096118fc19037722977a9088ae2d94d124fd3da2fc2c36da9e9006e0bd73794a805ed6a43737dfd513e51d8e653e0b8a35c33d69c541e82a5610ca16de7fec2fc74be195e5f9d9fd7e8facb5b1aa8c30882404b87a34f37f0b0630a54af3d6a2697886356969ea286025e6b2d18ef12c4c1905e8c07486dba80be8e1471b7079d576017df4a0ecf4352b5f2178d175fff01522f9800404f2fcff7407f822a51d8934356faf74af94d7238fcfc0d6237f63f8f692599b4886bd69029005dd72640d6cf834b6c35dbda66f2b7c8be82fd1a70a941f6800d4caae1adddb19f05f0df2f2217dd0be10aabc78b8b6a7024147083ccb6214ec5e700b130fd2f2f8c285880f53e2df58a9d9233efcf03c8e4448eb3458b37bdb6ab7fc4cb799344d4364a6eda0de10fa8d8c0faff71f71f07ace861594b27edc380b56a2cb77199599600bf53126f5342ce55fdf79b3b7b420cc4283a25aaa474302d5fe2d4166fe05382d4238585b8ee78f77a1f9a633da758ab1729d4b82b903d3f74ab6533862d81d80bb2511aeed77fb49b8e26f24671a9219d0b2df36a54d36080461a4fd09ebc1c82d3fe298d1bb5caf5d84c2f4c4080936057e4a71ea2fdb0e4a6fbfc0cd4ae2f47e88acda231249ef52afa91e1368d2e50d0536bbbae409db0f4e4a05812985132b4bcc104c605bf244a2b5bf6cd46577481a0364ae03f5bd2f10a6de37bc0c800d37a1fd88f7f7b94a63afdfc46082edee25a100f8a7265dfc8f0dfcead8cfcb23b5320dbe5e302ee883a7618388a6ff4e24d755c3739070d871835c225b714569392614cfc1452a18ed595e7016810f4ec5ef6665706ccfb7047c55363d3a3d6b7fcb6e2179da7d6676db7efbdf2a356af524748269761f7e82a729ad14f5d99826d473629e17c904c92b8143fd0de0ce14fa538717ce1c13dfc0df1086e1ee0b66a8c910a2bbc5b4ca134f793a73f5ccd5aa278c50b652dff2dfc6db667171bc4ad7a46c029000f50d314eb1e9970c0a674911610eca55d843e6c48e9d3e48f68b09d798bf29252a20c71b7b8129aa3614dbc0253f6d5b765c9ad8548a6da9aca7b9881442eb193ceee18d01a72ff5769f913d361fb560bbea797d52287dffe622ec646eb64d9579690af61cbc8fca6f432d42e2790c4b0cc3ad97b0917ba920cbf595766e3019299f28959d7953be00db5e12734fdc5829fbe04210f59e8053319538003e939bccb7310aa98f187e962eeba6c8e9661724ffbb18b2607617d649162f021e6926168e04a7947bab1b7e5aa5a0bb6de4ba948be2b12aa408f311f50a2e807c77ad85d797750fdcd965905610f00c1378b9e2f6211144b167b62e2521291f0bc8585c8626aa3c6627f41ef7cd90a83ff9dab74835a426df7a42211c0636896c48834837685def20a71f0bc5c1af14deb73d86cf2dc0f74d4946da28bdbd7b71decae049516ed05db06317e72993b7ef513588fcafaed7e49b9e8e1379b45f800f181054f88ce6251d7af51cee975878814cd3b37e8c2fa1cfab162b5369a33e7b50fdb2730a7c2618c3b32430a3a97c1b5f29d07d5041a9f950e5b2c8e70a7af916cbd9cba4a2a3e38cb5f4429ddf369c902adaa41bd3694a4c23c82c99f509085eaacc514ea1595fc43cbdaed9a2928f319799da26f315c10454a47f6571f0980da7edda52d7aba357b8f15b7faeed3c2ea1f23cddb23a1a44e55bb43269e690df30ce652ce07ee6d2ab4299b382852b36eaf3afd3bf323fc01ae37b202ec0090ea3d2d979a124b038672b7f9d5e57785c63090678e4d10eb275b49ed241d0946bf7aa1ea70b6b33161c74403a0e31d4bebdb0002cc541df7cadff9b95a647e04632ca3b61986ef0a5f5d734dab319e5d75c0729771a247e0405fee48746719dbb7daadefa1d494bf5cfe1eb78a91099e1ad988ac794d9cfb56b6cbc44f69495584e1b6d7ef7719f7ff086f00ef6cfdba4f135472ddd2093c9bf9258b1542ccc060935c0c0d86333b98f411b0f12f1540512486411d02d02808032532537d2bbb8d0b02f779056c3c1efb2b6f2b55e58b1f9882ffb58763bf6995e396bbe328908d5d2fcd65cdaa8a063d0f28d1bc00db5deebd7278d6686cd1bc171abc1fbbb31c4efab444f6a4dbe1ab094269e137a9d8a8693f42dba27d22d6159f009c5f4fe23fa8e1655be469f0896a4aaf5ba8a876228bb53587321513b4dad5f45c68a2144e45a3c82fd45ee647b8043c5a022a78e787e623102b111c20c1dce470bad2e0ec45508a7c13379d9c7ae09560daf247a9b7bd6375690161e7d9f66ea77db8a2afef76b25453cd7ac9500642447ca2e54fdba456393102d936a3b4f8ef5d7ec09f9c23d42eaab98d69e39a129d579afc977c1e062980e49d4d2aace4d8e4241c78552d037e8e0b5b4b0d5fc915321d5994e00711199b7b984b899c16dae65148bc52cd2af4c02f1fadbfc18924ad2b3d389fed04fa716cc68907ae786242ea882302a8880ed2ac37aca9b144e513d52dbaf069e6a007ea2529a2606273611227b54e97bafc101e0c388d0f8ed35e4a6f050c8404060032beaccc90e819699bb45d745abd23f45dca3d5013fe460fd7514f4b8196ec2cd50d1efabbf03deaec67a67e22f86f14b184d31996c15bf680037154d39d9a673b93e68a9efe9ea79a6de893287416a6cbc9a6eb79d98bf36893a2b2bccbd04c1ead7382ab6bc048e0ce8905f42b4543915f4d844fe6964cd23f32370dc51b0fea197cb158022c780f75aa861df39ae9dde2bc05b53dee77fffda525ce7aa07ae5c226105cc9126bb7fe0f6bd07f2b119a83074b7808149536659d2e309f34305b284538d40356e50dbe9944ac7337350961d839f8de8da3930f0e6520aa5836daaf5cdefd2e6fa0a0e130b16a6f52dd25e55098cdb647fe81abaab5041f1ebc79b4f0ce48f3b664eca89ed37251af90076fced49e4de9f4c68a72d0ed302590c619e1570c32bafa2c254b048f773bc70e801660649d28e6c295d1e6c0fd9bec37889973193321abd9bfab52b92f810458c4fd303afaa7471ebcf89ec9afa62cba80a47ce0d6422d07b7d9467beb9f2f32666678bf056deac1c7566f290456575fb1212968c0a0682dbf8482c18ad953ad86935c47b8dc1fc0b82d67ea925c9c4bc5bcb2735dbba619afed1cd823ce6df5ae132d52a045b55006dab4c209b12eebd127bb4368669355d601c1035f49edbec50ce04b725bf0e1a53ab84ad6f41bd3578c841ed1c3b2bf0c653b689f38639126bdbca713618dfa34c238c3840bce75716eedaea89d99473efe77dff8df4ddb2774b1586da0e1a124478bd76dc21c5790767c4d018fd47ce98d1a58fb02d2c772c3939bf2468f28e616b5ea307f25ed372277c2d7fe3a0e78e469a0bd0ebaf96f16a801ed926b1adfcc2f57c02fb4c304918e19536343fc7b31525beda304f7f7d0b77a26e6197f57025adc6717753c51612168fcf05a5267467868981908db33cab8ebc4b6206b9e1357205cf114e69311315be560768ca94c55db01392766f1b1368cff502439bc61a9e7a970ed1b6931be9813e92684da", 0x1000, 0x3f04f564}, {&(0x7f0000002800), 0x0, 0x6e}, {&(0x7f0000002840)="6e34073a7664e277eb6a658c2c57abe5c0d1fe8f5c41c10c48c3b0653234b6081a1d26b8361a85ba7f198c0aa092b8ef95a5517dbce6f5c23dd4fee56d2e1713283b76216049b5ae52aea03b68f4ff0ea3cc7d2fca6f5bdba423e48b4eaec4b032dd812450c1c10b93e671599781253d0ea40a3dcff02d0ad680e5b82ee888be79886ee93d5f9bb8517e14b8b23f800651372391d92fdc03472acd6e4c1e83817d691dd94fddea3421123ecb5b92d2182f26f553b1c5bf90e3b3f0244d07760384509074a7e3ec0d6f90df17f0cd87a2604ad8e4c44b2c022d7e3384471504822df4a70a6d910cce2d58db1202dc9587d8a25381e1f0c406feaaedda4935d3355eacf4af62be374143e2f8560acf995f711bba9a97bd1dbf97ab2392f316ea07820b97ba41d09e7db262729d810a5885760fcc39e589bbcb6fd01f66be629c691d81777938004f5b5592aa00a6708d6101e6008201abbb109e3453daf3b3cbf32a762309b4e9401f8e643049c7b74dfd14c3043ee0f8d423988d1b33925b05300b8415792a7e98caa31ebfe3300de1670c55afe39b96cc3c9af3a35b4489ac4322a9c89a0e27306cd7c4135b89a41a855344dbe16ceacf31c44af8558145c3513d1c5d18ca749dbdcbf22cd48deec484be7ebfa61da9d17e798a6fac47488eb656244f6973de9e8f4529fa65d7a302a88625eb78c2e8b8f2e7adafdd6ddf44adfc15f4b4a349edb46151123453b2cdec3d39e0be684d83ee61af800bae2b2b8b7458afccccf2a37e36235470e8cf17242fe8fd48f0cdd0efa1ec1fd34669b4c8729278fdf77d9da4f1f3aa2b359d69e9acabb9ccf0dada0494281ab70f2d8ffc95082177e7e423a67b04c07f329e988bc42805804b76f588e23ec9627d7dc0671b3a7b3a5866b2533c2497bbc64a4b9bd55d01d25f2041d69ea1032c12472109a382760f2c50441fea3a2e0b5043984f0fa0d993096a03d58fbb4f62094e554c63d5692ca22ef5621735a390d6a683d1f6485a2d09f87e743eb1ab5abd15ad3e0c2c68fd06b86122fd8d4321ecc84edfee7ab529994fe1e6b9129746845a247f12a4fe3a55ad1dd90426780b7040f873d3f269a57a62dad16851755f3bc9b6523cceae87a2545af37e41c671d935cd8bd54c3d7417f8f4d0fd69a89c86ed524518d7f36bd9fd9cfd477cfe22b0dcf18d6bc51359eebb849b4fdfcef46109d2c896a05b1b8b281c1de68c7e2586a88c011850a2b83404a3ba529e97b4951da61b965ce34750e9f3a8ea54db4b6dd6023777e77361c4133122235c8a551e63b4691c4dd73ad3af7b976949a1a99d9fa822f0a30478bbe761e3533e1521be1b36c2c632aa8d7c4a899139bf04161a574b6a1067134a2477528ef0336936ecdcd68f560cc185aba2c32192fd95db689e7db994bc0f0393d2f5fc15a0e887ab990b7188b715c451cabbb8aacd6e20eb9ee078c4ee856b2524dee124fc7bf95133923590300b341a1720a6c39426034e004e74d0fc75cb3073d2d37deeee0eb967ec24af24b6b052b6883afaf8ce803f8895d86b044fb65391ef83aaf75a6c01f489eda25f7ab7a3db70e5ed611321a62ef51002765ec3690e177ecc66982d51b2340159c71c6fabd883d9dea70e7f84ad42d60493a4d41520d894940a2822b4219e75c9efe56bde62b82316ce88bff2884c6014d61ac715aeb310bf8301b1d62d9c3d2a121aeb5cdf8edce714bd48c057a6fbeacbb2f50372d26bd003228294dabf66a58ca26cb0d7ca8eb288ee30803777aced57df21a6ec7862c3952aa72389a8203b0acc3b53d7f1df3744ab39cb44e91a11614a1e2e549f4b74fa30776e41eb434d2d1a279a1b87f617c88d52a0d405897eea5d152c998c5e586fefe318fb3f5aa039f97b849296cf61c010dad60847db9f654e5000349c414d913e52da6408a87c693fa463706bf4aa2302caadfa675ce00b05f4197eacd93762c14feb5c8132deb0fe0117c30296c093d872621e3e094d963c3367a0a980438643946dd6f35badf7ff7dd1b11e2010932cd8fea5ae093add49d32762fd0702e5c2e9c9c550e20070f1a5f031cb999d3ea98859632eb48dcdcb4ff0009ae17b7fc8536667723c57ce1203dff71abdc0ac4e8f599712364e19ed6680e2faeeeb3dde0d9334a094f9c492b2d02284e1ab653fc747ccab99c43f838723b4ba451d4d666a540206af4dbcefc669b7e6d90b79114acfbaabfbaa61773f9eeca9782981fe792f76645b96407009b7f0ba1e5ced4b578296b4d317b03c8c4e798fac6f4a48bc74e279cf92b4299f1abced470fbbb22af1bbdccd9602d564c9415290f1261d53fd4030f88dec3f1f0c3a24706d5d660f5039d0522f537c2e75ea977f84aea192da4f43ed2e04478feaf0daa3781106831d03ae5e5ffdad520fc134c9186aff2ecc88935169b494ecaf9848eb6816066818bed652595f345bb407af9800366bfa3a8d64877caa3c762874da788889ff4c01a83d76d0fca22724b88baec7e8ce02b1f70cdc263384ccc8380510bc73fdd195e095b56a138ca76083324365ad1616f4e30ad6abdf2be067b291a259db9526c2fbfef17a00b2f2383b23b6dc2dfba5258e2150884ccd2816697b5c0018b27fb0a62351b3756116f62f527eb486956fe02ab6efdee3ec8f644059c6f01b8314005dfc8b31dcd357f3ba0761423f33216bdcff2afbb12a6f8051386a587e78bd2802c9aee2eb016cb998987ce05d417e0b8f94718b28cf00c10cb9f8409489789a212ae2537c5447c386312735b764e1e826ab2bc89fa210c37bb5dfed1b35ad2834e4745d6ea9ae6b5c717f4d2a65f1c499f1b40257604b1fb69d702cd8a8ce197897b21eb8dea316d1f41dffcc1e6c22f404eb6ecf7a73d843d99c41f3c1cda75f0147ba6f07ac2fc64008f57e5dc696e5c395265cb97cd92c1ccf810f356f7a239798a3762e1ce001940c22222ffc8e353856bf8d0391e953f9e4622abd553d37c46f6975b34e0b11586699de2546b4513b1c15452732387a11fee3f44edd3b8cc47b2f616b10441f8577135686d716070c4a4720a33c0fd99313da538902dc16d8aa8b73f1c95c2ac961ec56f7a8348c5d5fee53f4b95d73b6f56a2bb4c415bf62ab21c7b51d7a50b829438950fd5a14f0bc967c1c6f03b1ce41e2e8e1559dc5f4422d9d046b52160ba7050a6f32ed582c72609d8eb5e88fccdfddb339b52b95ec21087f86d636b636211ece6b821d5d66c6b76547c893f0756c2f05503c6fd15264e81c2289340d0cf10741218e563bb16bfb4f5bb64477b1a91efce775856c371cf45ab76d8389c51d06ec0a6ffddfaa1442dfed5790ba7a1c96216f30a4cbac085261b4284a7501c0cd312c6e4c4914eaa3ee427c87102115da96afba264906a530a1ed88b56bbd77abf90b43c045626f5a5b42d2c3d6c1df53a97d48d314f8874afa13dc77338f7041d6f9af90fd6760f7599b0733d786ca799ed6a84f57de10d55069eae8aff26b7bff9a95eecbaf418e0e571a5dd417a944c69d505b579f22996ad40f2a0b121080150a4d329cefeff3580c84bd8a8163257ec89735b7060f5d6209474d810cad3c1e324545bf067749d87f47e2f0af76b6a84605a3483fba430bad0b4fc517ab2493e739631bfd1a038b2ce605eaecfa0c3cee49c23baf0ed9a5fdc612b5f7ffd384eeac0f76213a7355a6d62421f9f1f6aebb23e89592c9cc2083032985d879e9b48e9224a8b61ad8ccd58d6b231142b48effd4ce4e90ce5aaa9a7143c7191794375d46a0e9de2c01e91dc6b4d23a3f86e069856658dd05e6897822d457e2e40282a50b7e0b6ab8144e8bfd2f7118f29afe2b36e6556cd1d6aaa7a7188b3e20a89fe58af98a73f356fd82a265faaed55fcaddd621b246dfa3f91e9c39e34b2bffcb9eb35867a2e7433da6e4e9be1eed640a18e6640a477b62e42168af86ec6dba1d26fc249316f562511b67bb047677d8f1e24804a86a283ffff5fa989a19f2ff07a6a1199405d6365f7bb0bc1d07fa9306e984fe575d2bb707f77ffd1092f1047b6edca2efad0fab685ae656df95d4b30c391941fc972ab9f92bdc8d5a4318c06131d9804f5b492f14e917f49ef1077f39f1fe63760c9f36fb560a9b78141883d61d550f80b98c1db660dfe8f47038147bade2b3d806d386b857a1507af0412b90506765116c20e5d3e008dd4e74790571b24ad62a13bd1ac976d5733032e523c76d7880fb400fbf18272eb83aa018b758590cd4ff2fa4954385380d227159cf6a0d9d1b8422a13be5cbe272fbc39ed57c1371c850efece1561a1e18792e60c45dbaa8e3cb6b3ed4feec54403650650c91c5755302a3ec46cc3c0416ad70f2777386d113b4e9f836971a53ceb0445eb99d5801f8b9b79f400b6fa5bccf2e880f9d531b21ee465183c48cb40a7e74b86fcd13a493a8fe0a72b5afa868638cd1f3e6527fd94773e10239410dcc3dd1f9c10766d521c0099e55dd2038dd0c4a169a667354196091102b63e25bf5887221557220df90bf8e93311b7c7295e0f443bc0227bd59d41379282c8f7bc2496ce6f0e7b439fcf8db394168d7098eb5c85d2e9403d6f38d45ec8aef56e2f88473e674229b3cc711c99ab95a8a6af6d152344f149efaf6b32c318db30a3a0b4861f83a39f074f6f98a092ab308a03955dfc5217a88927c3309033b6d54498f306bc85ef094a1fe509c42e97ca505e07e56f904f11cbeffc7f6fae9c86fa1fec483cfbc5449a8845a948cf2553353361adb43295750b0699aa1fadce7f05863dabd92932784b7266869a936a52d3b3bf6ec2fd596c93837aa9e615b8d1c6bacdfda65c3d62e5727436fb3e1f733daa8e530d10067a8806a279740fdd18edd56e406dd1c84ea71ab768b481822e3df6c877a779dc34fc2ce3dce3afb8c02d3512ab4a750f61c68b9f1fecc7353091cd605622c4721c0358858410a4e2a7fcca880bd47971f92674d002d7ce8e0faf25a0d9df7bd9177abbc809de7501a39735f660966affdf751d2fc86b2eae5555ab4fb898d888aa05685631a6fdd0abce5efaecee536d3c55fbd90f023cdb243c77ac1158e90cc69159c3e605b5b10ab5d4080960e515efef0be2f6b8c3d6e017cc4701e533acaf2652da6fcd072be37a64ef9b8b1c03dc9190158878351f60508d2923a82ef4dd0688291a63ea822f96e728c5cf8c09b0b1c3bdb96e42e989133191dd251d849a7420b103ca54afb4b028bec44e96e5868a13a21c6d74b6c764aad846d167b6f9f0b60f2c70f0da4d7ee5de03fea44b068e26bcd4740efab346a37ddfca78ea275f5b02dd30006b561d55aa7ff2333aef7e2f591f697e76e635dd8f29658ae0a74abc8de1058e0ca3cef7acd2ff26add71076a4b14cf02cd8cce5353aac569d7ba5026e575aedf796018a320e179753cc49d4e619c5bd7b4144a9bb70bfd793aaab8ed027d7a1323943c4ceea88ab02c09302665d81ab6e57ba12f92b5e622f059f4a3ea60f93f47a90dc42668588c2b3ee85eb7b026837a5e71fc2ebfda2b48cf454c0a5cc3f1a54094383d5a997284eeceb91fd38fba4e28daecc88661eadc590ae431d57fad9d3a90f89cec8ea621f22c9da09d2efb7d4f821c67306d41bf08d23bdc1ba2be3cc5da256a16003d0027c674ca9bfdb43be012e4490f15800ee99f8d092ea3ce0c16e14a1143bf7dbcf99c391fe0b5f83a900abb8a78008adb2f61098dd1f468754bb941dfd0b2dc997c1f225427287bc4a9a976f445ccb6b9a0404439850f", 0x1000, 0x7}, {&(0x7f0000003840)="fbbb8640734124b2e902e896371d054d289b35714cf5906bea865781bdca58ffa31c0ca1f7b81a7f655b0d16ef49e9e6661b28d7c6b1c44d2934ef58da0838f965e319422bf0299d4ade94a15e084eb4f0e32d82c44b79268d3140604d1fcb14f5adf1a78cd63c2e2975346dbb564ecceb66db998a0d197b2fa065ab695a83d6d8bfe8cc183a50be12eeaf1afe0016f0275998871fd399700fed32249e7cd518f1aa0ad8092ac3606c99c444976c5fec064d0e68a9571a084420aea9529e4042d0b08b2b247a23ee5d3b5f3f2ffe1c631b0925fe05ad76c52ab0433c1bf7ff73e658f37d6982cf641d61dfc0f83eaff54c227ca5dc12e96334cd52", 0xfb, 0x43ab}, {&(0x7f0000003940)="8c7a75ba906fd8bbf4af899d317bf0a01525b99f64bef0de1d2980d7921767ddec285359eab55ab061b1aeae90b769d6c973602f98fc90bd79dc50438d2f4211c5944ff6c0bdab2db2fe623c9d6a681166d87dc43fac457feac8292da7cad025e8d4fe41468bfb052bc88d2f58a9958f53b7414d0a70b9a9ffd87d17700cc0f0e63431141b07dbfb0f69f9c818dc6f029a49fd5a98bcdf25696e7c539780e5d683bff48a4ba420cc3baf4439794f241486865112d9597dd5c7f95f8b3cdd21c92baac3924988951b25a12cac0a960f564fa39cfa75f037ccebab0a3dfb519ca64aa5c0a800c65883286cb4a561c5b9469e72235927b9e56354af334c494219a6aee71770ae64965099cc5e9766bd29153c2f4881d172b9eafeb42d4597cdb50f80ca1ef32f6f797a571db35c06f321f4aee090c9a5a4f73981138d472ab0d9bdfdf2ef24d84173850245920ae4cd747c97d5f054979eb5b328adbae87c11ac8dc34fdb655a77ca4bcc13635f9ff3c06191d35b56c303565405cee499d14f62af0fb8134f63f9baa38f65f4a5ee36bd853d0f68206cf60f14f5744d130a44cc99a0e42892fcf6c52dda5a52aad55ccc5ffd10f135ea99c3ece0305c35e106266142b0fc857f95afcba1b2603b25c7ea3b445a4b293eb2e318f2fd61157823d05f1462924b1474f14ebc1304a2c41b2435165a92f3cd9e422e9b1917bf7d6bf07ca60a0ce89dbf2644505bfd41b4f39a33aff208c6190003d793697ceac28b384d04996ba8c10170d64e1abd52449d7a2bd5ab7a62304b6678ee3e76a7d96f76f159cb4270899ee2a62ecd3609ec06c2c32132bf41d6dfcb2a638cc3b1a6efda01f60c8f81c3705aaa62b24beb646cb1c1b37cee3f244a55e8744deaf57707d0ac89e52c450b1db4b705b47c75513b262b236fe7ab4cf4b6337fe0a981d5314883198d0629dd1823c21258b1eb7e735532721da9683f4175b0f50387f974a681b533fc5237c0e69feeb46e60b4de7695791984fd06f5383eaea41ec9d047e5b7d170756f663019aef382ebc57af1e8256ba912bc2a08f39a5abc39669c23aaf1a8f50be4de97ee6b7ddddf53910fa2807703f71ce6411b94ed3eafe6391fd6bcc6de7284524eae1c2879bf168781d2e187f1a094e198f9cd5c815858b8a4e043c5d195547a2889ce8fe5a3e3d76c92b614647d25692a6f01375561197f4c05ad70ab39a36ea66d3065f6c223296fd00517313f8e61f37d5a595e90f8e2b91a7c328bd1701eaf9dc5ac0528aaf0e998fb7f8c1aaed2e9025635cb93fba7252bf9241d1293c0edbf79b97912ea8d4e49addf580ae19ec893cb4c6fcd412efc2a0018824d8303df0a8d42c4596327ed340712888f52153b173aa5bd990831044126a5312cd46100afdbce1498c4b807056bf5e0d895dc5c402da367d0ffd0bfbe82c650d1a5b821cd2174b40fe33bf8f009efb8e640ce775bda4bad3a1535973504c227ff7c9c7bf0e636a09eea0b0009120021299bc20431c70e25dbd48eaa5231f6e983eba95589478a6f86fa1cd4c916591f638921196ab769a8fc6261435c0f5c1f7065c32850b4519253a3cd73e6395c62b4ffbc6faa44c3cf73ade6b5a71e09b19ce84f626453a8741ce33c7f334651dd0534a0691616b3eb7bcf83605f89554bcf8a3870cca88402019de8aee8ee1a57dd546aa0b9eadd453cc4917c294ba4ebe88ba50e233e2efebbb8a59aadebb395718da74e34f20290ae4eda2ebde191f7b5d55d32efce40593a0f5a6d2b6c4a1419d82055b7e35baebd1a99e94f898483e70273f4800240fb19bb7d4314f1f4e3f939e4fa967e17783b0858e279a53deb0a1d01b4174a8fba0eeff3ac2dae1d47250572d4ba9f8a556a6f32f1b8db82759090ccdcb2244afaeb56c677d0bdda08a6aef49defe404c4d5221ec7c6710c650341200f84e79549fb8d7104c3d312533b56a6debd3ef201798cc2a42fad17cfe7064e6b8bd3be83e5fa2eb9962f0fa9457d804930c0d501ccd5871dc3f817e731805c2a37a5fc56ce533b161774eed37038b5a77203fee61b81e9ed5b589a53fa4bfad7d01ee0a06966336182417ce379497e22687c9dbef79e71c017df7684068f3d4413e1f82a3a9f38722a3d6eaba688bf6088259ad454e23585664f8a5da8dac6e0ce705c6e994a68e3972fe18f6485cb07c0cd720d3c47b7a7442d734266fc19ef88d94270db63f58de98c2ecc3e1f5918efbc0728c33ff434d2d2e04a1b860621b089b323192276375caebb5b0b6ced0c09568c1bfabc1584fa960dacae5ecfc1be649813a8111a0ed0b52af2a6d2b97beacf95cf5e3025a60886fb12d0d8d297c4f3df91eb848dccb630ce406aa90a803399f9995874a580ea8c199395efd30a90bb305bfbe8a951341d187a705399c7e1a14df8b83096982673935e383361055bc495518ae9f4d026b8bb4e53b6baa51c94ee534d4f1bdb7f8bf218cbc9ace37511f1b9a2331ea50668bd7cb8a6f9535bc7cd73f9be0098fc7f893d36dff88b090d279b713c901d7480a667b1127a7fcaacb598322ac7922e3b1ac91a0a93ee45efcc2dc6e2e26592f7c3e5d00d4b4ee18a69f1beb591b36e7b84e3a29b5248e7301542371dac1fa11de7fa223cdbbd040c37703db20cc6c0e131a35d7f616d0e4952a6d677002a75ef7a06e692596540d5dcd41c01f394b30da13410a787d0c6798aa3bf52dd525525cd201842ac8c364f4849011d7645a738a55fd03785bda47e94e4ef1eec763dc595bf41898cc3ef9580067d1aaf6fc340821bbc90621daf76ea49862935596c38c7cfb5df121e444ec50ede4d8e237d3e87a254a1224578db17d34e7c09b20a8f3538964c12dca44b12bd8e2a51e19e1d4feffc15d131f8571d9cc735d4180cea52fa75eb876b8e07f4431d5a2aec760ed4a1b3abea4b9daa4c1efe668b49d3aa1f9413992cfc6be2adc3cb38a2f945097cc9750d525e30d9b5a391f728bbf1dc262b6b61fcdb6d81046a246ca3136f2b7a8fd4e81caa2d607ad1bba695a3f5a27096282886213a81578fed8e1f4457e931e002ff81e13f8245b837118edd21e1dadf5469c0768dcea24ee3b387b0253570e9a61e645d16ea72616b7855d3f46393b1ccbd438f1431998ea105a2e60d4b71431d104b4a2787a8281798288025ed3328ee750c4ced4446497aabd03ddf674b98a78876d61123e0b0936b1a44534c7ef24c5f2155df71757048f4fdf33e2322ca276957a398d4a60ea6377b86feb697c04296dcb2d24650d6cc5dcefa8ba0498b2dd6f1e32f23597f2d112b51a4315c28586d5107e08bfd996e1a410bd4c6c3eb5ebf7ca20d5c9b50f7eadda862038535706e60ad25fd4daf619290253b7a195d0a64ec05e8951d75a7b48a179415932ba24f68e656e3f9adfb8238c3df106b8ba0bc16cb1006ae1d71cff4b23b1bcf01ee4d4d636ba873046dc8c5fd58a5c57d7ba6b2a8a7a310d96c90d228cd0c30922582db696a4d5aaf13783e16b52506f1302d2b52d966d87006a12f18d5875157d677768b20045bc42a0b2cdb8ec62144d07546d3c678e8059b57fe2563ad8763da5415ad255a6ce1ce0ab1c27df9ac4f29d21dc6d37456658e346a3bb9d4e26454b32c463818da232856a73fc780d15351a5b48c29bd90d60002b73a33536fff6a3ff53632f43237ccbb35a98f2cd4b1ca7ab3c9e2f85f4c1677cc4c9b0afe5937709c20ed20192a7a49cb7bc5b2f2824b41a05905439915e436aa9d0f8e748f4992cf7b0dddd93ad0d2a1002668b746d78c9b0690a201f81487cb0c6efea57f24ccb882adbeca7a5614c93abbb8e4440e40ac7d3d204c04fc9684b6da7fd031de7781202aab0e35460fa34154479c047b412c08cae51f1555a81c34b826bb2f19b74e66d330f5c5fe26e58702076854575858b50e65bc93d6b9e84dbd69a576ad90ecd3a168c6ccb82207245bd3962e813fb22b9798bbd85923dea52510ab780d6d6131f86c03f76a311a78862b180074a0fe54cee141f2bc50d6cc2cfaa9c0c95ef2a2d070070a82d03f97a27eeb1787e116065a12a5c6a2e60089f50e1e2111ebcf933a5768a740136b0b70bed425c28f1435f5932ec062f5cfc9315d72351828f4739f55196572b331353d5919a2663b76fe9f665c074cfb23463283910fb428937b928e3c70125692a0d231ea033fa16fc6de490ec16433bd2b3d41ed54b36feed27a8ad0ae968cbbbf30f4dcdb95cb7c6ab64721b5ead1273857e7733e54e42883ecc3921a988e6cfb4424b15ceb30825f6d824e6795f3d821a2d10856a2a4bbc45e816a2a5b9bb640f382e6201c60399376b142335d8b4bd5308b66bcb05da81c79f247cf50973a93ca2c02dca538bf3a98d0dc09989949f0ffd783ee77ea2b1e5829a56bfde92c65924e3e79351031b81bb975a26281f5a34429e2c66c9c8e3c60c7f373d054a87d83a15e48f32eb2a30890bcf6dcab4e24df532229d9efd64c4ed0b757160935964a03b1c3dacdb41d31302c19672aed6589ad5984e25b72a8f3d19d28c382a5b37207355b8968f17673f1db52e8dea22eaad08a2174dbc25ce6f773880a30af83dd30c3399553c8f315139fb4e44129cb4da583266e654689478f82f1888bd14ea00f2e4acaefeab926eebba6a1649adafae9a3d628a3b2301d37fda47c5f2d94d9861517964f21f8e5aa8666c0e05190bfc3b4c4979d80633e84e7894301cd9f1ccc8fe2fddd66730198089d786cccf2b9865c1c93f49f936b8e96db2f7d214cf7672cda46d0a03a8415bd7c24e537eace37c4ec0a21e3d220e2862ec56aa55177db5864061ec826d41ca04d97aef9ce8e2e1a6bb55460ab0f0b882727f723d54ff85496c9d743a42d8fc274a7edd66291f3c37b21cc70858d383baeeaa7c18fe475c4e166f862ccba9897400fc30b9bc19128464759fc2ccedb991b6654ea13ec7ff64db18811b7f015b8d57ed9f9e1e05065dc6189c768482f791268167766246747ea62e463e6f0a397cfedabd104d1321ee3735e6a7c48625ecefc34046c0be4ece377986a91792cf862d8398a6bd5c7dbc98784219c83b5591df27b9f82849c9f4990140736ab5f3ad15a6a3925878f0ae4c62661523694b2a02be46810176be2474d15530c16b9f62cce089ec31d00bece7e0294ffbcef3f1917db262a6cb458e14c43b45a846315e3ba103fd6dcdd9708c1ae3b41181cebf0e4d142c4fb910bbfa4758ff97bec1520c171e722add2e6cb81f5f69ccdd3fbc05dd45268b0cf6cf98b52858b3e03da9d2fe04b06b9c63b317df435c393ae0b6894b8418e3d20d91b75f9fc04bd8ad175c6b479ca670ea9cf3d87d55f87a86ccedfb47043e5921340a915a7f8987449e13d567b00137eec2945d48c56b78dcc5a51925e440b078da74c65d5de6e23b547ad9f62af3d960661be39f55189ecb5029287bc689b9800711d4f7737af236a3d5e1b47ed2708c30daed79e4fc62d51c25c2bb9da34b5dad5d3b1df8740f23b5404c5be63f9bb410beb00467143135e728bfc9d784a3318541da0fb79aa425500f9696ce6ee2079f07ecda6f3df6bec58e488af5ca26cc095e627223dd920ba635db1c4fc4b57ad9eb44409fa8812c8449ee2bddf8ad9ad2d9c222f7bb18a5020a594be20a075bc771a6e25a66dc532a008d431c2e2112a424f461b09df33fba2168e87d0bd578c8f70d6a50c1045b2f96ce989c8c2bba572a6812b03ee4a1c14bbb5160137a80d350d199a3530d3233489ffe65f75d85f", 0x1000, 0x1}], 0x20000, &(0x7f0000004a40)={[{@nojournal_checksum='nojournal_checksum'}, {@journal_checksum='journal_checksum'}, {@debug='debug'}, {@grpquota='grpquota'}, {@block_validity='block_validity'}, {@journal_async_commit='journal_async_commit'}, {@user_xattr='user_xattr'}, {@data_err_abort='data_err=abort'}, {@commit={'commit', 0x3d, 0x5}}], [{@uid_gt={'uid>', r6}}, {@audit='audit'}, {@dont_measure='dont_measure'}]}) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:37 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) pipe2$9p(&(0x7f0000000040), 0x4800) ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000000)={0x2, 0x2, [@local, @random="1484883fd015"]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 684.651326][T20754] picdev_read: 118 callbacks suppressed [ 684.651340][T20754] kvm: pic: non byte read [ 684.699427][T20754] picdev_write: 120 callbacks suppressed [ 684.699439][T20754] kvm: pic: non byte write [ 684.751812][T20754] kvm: pic: non byte read [ 684.756370][ T26] audit: type=1804 audit(1574140958.025:288): pid=20764 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/379/file0" dev="sda1" ino=16804 res=1 [ 684.798681][T20754] kvm: pic: non byte write [ 684.820956][T20754] kvm: pic: non byte read [ 684.825413][T20754] kvm: pic: non byte write [ 684.845750][ T26] audit: type=1800 audit(1574140958.025:289): pid=20764 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16804 res=0 [ 684.869020][T20754] kvm: pic: non byte read [ 684.880653][T20754] kvm: pic: non byte write [ 684.892452][T20754] kvm: pic: non byte read [ 684.903387][ T26] audit: type=1804 audit(1574140958.055:290): pid=20765 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/379/file0" dev="sda1" ino=16804 res=1 [ 684.903831][T20754] kvm: pic: non byte write 05:22:38 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x700020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 684.960503][ T26] audit: type=1804 audit(1574140958.105:291): pid=20758 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/363/file0/file0" dev="sda1" ino=16803 res=1 [ 684.970018][T20754] kvm: pic: non byte read 05:22:38 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10000b, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 685.062071][T20754] kvm: pic: non byte write [ 685.072348][T20754] kvm: pic: non byte read [ 685.080276][T20754] kvm: pic: non byte write [ 685.085224][T20754] kvm: pic: non byte read [ 685.092521][T20754] kvm: pic: non byte write [ 685.097951][T20754] kvm: pic: non byte read [ 685.102452][T20754] kvm: pic: non byte write [ 685.107821][T20754] kvm: pic: non byte read [ 685.112384][T20754] kvm: pic: non byte write [ 685.202188][T20754] kvm: pic: single mode not supported 05:22:38 executing program 1: r0 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100)="ef", 0x1, 0xffffffffffffffff) keyctl$read(0xb, r0, &(0x7f0000000100)=""/254, 0xfe) 05:22:38 executing program 5: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 685.202208][T20754] kvm: pic: level sensitive irq not supported 05:22:38 executing program 3: fstat(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001000850700"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012000c00010067726574617000000c00020008000100", @ANYRES32=r2], 0x3c}}, 0x0) ioctl$TIOCGRS485(0xffffffffffffffff, 0x542e, &(0x7f00000000c0)) 05:22:38 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x4, &(0x7f0000000700)={0x0, 0x3b, 0x7, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r2+30000000}, &(0x7f00000001c0)) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r3, 0xc7, 0xfd}, &(0x7f0000000800)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f7766697368290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006fe61c440c89c21b2e768dcabbbc8bf654bb28301f23424ee53cdb0e87ea8b3fbad8eed309fcafe406b7b2e7aa1b69d44ca9db51b2eb343d6e998b362a931794ef8a519fef1652d10af7b11eeeca363a47a41e7a9e5ea1dd7f8061a87bfc6082e8a5f7d34b4442651b42c08edeaab72214b7956965d7c4563c40caff57607658f74cba30204a92a8a6b2caaf70a417d9953a3a9512d61f8c6310a7aa726658879b1e31d25dd31ef674bb00e86f7efa0e3ffb279345193758fc756f6f5897d5acc09a22e03890ec2c51818115ebf9143579078a184454e03422"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r4, &(0x7f0000008880), 0x62a, 0x0, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f00000006c0)=0xc) ioprio_set$pid(0x3, r5, 0xfffffffffffffff7) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r7, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) ioctl$sock_rose_SIOCDELRT(r7, 0x890c, &(0x7f0000000740)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x81, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bpq0='bpq0\x00', 0x1, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}) timer_settime(r6, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000680)) ioctl$TIOCSBRK(r0, 0x5427) sched_setattr(0x0, &(0x7f0000000400)={0x30, 0x0, 0x0, 0x1000, 0x5, 0x0, 0x2}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r8, &(0x7f00000007c0)=""/23, 0x17) 05:22:38 executing program 1: r0 = memfd_create(&(0x7f0000001540)='}\xbf*x\x89-vO\xd3JUk\x88O\xc4N\xa2\rqI\r\xb3\xd9Q(\n\x1a\x9f/X\x1d9\x03\xc2\x16\xaf\x9d\xffl\xdcC\xeb\xa6\x96\x12$\xd15[z\x85\xf4\x1e\xcc\xfc\xf64\x00\x00\x00\x00\x00\x00\x00Pw\x1bN[\x81\x92\x15P\xc5\x0e\x06\x17\b\xaf\nu\xd8D9z\x9eR\bjh\xce\xa9j\xda\xf8B\x84\x8d\x12.\xeb\x95\x9a\n\xb2M\xc7\xd1\x87N\xc5Os?T\"\xfc\fc\x92\xbb>\xa3l\x9a\xc9\'\x14\xd5+\xb1\xa6\xf5\x9e\xd1\xea%\xd8l\xae\xd6\\dZ\x17/\xe7$(\x8ax\xdc\xc4\xb7\xa4\x9b\x92\xd8\x16Lz\x9e\xfc\xf8\xf1\xdc\xb9+F~%\x16e\x81\x1b\x11vw1:\xdd]\xb9\xe8\x99\xea\xd1O\x83\xf3WA\xad\xaa\xdc\r~[I\x9f\xac\x03\xf9\xe2\x12Je\xe9$\xd2\x00\xef\r\x9dQ2\xa1T4\xb4\x116RO+\x0e\x98\x8b\x1b\xc1\x81\xf0U\x93\xd1\xf7\xbb}N\'\xea\x8f\xbbdd\xda\xb5\x7f\xff\xef\xfd\xd5\x9b\x01?\xad \xa8\xe3l\x86\"\x94M\xd5\xfa]\x9f\x1d\xad\xf9y\xfc\x03=$Z\x00Oa#`qHd\xcc\x8f\x80\xa1\xed\x81 \x85\xe7\x1f\x99\xbe\xe8\xe5\xcey\n\xab\x8b\xa0yM\xba\xcf7}\x8eVQ\xe6d.S\x9e\xb1\x98\xd9\xc8;\xcc\xd5\xf2)\xf7Zh)\xffF\xb8\xc7\xd2%\xe9\xc7\x05\xefq\\\x97]\xd7\x1b\xdf\"o\xca\xd4\xe0\xd5\x125\xefz1\xcc\xe1nZ\xbe\x16\xa1\x8f\xc8)9\xb8\xc6\xc2\xdd8.*U\xe0\xc5\x04\x00\xd9\xfd{ZT\xf2\xe4\xb9\x95x\xa5\xbd\x04\x0f\x8eky\xd8\x8e\xd77\xd7\x0fp\n\x11\x13)\x9b\xf3D\xb2\x88*(\x02{\xb2`:\x01\x00\x00\x00\x00\x00\x00\xee\xff\xff\xffV2\xaa\x82', 0x0) r1 = memfd_create(&(0x7f0000001540)='}\xbf*x\x89-vO\xd3JUk\x88O\xc4N\xa2\rqI\r\xb3\xd9Q(\n\x1a\x9f/X\x1d9\x03\xc2\x16\xaf\x9d\xffl\xdcC\xeb\xa6\x96\x12$\xd15[z\x85\xf4\x1e\xcc\xfc\xf64\x00\x00\x00\x00\x00\x00\x00Pw\x1bN[\x81\x92\x15P\xc5\x0e\x06\x17\b\xaf\nu\xd8D9z\x9eR\bjh\xce\xa9j\xda\xf8B\x84\x8d\x12.\xeb\x95\x9a\n\xb2M\xc7\xd1\x87N\xc5Os?T\"\xfc\fc\x92\xbb>\xa3l\x9a\xc9\'\x14\xd5+\xb1\xa6\xf5\x9e\xd1\xea%\xd8l\xae\xd6\\dZ\x17/\xe7$(\x8ax\xdc\xc4\xb7\xa4\x9b\x92\xd8\x16Lz\x9e\xfc\xf8\xf1\xdc\xb9+F~%\x16e\x81\x1b\x11vw1:\xdd]\xb9\xe8\x99\xea\xd1O\x83\xf3WA\xad\xaa\xdc\r~[I\x9f\xac\x03\xf9\xe2\x12Je\xe9$\xd2\x00\xef\r\xbbQ2\xa1T4\xb4\x116RO+\x0e\x98\x8b\x1b\xc1\x81\xf0U\x93\xd1\xf7\xbb}N\'\xea\x8f\xbbdd\xda\xb5\x7f\xff\xef\xfd\xd5\x9b\x01?\xad \xa8\xe3l\x86\"\x94M\xd5\xfa]\x9f\x1d\xad\xf9y\xfc\x03=$Z\x00Oa#`qHd\xcc\x8f\x80\xa1\xed\x81 \x85\xe7\x1f\x99\xbe\xe8\xe5\xcey\n\xab\x8b\xa0yM\xba\xcf7}\x8eVQ\xe6d.S\x9e\xb1\x98\xd9\xc8;\xcc\xd5\xf2)\xf7Zh)\xffF\xb8\xc7\xd2%\xcd\xc7\x05\xefq\\\x97]\xd7\x1b\xdf\"o\xca\xd4\xe0\xd5\x125\xefz1\xcc\xe1nZ\xbe\x16\xa1\x8f\xc8)9\xb8\xc6\xc2\xdd8.*U\xe0\xc5\x04\x00\xd9\xfd{ZT\xf2\xe4\xb9\x95x\xa5\xbd\x04\x0f\x8eky\xd8\x8e\xd77p\n\x11\x13)\x9b\xf3D\xb2\x88*(\x02{\xb2`:\x01\x00\x00\x00\x00\x00\x00\xee\xff\xff\xffV2\xaa\x82', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') sendfile(r1, r4, 0x0, 0x40d5) gettid() sendfile(r0, r4, 0x0, 0x40d7) [ 685.747031][T20804] batman_adv: Cannot find parent device 05:22:39 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe6000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffe7) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000000)={0xf6, 0x5, [0x10000000483], [0xc1]}) 05:22:39 executing program 3: r0 = memfd_create(&(0x7f0000001540)='}\xbf*x\x89-vO\xd3JUk\x88O\xc4N\xa2\rqI\r\xb3\xd9Q(\n\x1a\x9f/X\x1d9\x03\xc2\x16\xaf\x9d\xffl\xdcC\xeb\xa6\x96\x12$\xd15[z\x85\xf4\x1e\xcc\xfc\xf64\x00\x00\x00\x00\x00\x00\x00Pw\x1bN[\x81\x92\x15P\xc5\x0e\x06\x17\b\xaf\nu\xd8D9z\x9eR\bjh\xce\xa9j\xda\xf8B\x84\x8d\x12.\xeb\x95\x9a\n\xb2M\xc7\xd1\x87N\xc5Os?T\"\xfc\fc\x92\xbb>\xa3l\x9a\xc9\'\x14\xd5+\xb1\xa6\xf5\x9e\xd1\xea%\xd8l\xae\xd6\\dZ\x17/\xe7$(\x8ax\xdc\xc4\xb7\xa4\x9b\x92\xd8\x16Lz\x9e\xfc\xf8\xf1\xdc\xb9+F~%\x16e\x81\x1b\x11vw1:\xdd]\xb9\xe8\x99\xea\xd1O\x83\xf3WA\xad\xaa\xdc\r~[I\x9f\xac\x03\xf9\xe2\x12Je\xe9$\xd2\x00\xef\r\xbbQ2\xa1T4\xb4\x116RO+\x0e\x98\x8b\x1b\xc1\x81\xf0U\x93\xd1\xf7\xbb}N\'\xea\x8f\xbbdd\xda\xb5\x7f\xff\xef\xfd\xd5\x9b\x01?\xad \xa8\xe3l\x86\"\x94M\xd5\xfa]\x9f\x1d\xad\xf9y\xfc\x03=$Z\x00Oa#`qHd\xcc\x8f\x80\xa1\xed\x81 \x85\xe7\x1f\x99\xbe\xe8\xe5\xcey\n\xab\x8b\xa0yM\xba\xcf7}\x8eVQ\xe6d.S\x9e\xb1\x98\xd9\xc8;\xcc\xd5\xf2)\xf7Zh)\xffF\xb8\xc7\xd2%\xcd\xc7\x05\xefq\\\x97]\xd7\x1b\xdf\"o\xca\xd4\xe0\xd5\x125\xefz1\xcc\xe1nZ\xbe\x16\xa1\x8f\xc8)9\xb8\xc6\xc2\xdd8.*U\xe0\xc5\x04\x00\xd9\xfd{ZT\xf2\xe4\xb9\x95x\xa5\xbd\x04\x0f\x8eky\xd8\x8e\xd77p\n\x11\x13)\x9b\xf3D\xb2\x88*(\x02{\xb2`:\x01\x00\x00\x00\x00\x00\x00\xee\xff\xff\xffV2\xaa\x82', 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') sendfile(r0, r1, 0x0, 0x40d5) 05:22:39 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10000c, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:39 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x800020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:39 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0xaf01, 0x0) r1 = dup(r0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x1f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x0) 05:22:39 executing program 5: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:40 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140), 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={0xffffffffffffffff, 0xc0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0xa}, 0x0, 0x0, &(0x7f0000000480)={0x2, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000500)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) r4 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0xea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffe}, r3, 0x2, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r4, 0xc0045878, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r3, r4, 0x0, 0x8, &(0x7f0000000040)='io.stat\x00', r2}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r1, 0x0, 0x5e, &(0x7f00000000c0)='/group.stat\x00<#\xfbW*\x1f\x02\x94\xe6\xf3x\xb4\x1a\xd5KM\x9d\x9a\x1fc\xf8xZ\xd1\x88\xa7\xe1\xc8\x88u\xe0[\x18\xa4\xcb:\x9c\xd1-\xce\xa4@\xd8\x99\xc2,e+:G\x1bJ\x7f\xa2\xf3\xfd\xf6\xe04\xd8\x04\xe5\xf0\xdfK\x1d\xeeH;\x15v$\xc5\x9c\x01\x00\xe8\x9ej5|\x00', r2}, 0x30) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000440)='lo\x00\x96o\xd6Q\xb9Y\xa9dJ,\x00\xd2\x97\x04\x03\xdc\r') r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001100)='/group.sta\x9f\xd4t\x00+\x96FR\bR\t\x12\x04J{\t\xab\x01\x83Z\xc4\x06S$\ah\x93\xff\xf7Z\xcb\v1\xf2\xc4\x85\x85\xa6\xfa\x15\x10\xa8\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xd5\x12\xc7\x1ee\x86\xcc\xdb/\xc5\x97\xea\x93\xa7\xde\xc9u\xb1\x9f\xce\x8b\xe0W\xdfuE\xfe\x8b\xc4G\x8f\x8e\xd8[T|h$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6J\x81W!\xf0\\\xa1O\x9f\x93\x19C\xceQCV\xe3We\x11\xe0\xc6\x1f\xf2/\xf6\x1fM\xeba_\xa9\xcd\x10\xcd\x0e~\xc6\xed\xb6\x82\xf6\xee\x9aK\xdd\x86\xf8\x0f\x15Y-\xb8A1\x1bb\xff\xf0\xd2M\xf7)\xaa\x8a\x18\xb9_\x83>\xeb\xfc\xc18^\x1d\xb3Y\xdc#\xde\xdb\x89\x90L\x99o\x02\xb6\x98e\xc6b\xce\xb7\x99k3&\xaf\v\xc6\x80\xff\xfb\xb7\x0e\xb4K\xf8\x17\xba\xf8\xee\fe\xed]\x93\x13\xbc\xf5\xe2<\xa2\xaf\x83\xa3\xaabc\x95\x00\t:\xfc\xe1\t]\x84J\x90\xe8\xe8\xb3\xc9\xf6\xea\xb2\xdeI\xe4\x0f\xd4\xca(\xcd\xfa\xb2\xb8@\xca\x17\x85\x02Rb\xad\xd0\xf7\x9bz#\xb8\x1d\x88\xf6?2,\x89\xb1%p\x8a\r\f\xe0,\xa4\x01y\x1bc\xb7\x19\xcey\xb5\xae\xc4\xe3\xc4\xe9=\x1e\x8c\xec\xfe\x05b\x7f`Y k\xc4\xa8 \xc3\x9b\v\xbbE\x8c\xb8\xe6\x8a\xa0s\b\xcb\xbb\xfa[\xa7\x02\xde\xf0\n`\x8az<\f\xf1\xbe\x85\xd1Wk\x17\xbc1q\x8b\x93Y|\xd1`\x88\xf4K\xe7\x80\x9e\xe2\xc9Ms/A\x98\xf2\x88\n\x92?7\xb1\xe0\xee\xe8yo\xb7\xb2p\xc5O~\x87\x17F\b\xb5\xd6\xdc\xe4u:$>\xd1\xaf\x1a\xcb\x18\x8a\x0e$\xbd\x94N\xc84}_\x06\x11\xd2\xdd7\xe0\b\x0f\xd0\xb0WZ\xfc\xb1\xc3\t\x91\xa3\"\x85H@\xb9\x97\bZ\xa5(S\x13\a6\xc0\xbc\vG\xe4p\x1b\xee\x89_=\xb8\x12\xddpk\x860\x03\xfd\xde\x0f\xbc\xc2\xe5.\xfe\xaf\x8f\xe2\x16\x8c\xdbS\xe6\xc26\xde\xf4I\x9f\x003P\xb5\x9fg\x82!\xf2\x82 \xc1Os\xd7C\\\xad\xb3n}t\xba|\x10\x05,rk\xd1\t|\x1e\x00\x9e\xfa\"\x85\xdd\xb7O\a\xfc\x14\xa8\x00\x1f6\xaa`\x88\x8a\xf4u$\x17\xff\xdbR\x02\xe8V\xdc\xb8]F\xdap\xf7\xdf~G\xe1\xe8\xd2\xe6\x1d\x9b/\xd8\x93F\xcf\xae]\xbb\xa6\x85\x1d/\xef\xf8\xfb>\x9e{\\\x1e\xf1i~\xee\xbb\x1e\x93SN\nA\x99\xd8\xa1y\x185\x86\xbe\x1eU\x9b4\xeem\xaa\xae\x1b\xb09\x9f.\xa3\xc0\xe6C\xc8~\xd8\x95f\xfbF\x05\xb9\xbde\n\x82\x91\r\xf0\x16\xbe[\x00H\x96\x7f8\x7fx\x06\xe9\x0fa\xfa\x1eg)\xc1vaG=a\xf10\x04rw\x0f\xbb%\xc6f\x81\xbaEO\x80\xc3Tc\xc4\xc0\x14\t#2\xd8\xe8\xecX4H\xf0\xc3\'\xba[\xd3}\x16\xa3\xf3\n\x00\xdd\xf3\x81\xaa\x99\xcb(\xb2\x19C\xe4\xc9\x87\x9a\x8c\xbd\xa0\x9cW\a\xb6\xc2R\xabn\xf2', 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r5, 0x4030582a, &(0x7f0000000000)) perf_event_open$cgroup(&(0x7f0000000b00)={0x5, 0x70, 0x9, 0x8, 0x9, 0x8, 0x0, 0x9, 0x200, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0xb90b, 0x0, @perf_config_ext, 0x0, 0x0, 0x10000, 0x5c588eb3570453dd, 0x42, 0x5}, r5, 0x7, 0xffffffffffffffff, 0x2) openat$cgroup_procs(r5, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000080)='lo\x00\x96o\xd6Q\xb9Y\xa9dJ,\x00\xd2\x97\x04\x03\xdc\r') 05:22:40 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040)=ANY=[], 0x6db6e559) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r2, 0x0) write$cgroup_pid(r1, &(0x7f0000000000), 0xfffffea6) 05:22:41 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10000d, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:41 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x900020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 688.600944][ T26] kauditd_printk_skb: 10 callbacks suppressed [ 688.600962][ T26] audit: type=1804 audit(1574140961.875:302): pid=20904 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/382/file0/file0" dev="loop4" ino=498 res=1 [ 688.638476][ T26] audit: type=1800 audit(1574140961.915:303): pid=20897 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=498 res=0 05:22:42 executing program 5: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:42 executing program 3: perf_event_open(&(0x7f0000000540)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000340)='cgroup.subtree_control\x00', 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000000180)=@generic, 0x80, &(0x7f00000004c0)=[{0x0}], 0x1, &(0x7f0000000740)=""/190, 0xbe}, 0x0) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="2d63707520ff92b2f197d86ad80547edb4cd282eaa6ef7ad6224d7b3ecb7b7a2436978ac3aad2814b44d3d3a4a9f84247308000000cb95c665a50bd1a286b2445614306acda1963025e1dfa600a8713bc838b04a459a4600db8401f170d92ee34e1f04ea91df2bacb934a272caa68cb930f14608493b756c3d164ffa1f3c97a8728bf67e946ec1000000000000000035716ed0be9fb90437e907d4ee63c572a67fb888108744339e535a893509d12bb3d06a2e00"/189], 0x5) r2 = open(0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f00000001c0)=ANY=[], 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f00000001c0)=ANY=[], &(0x7f0000000140)) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000600)='/dev/snapshot\x00', 0x202000, 0x0) write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0xe850f50af522f5d) write$cgroup_subtree(r1, &(0x7f00000000c0)={[{0x2b, 'cpu'}]}, 0x5) open(0x0, 0x0, 0x0) 05:22:42 executing program 1: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = memfd_create(&(0x7f0000001540)='}\xbf*x\x89-vO\xd3JUk\x88O\xc4N\xa2\rqI\r\xb3\xd9Q(\n\x1a\x9f/X\x1d9\x03\xc2\x16\xaf\x9d\xffl\xdcC\xeb\xa6\x96\x12$\xd15[z\x85\xf4\x1e\xcc\xfc\xf64\x00\x00\x00\x00\x00\x00\x00Pw\x1bN[\x81\x92\x15P\xc5\x0e\x06\x17\b\xaf\nu\xd8D9z\x9eR\bjh\xce\xa9j\xda\xf8B\x84\x8d\x12.\xeb\x95\x9a\n\xb2M\xc7\xd1\x87N\xc5Os?T\"\xfc\fc\x92\xbb>\xa3l\x9a\xc9\'\x14\xd5+\xb1\xa6\xf5\x9e\xd1\xea%\xd8l\xae\xd6\\dZ\x17/\xe7$(\x8ax\xdc\xc4\xb7\xa4\x9b\x92\xd8\x16Lz\x9e\xfc\xf8\xf1\xdc\xb9+F~%\x16e\x81\x1b\x11vw1:\xdd]\xb9\xe8\x99\xea\xd1O\x83\xf3WA\xad\xaa\xdc\r~[I\x9f\xac\x03\xf9\xe2\x12Je\xe9$\xd2\x00\xef\r\x9dQ2\xa1T4\xb4\x116RO+\x0e\x98\x8b\x1b\xc1\x81\xf0U\x93\xd1\xf7\xbb}N\'\xea\x8f\xbbdd\xda\xb5\x7f\xff\xef\xfd\xd5\x9b\x01?\xad \xa8\xe3l\x86\"\x94M\xd5\xfa]\x9f\x1d\xad\xf9y\xfc\x03=$Z\x00Oa#`qHd\xcc\x8f\x80\xa1\xed\x81 \x85\xe7\x1f\x99\xbe\xe8\xe5\xcey\n\xab\x8b\xa0yM\xba\xcf7}\x8eVQ\xe6d.S\x9e\xb1\x98\xd9\xc8;\xcc\xd5\xf2)\xf7Zh)\xffF\xb8\xc7\xd2%\xe9\xc7\x05\xefq\\\x97]\xd7\x1b\xdf\"o\xca\xd4\xe0\xd5\x125\xefz1\xcc\xe1nZ\xbe\x16\xa1\x8f\xc8)9\xb8\xc6\xc2\xdd8.*U\xe0\xc5\x04\x00\xd9\xfd{ZT\xf2\xe4\xb9\x95x\xa5\xbd\x04\x0f\x8eky\xd8\x8e\xd77\xd7\x0fp\n\x11\x13)\x9b\xf3D\xb2\x88*(\x02{\xb2`:\x01\x00\x00\x00\x00\x00\x00\xee\xff\xff\xffV2\xaa\x82', 0x0) r1 = memfd_create(&(0x7f0000001540)='}\xbf*x\x89-vO\xd3JUk\x88O\xc4N\xa2\rqI\r\xb3\xd9Q(\n\x1a\x9f/X\x1d9\x03\xc2\x16\xaf\x9d\xffl\xdcC\xeb\xa6\x96\x12$\xd15[z\x85\xf4\x1e\xcc\xfc\xf64\x00\x00\x00\x00\x00\x00\x00Pw\x1bN[\x81\x92\x15P\xc5\x0e\x06\x17\b\xaf\nu\xd8D9z\x9eR\bjh\xce\xa9j\xda\xf8B\x84\x8d\x12.\xeb\x95\x9a\n\xb2M\xc7\xd1\x87N\xc5Os?T\"\xfc\fc\x92\xbb>\xa3l\x9a\xc9\'\x14\xd5+\xb1\xa6\xf5\x9e\xd1\xea%\xd8l\xae\xd6\\dZ\x17/\xe7$(\x8ax\xdc\xc4\xb7\xa4\x9b\x92\xd8\x16Lz\x9e\xfc\xf8\xf1\xdc\xb9+F~%\x16e\x81\x1b\x11vw1:\xdd]\xb9\xe8\x99\xea\xd1O\x83\xf3WA\xad\xaa\xdc\r~[I\x9f\xac\x03\xf9\xe2\x12Je\xe9$\xd2\x00\xef\r\xbbQ2\xa1T4\xb4\x116RO+\x0e\x98\x8b\x1b\xc1\x81\xf0U\x93\xd1\xf7\xbb}N\'\xea\x8f\xbbdd\xda\xb5\x7f\xff\xef\xfd\xd5\x9b\x01?\xad \xa8\xe3l\x86\"\x94M\xd5\xfa]\x9f\x1d\xad\xf9y\xfc\x03=$Z\x00Oa#`qHd\xcc\x8f\x80\xa1\xed\x81 \x85\xe7\x1f\x99\xbe\xe8\xe5\xcey\n\xab\x8b\xa0yM\xba\xcf7}\x8eVQ\xe6d.S\x9e\xb1\x98\xd9\xc8;\xcc\xd5\xf2)\xf7Zh)\xffF\xb8\xc7\xd2%\xcd\xc7\x05\xefq\\\x97]\xd7\x1b\xdf\"o\xca\xd4\xe0\xd5\x125\xefz1\xcc\xe1nZ\xbe\x16\xa1\x8f\xc8)9\xb8\xc6\xc2\xdd8.*U\xe0\xc5\x04\x00\xd9\xfd{ZT\xf2\xe4\xb9\x95x\xa5\xbd\x04\x0f\x8eky\xd8\x8e\xd77p\n\x11\x13)\x9b\xf3D\xb2\x88*(\x02{\xb2`:\x01\x00\x00\x00\x00\x00\x00\xee\xff\xff\xffV2\xaa\x82', 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') sendfile(r1, r4, 0x0, 0x40d5) gettid() tkill(0x0, 0x0) sendfile(r0, r4, 0x0, 0x40d7) 05:22:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x1bb) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000040)={r5}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000400)=ANY=[@ANYRES32=r5, @ANYBLOB="06000000000000036600ed0057e005000200"], &(0x7f0000000680)=0x16) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000006c0)=@sack_info={r6, 0x3, 0x6}, &(0x7f0000000700)=0xc) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r7, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 688.884805][ T26] audit: type=1804 audit(1574140962.155:304): pid=20921 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/366/file0/file0" dev="sda1" ino=16780 res=1 05:22:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10000e, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:42 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="0400cd80"], 0x4}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[], 0x0, 0x120, 0xa55c91fed3cc2212, 0xfffffffc}, 0x20) tkill(r2, 0x38) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 05:22:42 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xf0ff7f, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:42 executing program 1: openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x3f, 0x3}, 0x0) open(0x0, 0x0, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f00000000c0)={0xa14, 0x9, 0xe9e7e898, 0x3ff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$P9_RWALK(r0, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x8) r1 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r0, r1) pipe(&(0x7f0000000300)={0xffffffffffffffff}) close(0xffffffffffffffff) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_GSI_ROUTING(r4, 0x4008ae6a, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r6, 0x4008ae6a, &(0x7f0000000780)=ANY=[@ANYBLOB="010000000000000000000000040000000000000000000000ddff0000fd000000000000000000000000000000000000007d740000000000000000f0124a61face70920ded5b264bcde8a2e4f31b033ec28b4e01991c194d35b22831c2716adfbe72f65002f4c281a2a3dc874108588befdb8852bea78e7dff87f6c3f06cbb182219a0e0dc19a35d6a20a0baa2ed8dbc6ac4b60b7f4e7ffe38f2fe2a2c4939b9b25f749f73e12d4bd5e87e95dd23edb42e1c32e320a5ca666680be0953c279596988ee9f6f3b09c1df71c22248ce24a83a09b0b6d9b4c01588f7b9a4cac7dc78ecea66447f8171ce752c43f3928c18090d37ce86786079829c1df452ef87a29580661684491d3e8eeb8ea5d336a8010000003e5de40e1cc396c213031e5748a74968c35a41c2660c7446cd6da3c1489bd501fc9e63f4918f49d4e232eb5b083772579dd71443b0e6cab7f7541979af35a6ba39f0f64cad777dda647ffa922c8466aa92665ed34af86b37f3a46e4085ff7115c50efeeab70e1210fea8b83469f3e9724ce408c99a8570678fb4390470b93f68a47bb60db26a3b7d424b4c576be7aa7ede1dd75b6fd2d7"]) ioctl$KVM_IRQ_LINE(r6, 0x4008ae61, &(0x7f0000000000)={0x0, 0x10}) write$binfmt_elf32(r6, 0x0, 0x0) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) [ 689.205532][T20950] ptrace attach of "/root/syz-executor.3"[20949] was attempted by "/root/syz-executor.3"[20950] 05:22:42 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r0, 0x407, 0x0) write(r0, &(0x7f0000000340), 0x41395527) openat$cgroup_ro(r0, &(0x7f0000000680)='cpuacct.usage_percpu\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) fchdir(r2) r3 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) r4 = msgget$private(0x0, 0x80) msgctl$MSG_INFO(r4, 0xc, &(0x7f0000000400)=""/7) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r3, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x124, 0x2, 0x0, 0x0, 0x8, 0x0, 0x0, 0x10001}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r6, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:43 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:43 executing program 1: perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1dc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'nr0\x01\x00', 0x1132}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000780)='/dev/net/tun\x00', 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000780)='/dev/net/tun\x00', 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNGETSNDBUF(r2, 0x800454d3, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x7, &(0x7f0000000200), 0x9ebe5b9d47df9f2d) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'nr0\x01\x00', 0x1132}) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000180)=@nl, 0x80, &(0x7f00000002c0)=[{&(0x7f00000003c0)="d2666955212da39dc0379a71f6a418d9969a153140a45a21ec65526f707f510487037d355a2da5fef0a580d67667c50578984a6544724c7011302d0a5f3c9864ba623298a856e99f1a8009bb212efa9673c7ada9bca24bf1282515226ac06a86c04b76d42f3c69bd4953ef5951ed49921590a2a470f6e6097f786a63863f7097f700cf0932905df87a102d6e322f1a57960408cbb0ce5c31d563e88253f0312d243327c55c2a338c", 0xa8}, {&(0x7f00000007c0)="e7bd4e771f31aa4c340a6cd87a64fd0b247cd142b295573d8aca99885930124c50ae35897414967a23369c79b970aefbacaf592f483a36dc0f02534fd71c1ecf3eba6d12ecaf0cbebe8c523673da70ab3335bf376e6e5d7debf1c3929503d5ec6f881ea81e428ec9381aaf35dc5813145ec195f863eb4e53db4a2b996a88ef269af0d97de68a9005d529e9d1329eb0f4725ab326977b0cb6052d853b45ac251c8abf6ee6fcd157d7b061d33fcec3ec0a78b3578fa071be4687a67c0532015e3bed63d43cb7fc104e3429831b3766337084d8360dc2d8a299840e1b1c0078e316307d6e8e21114955bf0a7b984b710bd5efcf5178129bc9b6950954727ba2d6d04142e9e161230ea4999c70b85086f033bb34d228edd3257eb4001c6aaacffef653038e232f38efcc96336a5a50e41ba01be75ababcfab742f827c19406bc25c328d25bbcefb74f7fe5dce539aa309fc2fd19322ff2195c503a53c4c2f1763df8e8d3c41ea7490a885a886af35f4904973d80b7950a495763deff8a15b7a104b5ae4a5ce3def0c06c80dbfeb990ac74df49824ab9d71439244d43e72cc773c71d2d8128bb9372d11b69d794ee9166d9c8b94af70957f27670b046fce8710e67472b6519a9fe11f10f4a0faaf93a8c2f0339de0955122d64d554adc2cd807cd97fe19509631821143bfd3f714eb4a8cecdb54afe7849434043ec32d22941081457c718f5679b7c5c343d5655ca46aadf3f8d8b96d93bb2115836ae2d135dc07dd63c3bad3c8c73139616ac00ec73dc605cefce14bb91626709232c37722601b277d1f14a423d0feae9701c5ae85963e65850c2df7459a03383934d865352601c87804c9151609c65915ba62b3f27ef826275ba1576b4fe879553f411c3247296554672092ba9a0c47a9a7b784386669db064077aa51e14cdd06ed42bd5d5af7cb39ab7943668e3d2f8b09f795b06371ffb53edb9972af0efbc0d2d6929f267524850d8f3164be6bcae8a607cd8418523c608c15e7c954c64cc5976a814822ab3caf3135cefdfa33339fe3e7ef46c31704cda94bca0df24d71a68837bb6fad9c4598d2430fa4aa01bf0a5c072a1ec2d138d0a1ea795d859c3e3dbba5b87cca4e6cca262c84dd54b014582baca6479903002af73496f152f0d98a532c8016457f291d95e5c36cddab827149ec483e432d7a247236a5cde07c680f2c48ed58a3034289b3aa440986845cc200305d7da4393d8bb52757e25851b19917811d50f26e5d66503dd45aea3ca1ec8be4e61a73f12b13ca02dc62661e3bca15b0f7f00ab29c583bfc3695c6d93b3ad540dd60575727acdcce68750c5340d4c75616ad2443007ce170b60e034784a457721c973f7fe90c8076dfd60a34a9bad1575337a453ad21164a43c6d56b8e4a8572f39c1f70afc4c3ecc330319c8807ce66a4668344f9ecd02504f13b14041f2fc720c1cd3a27ea4842d88edc011cc37a1a9e3b054743ef323c8a5a6ca690df285b39614fba720abacb7db7b392055f244874be153101197b8d76190296b0bd816807ca93324a8dbd8d6a57a0d1ea459e7c7068cf8899eba3d8b05d93a3b04d6478fd5806a6fc2b33113dff3a9c17c7b4d166297571ad013698f02f2391c31c5926484b17082d5a47abe6ea716aded4b003075635ab7e4a386e36ad6104a53d8fc4469e3e7037a8863341d0a90f1260034a7603622fcf2c75f1e4624b55690b477b5895a55a6a5c1e48ebf5f68c9cc3e563a453b094c4503d233179e241ee5162659fb9917f69ed98b0ac2503a2627b9d32d05e83daaa5b4e0743517d612781ff542717d8730a28b87997a3f036d4d6f5c2664736f1cf256989b786faa6e9c2cb47aea69d41b7dff51a05ef10b96c2839b9a35c0c7c59b33079b977eaf721e937139f47c519feaa65459b7856844d38e53cc7a566e8cb2cc0cd3204695fec365cc88b4339f8693bd61d2645f9c1e16be31cf5b7a673712247b7fe82af4ef433645b290f2c85ac9435cd8a432ffd1c1638e94c8dba4015c3300b08b495f3dc18c108315a73afcfe080de3c1729d903d1867d1cf99170f9fb42ca3cc86505d1129050b81a4cafab8453cdd43cc3fcfe808c54dc4af3f2b0ca89e293d632986928a8db8e2844dbb88e53099597882e0c04125a659a6c3dd7a5e9df5662fe4edd47cc6a9337b5bb878719a68c5fb4ce45eee816014b5ad8effba97e87aafb84db3c59025995b72ffe5fac496fb1cb9451cb1a1e7f430a3a62ce2a48e0db4aaef3f1ab3d45b2dcbc411d9003b9fb14630ef05feb7a129cbf06dedf7a46c68c5a936d0005fe94ef8ec3036f994c1e1576135650eb03808a8dd79b78607792ec8aa109c72c7e3572287e2bedc56fb224b4ae188be9193e302daf1821bbd68ce9d0baad7e40a3dfb004cdc340aa62a99680497a854160f0d30d9b73b9313bdfcada16785a73c523908d9c3d1c70c977547ccd85f4068a3d9bf9a0e22d43fcf7de970957b6d4aff353215d086670dd1531017d192bb021c3d3b325f0fc89b6f6ac3d5b8bc858f8941aa3d65dd92bb00f7210aee082327e055784d7fd78fe18c7b51dc99d6a30bbb6a5c5350e3485747e278858c0a00d660a3a8b703b72ddc341f3a9f5b430a9c810c274280b8ec66df48dbd2a91248b9bd99d77078f24e365276c3bf4fe547703528596e7bf48771e36fd6131992f664d3586aeb43c9d172036b4ff38deadff8190d2326ddcb57e4f884c58b2eac36a888aa1cbdbbea5a74d5aa9569de53c1b30de583ed8146dbd243d1127199fda35e61ab88b219e9082aecbf972c6a6331084aaf94c497180ef7725a1ac460985403b6b9701bfe3f51b0368b658b031e11d05b6c3388de6afa7971cf4eaad4230f3626a4368e48d136f3573191d2a4e215d0aa56393a3a6cf38a0d0cfb00ee1f8e5428a1504af191815e4150543234f413a5ccaa503193bcb5d3aecb4a3ae55f2468bbfb9568fcef0d85ba71690b0f1ac2e25bad5e319d34518754b6fffae081e9644345e9a1a01dae5396c336af4e70bc7b34195150e2135b13319e5a22add1465b25e3b7592812dd01209cbc89d8aab790c046584fe6075fcd8ebdb06ca52ed1d429bdb3500881596599a37404a5e18191d5546f2e97bb25f9251cda856fdc0a63dcd9d5f0da78ea473a097a49419a5d8dad5a98b9e9127dc90b4420cd9178146a11f38d0d7c1d1f88253a052a60d25f375ad84052d9db954cd381d64713c1afa4b45e46250bfa2863470edbf881b82e4d3127f112c35277608dbf36287bf8f825deda30f076cd80b086bbae6285955ce08e307b141cb99d18d4891d2d92745cb77e8b455e5368fb8550973be0b552a9239ded1066ee64fcded8cb883b9dca1cde1f97e0bd4066d0c0f1188cb8b7661073a5ee824f7e32d9ae4bb7cd24b772979dd1ac66d12871f5e78e837bf3f850dd01c68236073c706924e499214993d880183368fd5b0714e394ecc85c0cafafcb53e050ff3309f4e839ad74761d17ee9b3e2badc4e821e6f2786fe9dc2a6ab64d3f8b364850e561eaceb7111d94dc38ff30e51746db82bb8481355b38aeb770712d7735196ad9d401180deac533d7967ae8e27796fc3d344f6bf768ebb49ad575bd89374bc86be6cc6c345a7f74f6251790f8bad90afbcb7d642024eca08cac0142d5729fc70985c4f20ba07f0efada991299fe4c7a536d69d4a33914204ca345b823b21424c94de16c559f420f04c588d0c8d37c58372557540f6a9d2d1db39ac73559d21a2a34f1decdec197ad745ba3915f63874e0ff901aff9fea0218cb17644821ddfa8ddd45a3b2d9bd60521db898fc5bea33f64af624954da4316356bbdcc691999b90589b384aebc33d8e99130f99caf19f51b7487ffce424c58dd469cf577dfda7fb7cf92317ca0b89fcb112732242907062c2630a6a749bf53e94c9bf763e672ce3e188133fe6c8dddc89459aea2a8621ec33399abc81ef6b155828503c51a52db8622d7488d1ee5a91a53852975e272640552e0775afa4c10f53b2c4ea9173c31d799589a941f27d18a0161236627f1be4280dea2c10cbdfe15a12f3ebda512555e9ba3c56798027e2fc47f9166ad71f1ef2b0297a3098c3c83312baf7b9e63fabaf86e5134592182515d978a2654a49e7aae477997c4e9f1034254969910a542d7e1765a31ccd7c76758396ef8d8031638962953beeba73b3fc4056850cc2d997f328cfef1e8942fb8035db73a64fda0260198d50d7a47aa39e0db9fd1c1970d12a669337ca08dc3725713a7cbe4e2519f06388a692bd04dad9b2d8f5594acde1cce647a48cbd2fcebfacfc28749a6e40c67575db9cf2788da8dd25eaea5d8f16d56ce70f329f0659b09754fd013ac713aadb9d5d64fc5811dee4c489dfaf0d882a24e519924380fa0e8498db316cf57ea2fbcae5e1efaaee89ce8d474fcd59f0e6411bd5f243a3765c42f46a82d68e59a454b1a5422e1bfc57bad13162324306eb5ee584faa58ee9dfc30b74d1c3e20b2814a60900e61fc42658aeeb412d53ceac9cf018188b4979a947be47b50b5dc19753bb9eb73d1a20bb2da74803b2497e44f5b7347dfebe383ccc09290164f9feef4738398c4ba6f596476b3446c07a0ef33ee7796a517bbf5ed723af3590fa6f6245663321cc20a74f89b95c5ab9dc025e94166264f310219371af34e08c4017d8f07c9549be2085899b728ec2102ac7dcffc0609fd98012a0b876f0dc89af475f5469cb33f82ddac380efd1faa835430dcdf26869eef80923510707195012cfeb358f5ab4888214c3cdfbd6425d50d707b53ab0adbfcc343323b9b7cd71ba8c2981fd9dc45e59fb9eac7f4610b08ef18719dc83939dbfc035aa51305988739934f3d49428bcb4e29ca3ae9ce795e05ca1b1bde7fc7efec0db398e106b5d127cdc97c900e4f86ca38b9c329999db60467bd3a9351fdf201668b543112023d13b2f6e70e7cd41c6f14bf6c4c20f4110a884d45a7ecca571bcce0fe9d17f8fa824f36bd764c80962afe5a741b4b98abe7887c8e882009e43962be57947dc8b1c6565f3d0051cd7a70d62", 0xe09}, {&(0x7f0000000480)="4ad5342a83f8d8c683469bf7fa00b406531bb2377cd80e94b059feb0469141f32ffae522bb8e6c7e960611a21547151cf67e235d4da0be75e09b7c8cd1b7a4c5fb64d7e6e96c067b4fca2a1ef65158aba6e39a1b011fb0439b0abbe8b28eed77500a818367c91a2f1ae9de0efb9ece4045416a9ec6e223bb672a55fbdbb555598cb4d8d59b7c6764da8de2b45f4a33c94775", 0x92}, {0x0}, {&(0x7f00000027c0)="61f7ca994bfbc4207426b4c159061c049c4a9e04a1655c97d1010bb46937ced6809a314f05f1836c198ed386f04dd772349b7c9f9c296d9a05782ee1822911f27d8edde04d4c08ed688f8e7b7bf92054df3a2fa2a1dcf987e34caa2416a830a2916689027dbe551eff19414c64669f1e0a552fc96251be2e0aa5a73986e51a978bf42557ae26946db70937bb38a2d7a87d0d66baa47caee1b5b766c197b291e49eb1e9864a76c431d2232591f5d153c129e619974442c7b9ed304c1cee47ff4facf245c1b47f6e23bbce52cd6b75e8a4d70889d5221b0154a060454cdfe80cdb0c5d8d1404b676dd7e85bf06c2cfae10d6abd0decf3cb6cc174c56bb49ddbd8acb96e7e4fe943cd8dcce7dffab513d13d1df1a27e6ecba3a010fa2409310aae100012184ee0e6bd8e79b2c29aabb8f7a7d64344c5125a2c707234abb397f3a4ec23e1c000665449db4ef573cdd21f75238bff97ba6306fc35593e58a56304e79e19313043d1d435e61702e5e8361dbfae9060bf26fba93cbc7f093d853fbe84c94d44d73d83d27901c7fcab5b43c03b00eb49b5cc03955e067509af8a071cacfa44e2d7f666ad4249ce9e6a6797d179f217515a5ce3831837e8a8d6257794060c2f1461526f7d870eb308ef3cd409c111c6c027f4efc5aad338607c2a3def03663ad9b2eb6d363097e1d4aa10c7c5468735945609af10f5490649efcb049ad56f287537edf3b9ca4bec97d3f45943afc7343c0963257b35d9ac708a3c62418fdb03d1f015c26c4fc0f3edbdb1eb4d2323aea83de230409aafcf664fb23b43e1e9723b898f4888c951f12269638d01bd650848122cf5fac0c0911856064d4fb594a025844766b51e4ea09553f907335ebc38098b56a99b5155f6c24989651385c941a5511e4f226ad5a9b7784252a6d1ce71073ea9d46d72d094a604ddec62f813feb94e9a8c827bd70f5cc15f1c1c6a90ad4f0ce5b60f1b770470dfd4faa1fa806aa7792632457309cbfd7f1c8f6984ab6f1baa966e426e315936915d9e8d7270642c3b0a6e36911b66b4140657b866e43ca673faa65b419c0e5dee1539d61f2195ce08fd65f23e278b5f693ce040ad73d0c1f98c0a6f489d40ae56b8745e3e7efb9057416a07b6e2cec947418afc8f0053913411c5e7a645c548bbbc42a8fde90c8ff879499e28830bbfd26cad1c414c9670288d5ab54a4e176ce7073f55be66c376880b60b3888da871030b1a2e8cc38652a3f3030a652f48d4ae84f3b5435ede50486c3d5719cb18c96ce5325cbb5c1c867a63787b92ed1a457b0046079305b04107950e1e38c1d60863e6ed619674038663b19188c7d50567f2246403aa83d1dd92dec9fbe53289ea6915f2ba409ae119de74cf7ef1e2130972aedb1432c1e046493e68d754262e0481d52dc98e6dca29e83e9fbc4d0625164e2b22f4b2bbc7149ceaa7f895102a78b575e6b3c82682e01afc807e2a26d05174d0d0e64ccc8832145909917e0b963feb2ab23560053f1385470704eaff533af385209e52c9da167c9158068f981a7f5973719930238d5289979a4ee73edceb8ad6f7827b69c1de6e1c3714f126d5fb51304aef2ce2a2cce9ad86969d24fe32ad754ca9f980a57668765f52cb591d069689c226d8e2070c4278bcd7f6e931587b983924463d97a615c2fc31cd940f73b8f801f36c9b5dd26e0d9fceeed9ea2c1eb12692f636a997cdda76bfc7687a69510967b2cfe28d6d243c7a1b51dc04d373ce397873823042282da72a54aba98b5bd545bce2b3d92ee01d9bebb7f8dc32d26e4815ed7d1708b464b11b935c62e6656a379d955ffad3fa52e9b37f9990fa4da017e13422de0c165d41f387e6144f6e044a5591bbe832c872ab67c2c732279d79b834a5d4216a1de37da81041a367414b4d97729f705e1122fc99928df5f884935980cac5f1965fff89d876728e36287b17a5064c3bcb5a688b8fa241d53ca3d58e895e2872fa1e43b53d895bfe45843861dbaa5d21d9983e5e05a89091d8b2d932c01fd571ff859c16e56af29903b518b47a70ecbdb0236078368fe4f0e67af85db05a3001e5ddcec1184c874afd3738efb3668c894d8ad0e4dbef103d18ee54beab119e42d5d9619393d66a9561b8a62af4d49018bab590994a176ef1149b91ecd8b292f4d0b3fe3bd4ad8e013019bfcfde99e1038aca55ed78e098b4651ac96dd211773d8da2b45ecee5f983fa10306a687c254cbc70d5dc33e5aaff96ee39187d1781f22161315a0f9df0dbb40cbb434692700e09a8bdafbabe4567e182644ff04339a41d48b92b81b9bd06ab7e7b4711b74db61c92d07da3ff46c40316f96164619e8e402463f9f98b4881c057660afe8e9d3c08312548902cdc96e1daa4c6c4a57463ae7ae044edadc30feb4c347262f3ad37fb872fdb0e1447ee23eabcab3fe432bb1bcc5a85796d65d05226c5d78aa30cfceb9354656e3d4ac9f86283d2d9341bf2f1b3ea33b024fc16c3a2b08b979d18aa854e86499a7d17b31109f1da61326c363e7da1d256ee16e2aa1cad954974106552ee53bd1aae87ba2ff14052c6053388c1653115b4e15b02157e728c3dc4aed461ca2cdfa0aaeaccf7c859b8ddfabc7764da280020ef8f364b7c23e60b20e0b0e24f0d1d12086a33ae2244d120c3b978b27e59c93307113bcd4bba01d5504e0dae60326c9b1b4ab7445b966c8b449549cc69d4c4059a13862217514f032049c146c2dfcbccc0cd701f3a0f9ab0c2bff749fbaecd68e1c043e83d184c496415d284c16789d76b93cb948ea5c53d28f54387fb10f84170927e169f0251a17c100e158447ea27cb42928427a54f25a325f71b3f5891eeca2b904e30d45f7d3665f58b3011ffec40b6d4d9acd5709b7d0f082011656bb48d162b7829be6c4b4de01c59aee5e8524bdf0d5d927a6dff8986064321bf6c09a1f984f158d0f3c9428e8103a24a1cf4c51e73e06a2d1d9ddc0774add35dc0b60b404c85ade34e8d7e13672cf56362178fd0a3c1ed590ca89e15c164d08ad1caa019aa5d6df2136b11c74443186bd2b9dbcb864696b99c234c9dcbb062cef15294af44c784b5fee8b09141ca924618a9a099ba746b3fce6695127b22782cef69cd9c817cca8d563d20c0c99007ab697bbe49b1c65c7d189f7308232b3dfcf93394624f4a1fd5c77c7aef01d65868c4f79834a595000076c3300a5032798e3165704d02f9ea2293cdc2ef3e283087f8becb511d6af307a8f4f19a04607b74ffadaf50a2211e2f487448a4fa9f4fec638ffc7b3a0634c4ee408e090bd8b4246f45c81c3124136a0500fc867199a7871da9546be1f7753bba37d5357034fde5fa41f0ebe216a0e5b4aaa6768cc3341ce83dcdce515677785470e9a441d4ded7ca403e727ac06f82a280c90368afc89d9570425a399b9dc0b818ae9a98a9843e10b404ddd0f4c912e760c220ff95ed326f9c3d51970d113d93f99527f61be2a266f838d6e52698513aff5745f4ca2f953ee7c3f14aa3c19bae19f6a98337f9c0de709cea170d805e5268dd80b6935daa88148e4bb6aad08c510c11c4ab7bab1c7e6f1b2e66bce65f03971cf1412302454b0232e06c4d0984d3668dba2939d6fde0da8f0f394a733f410d1ad41ed5d7f54c6b417af530c6d35c71698c2cf5b0483de4127a81d91896666a608c1e80109e5c2a885a9058d9629fa836e391a0f23975d7d4e4aa22cbd4b8e09dcac0b056edc24af8c5c59efc118121b9bea69e28afd17553e9467b04e3b3a260f60de0cab73a062f3bc01d3acd722c06cf569a5f24973769d75b827c9189faa72fae3ae39122e5d288ce4b21e6a0c36846dec2e3ade87aec89e744f06fbb120d0c54fb8f54b9f6c8dc98c28fa4f9c91518bad545015fdef16e4eb8a5d506cfd13aecab93cc7aaa4c2320adb72c71aef6a94119524efd1cb3c3134b60df6501ad538f3db1b3c61ef8c592d1ecb4c598b99823c94fe1af189eb46d26ca5fc20437475a30d54079af2430d585c79bdec4153dff5cc2c138d0dd80b515068e5fd7506b52856e753fd628c80f91d98f59a664c0be880e5203cc778b548a8b6d306287651bc228eaf83138f25fad2a74d9aa8aa23b4c25568b61abaae6d3be4495c9d6a45df68a8c2fcde09dff8b4ff32441ab6ccec20539fcf212506fe3873fde6ea278690e117cddfba35bcec0be26c95f302764ac20edd313c1c4af6f20e6915739f50a12efdbeba6493de06ebd44e0a4b64ee123c34994e86933acf8552225b2dc7dc87362ea71a2392b09ec795dfda56a69e470d9b4808f881d17f9c0ae8d43cff63f2e4bc1eb3a7e5ad0347904c90a39937f61d028abfef5ddfc3b2327a41cdeae62535e7ed96309e9682ec27869b8adba7f53f1b3c116893b3e55e419f4bc44cbc14cf75ae5c72c943b8591579a619bfbd6fda1dcd45af48f84e5f0ed267697b5e3c0dd596436bcd3d85e0f6ed3be1cb0aee2c019b57730623cd2ec6b71e48ea978033171b1ccdc90dbada71ab5ff4603aa0e3ec870423872671811b66d94ddc9fcef606154855cb2b9495616e8055234195b478744a2e05d7e9aa56717672a00d7bb89e328dbe99753ab80a2184b15d09322c2b1413f9f9fb8f54270e7519ac43fbbdafd4fc4243950e7c5c75e2c82231827980a21eb7984bd767df358a4d508a4d8120c9a6308465849d06161f58aaec922cc344cc7c4659fd0943416c6068e9efeb69a1f64db9ea07bd01cf0b9258983a754be5ddad158920e03c9383af39a6613207c6e0d39b9e8f58265b8fb5595d5139bf477999a3fdfac64f66937c51b3998b167fbdd108751719ab675d01ecb8f23b27c6202fb1a0a92adc1630af576e1743339b8e9a815f8046ebb2f97227df64ad47a528f5d91a5e22bf6e2065a988908837e9e991a381440a77b5cd2559c520b41642ddc10a14d44b686797f7a6e0642363fb87da53ffaa90f8f11a209554cfd021554d486c06b11e0166beeff73c72dbef27f31cd9f1af8e876c292be698644e5d7ff6224942cd817942600a4eb31299475f5c53738457bad475298cc49b4c5b5f5106c27b7a5892061c8abfa84b1a8fea7ea85f5a4c45d1584d8dd14e7a262485b8288a88886f5ae05dfcd36edfce691d65086f5eb350b6c017ea294d80b3fc7a0fbe62a51a3a9a40fa988f194b420d5772ee5e46a7458a13df092db348d19b15d66e1ab0cb274994ec3548e711eeda28bef7bec5348cd1b178a00b564cae337f4404224e67bec1e53677452e3cafd95ca317f2399273739b6687df231963ae567c993289f2e053dcdf1f498395d2f54a5aaeaafe90f4ca38a3496301950c65bfba6f8efd202e7048173a04b71688e7ec3e23165627e122c9605b1e2997205f62f34b7b434a73cbf560b905cbb58e6a64a5d4c24dddd72ff0f998834ce4678a0d928d622b5c2fae2c4ae8c99a4054ea8eed0f9f38b53362b48acee8c8da7746a3fe77a25ae9a06de0cd673a144938d6f881fa6c1f9605ccd0c3261f04f1594e0b3b1ca0bb361b30ec4a653bb39b01d4c5214043c829b741b06053427bab78065124ef34b843b189cc7f3f7216a3333a3d0c242705b8892918a07f8ee0228739bf056b0d47e614c9653428d9b2b77fb5f960179fc0debfe41d75ecd0a380756f20d53cbbef3458c3da2fe2d992bca47a2d134ea1a7a00b8cba39e00b0176d0f9bc6a8a604ba8bad1e16852a1d119d840014d55f1ee7e661923418961e41cc4cf8c1534fc31b449a090e9c604a7ba2058494b85eefc8854eb81c385", 0xffe}, {0x0}], 0x6}, 0x1) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x3d}, {0x6}]}) 05:22:43 executing program 5: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 690.022182][ T26] audit: type=1804 audit(1574140963.295:305): pid=20944 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/383/file0/file0" dev="sda1" ino=16832 res=1 05:22:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x25}}, 0x10) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) r3 = open(0x0, 0x8001141042, 0x20) write(r3, &(0x7f0000000000)="b6", 0xfffffe7e) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r3, 0x28, 0x0, &(0x7f0000000680)=0x2, 0x8) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0xffffffffffffff0e, 0x2, 0x0, 0x0, 0x200}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:43 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:43 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10000f, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:43 executing program 1: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000000)=0x200, 0xff79) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x100000, 0x0, 0x52, r0, 0x0) [ 690.496379][ T26] audit: type=1804 audit(1574140963.765:306): pid=21015 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/367/file0/file0" dev="loop0" ino=500 res=1 [ 690.596773][ T26] audit: type=1800 audit(1574140963.795:307): pid=21015 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=500 res=0 05:22:44 executing program 1: syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl$RTC_EPOCH_SET(r0, 0x40044102, 0x0) [ 690.695356][ T26] audit: type=1804 audit(1574140963.795:308): pid=21017 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/367/file0/file0" dev="loop0" ino=500 res=1 05:22:44 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:44 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_create(0x3, &(0x7f00000027c0)={0x0, 0x32, 0x1, @thr={&(0x7f00000007c0)="da22b59e36960fbf83e0d573a0a4104edb101e75ad6315efaf42bbfd7e00f4d1a17d43fbbf737abacd58b7f8d8fd7610472851ceebc79956251c58affdf72ae2116f5a8eb2dc5ece745ea87d158fe1ac34efb9f95bd8b79c6346b3e10ab1e9cc066751b368d684988dc35be760554fb156716cec37f664ee7b4dc32946f188eabb5f1c212c09ef2da11196c6d1835f0f8007cb82093968264ce737267c1ab4827bb4608a3b62c01eca13e48a645dc43c147fa533a02cb294c58211bd86dfcc5df0d82367f1681cb472fc5b4d6bec82b743e7a28ddd82394e17e143e12ab680329fd5f2f97cf175cd2fcee1db044be3e1518741e9742c034272eef037c418d548080cea02222f7c9b8f10b6ade3545824f34cbb1666723ab2d564ed5cd8afdc9240611140881244d381d00c1e53bb4fd9003b9aade8e292cc6ee2dd576a47b36eb74984c4ef22dbc5465af8ede5d43d5982d22ca41a1a9bd722d18f59ef5f181b5d0c9eb91d13ae9e241eb87ec248b79220e8a35ac202e3337a3f90462efe5f97e4b4cae1aa74748a4bd2c589776d513c12e48393c8a1c3644ae1760b98fd880b3554e3b7ef1ec43c5033599b83dcc9fa5c63a6a5bd2215003abab7b8d720bc200ae76200ddf6cf628a417f15f102f0651f6e5091f192de8b92be109fd471d032ae8ee6d7de7b8591c9efdd24a51a309c9c0f8475869ea152ec69a7b9fb47d0e0ef1fa6b1a0e961c4d55e355ca3b5943a188180773817e94b9c548308d8925b090cd95b69c02a29261cb49315ffac18b669722c765430bb7687c3be369aae691a42a84dc0daddfd4afdda69f6c6e541720c9ac441d85ce9e6741a107d31922f187c3770633b29da1eb7f74530fd00adf32c7c814c1c33035de0e01b367eb61a590f64e463cd3dbcb08c31376843a40ea6c03583b5a943cb99a6a482c281a25062ab6c72356f277037c2f25e8b9b79a9bcfaef4e3e90a6ba27830414634c6ca9d062ad160f7b41baa2c495a1180d27d2139277d499f741e44baf4d6ac6067aecabc43b8f7c9ae0c07f9d2984e122348050397a11f01146a2d2780116593f599cab51fd9ac0d747bc6c66d1f30b17bf84e45f955347dd527d2746e61bbc3b6f1285133ce872df54cb5c48f7a1eef55b4a9ef0af6739ebfa7841076095becc80deb78c5c6ca868cafeeb45689fc2827d8fbba18492c1ecde1f7038ed112d0f9c2e497ef79de77155f778f62ac7f4d289b62364384dd6d575dcaf82a4541de0da93ee543ebd0a5e6006852eecfe6ef2ce901b94a911cc45600a2a936a88a1b0f613c5f044fa72d8840811f49f916896bffbd235d8118d500afe9209524b4eebb39507c999a86c523e45df453b82d6ac04ffcab80507d9115e7535e254dbcf166cbeb6c75d587e0e6bcc301e74d7e13357b6ff8f48cf581d5e450a6013341ddeab3fb6a51c32010ed583f305d19c99360954f80ef7a257e3ed47f7261e89cb2cd3e08eccc295303dadb40868c6fb0cbe2bd431f363cdd904bee05e1b5897765fc58df82dd78745b4718b4230e5853bd8fc1d7bc610d1f2460a1deb54ec229b0a525d7fdb483632ab4ea2f5ce6e49b4e2a4d646cbff6ed5fe5aa094cd7a33a0862d93c3fdbfa10d00ff9bf86316ba53c9f891fd6180b5113b1ad78d49ec23991d5ce9d2c3e16aeca942ab0705fc614f87f1692060b586d3cec26a7d2b051dc3fac6d77709a53b4cb72a29b58a4e83494f98a6c1834ae6c49f559c25bf6072018dc65d0f2e9c68d516cd0f026619bd1f7424137eec4a1201c1d90572d4a037588384ba626c027e3f7f8d9608fcbf9fcf9687673aa5f35bc2a7c8fc06f71a35e906e0d9b6a524071e999e900b8cc83696f2fee67305a05c8c7222f96455d28c0287abd7996d83df67bac43d7d87a039baaae015c7733ec7988c57440343463fc49574a86e7960d1a939037683bc47f7395b8e36bd142e9013852975e8dce92a8424f429e982b3714d2acab7e88b6f6828fcd0cc837364f88d077940a358f9d486d4a8af1d59cd281ddc3a051cf6e8afa516ac178b5756a357cac9b2e3f4162970ebb53be717fd9cf728c63b61a8f3faef4cb1e93cb0567c11c193daac5ade6b6323e287fa0040554425a5daca12becf65cf1de1f2b84069ad3620f8a26cefba6d1588ea04c2e7bdeb86caeaf9126608ce177f56ef3b7d90ce497e20a05a480e8a832b8e30d44d60ad01eca7424279f0e2ed05aa92bcadfd187d0fd3726068984c03b0b5add05e1e6af83e5317d82cb4c05a3eaa67e13cdbfdc6ffcf9e91bbbd1865ea96bae4a53fd56e0f4a4ad5dfe075cde96db6661cb8b49681fa9da14512230d3c1d027faa5ecdc13a31ddafd8f6e9b0f9261c4c4f8d750c0b28d24023e6c8ed89c9f95bfba9adfe93bc7188dd34ad82f124762e2abf6f28f9255a081984baf8742cf2d38d894ea56dbf81523ecb0c14c2fc06e685d39b51c85a08dbdb93801ddf75e6fb51647c115d8c3ec21432355bb4dfe87bb552905ffc3323b73657ecc1b9efa5d4232d13f0e128fd9fce3e425f7ea84ab949ba8cadf14716ff2f290394eef75f9577ca47f97334abeedd925d2329ed127bba12ff029e1266a3b57a7da84b14d92f248214e68d113a8b1d870d71172fa1f8e35fe043fdb127b81085384415a017695f7b5b8b5d07cc5e308b53a0cd253bae3f68e79e6b1641650bc9e756a7a013db6e3a5152278c8766d7dc0522f3af23a3db37d1f0ba9e86b03cdb7e95879294a02cb7473a4a89af727add90a802513c38239435044396ffb8c8a2c9222a609dd6ffd4f9739f7ce2a2ff52df492f31412064a10e771a569b6a7dc2ef013eab7fba57d3fe6508b0e67844038f51e963e84bf4de6cf65101e537979b07de0bd139b5a4d32eca65182a0c66dc6e99d84447fc777af8dda3c41d14c83f2af89b66c0485540e252e952f009f91f76b47e2aa7b611898cdbd31f8e8a5a41b540aa24ed53d1ff37a5dd682525721a4a9a8a3ecd1a98d2b835df2f7e29468b9d965c1bf288b5cfe5aa2ef7c38ec1de9cb89a05dc95fa2ec5daacfd62156cba0f7f2efef9890fec6ad445ad58ba55edb6ec01395cc0d986b8612699edf0fe24e0b6d7a18081c1452f0f43d277b365fc35bc3fee74d17c2a7e4709e81a6b2f92437b3ebd35e277f902454f8e6cdf983d70b38fe1c7ba8fb46b7a6d3c1e27b523601b6632b0eb7f326248a8f80573616673e9275bf8cf47ccdf098ddbf1095e0cf1191be3bfe4f5a2ddffb2c28ac36c441df8038100637513fb27f0bf20439021d5e3c5cb18d485c61f659c24165bdfd554ecf4a14c451bf091aaadf12ecb9d7a3d552a6526f81b8d9ae96711e2a3bc909d6a1f92a0a2a5625e33d901205c7d5edb038a3012f148abc3995dddcf4c6889eb1c3fa6d43b42417dd7f245f6f3b7c4728baffa9a535f4227390e57eb40a7cadd396d417ab49c0fef09e6ac510e35d3960201da688143ed6d457260250a770b96f7e6789964e1a1892cc06b8a87399e414b5d5758d44dd7b5db4fd5474af7833210a07a6c744b5f976e5b90f377a880941753a2bd35f4e1069207f5a3f604ba4653cb8ad58c2250221de72fa9414edffbfb7bbbfb25878f0729923d4d6ce7efb4f46b571be2782aa72096b27a526536674859a158ff386e879aa4d2622096706a041406eb7c75933e3abb388f931ecfd69298735ba3181a559a5b936a73cf2ccb26b913b01bd78784ebea4d497a3ec36fa83c58484475d42cc44c040d8738ebf8b448d22c8a6b4089665e7af2988c93818682ffef297b2594662ae24ff0132d79f0b657b1abdceb1dfb599ce146815d0a885d5a944bb3d3b5cc710cd2c328806e2141cff50154fc224d75f1896c9615a2f212d8014f34c74cb82384fa4b65d656dc5039ec520212b262d9b1eab3050603610f9a047c61b633dd1bb44b49655f6d9551b06396bcac422c2cf4e5a11ae4701df54c0b97d2526066ef5ee30e3e849c3be9f08d774f05d61012ada87dfe2a6af3b2a03a93dc7b70f6af03911390d6e9f62a215be7b3a3e8f5d7c2fa1744f68bd037c5f26baed8dce632c1abf1fa91b8fded9142a370f824e2754d9dc97fc046e60a79f7a5beb48736ae7510b5bf5cbc722a3cbcbd5871fc1d846d489ea80ecebd7f60a6b1518ba6258b75d5d16de07f7527cf440b1a0dd0415858aeec6b5083a355dd50cc3977d5850d3b409ed71fc72a1bfefd3aad12078ecd92684f220483f95154c03dad1796802a443ef2f58131e199e7144490b19e3ffe1a78b110d86106d6eb8c4c952a4cc0b9c5f2927ee33f70a3894ea08b50bf1a8a6cc2801cfb626e70ba32a7842af1b58d52ff5dadb0dc57968eb1ed395c7f20d279e61dad7fd0f99242c4da4f05e126e65af89f00313b0b6e1e1586f274e9cb87a27b3a9324ed3d99e75750c8ba35efea7ab8fed28b4a575b0c5215bbd1f5c416db02fad1f68c34b9e9b6ca327821b71fc3b985b834b5b13e255c6fd065d51ee829c775ec26a41614823bf42cdf0ca1efe68ede0e1212e3c46adc1c458fc5625d1a09f4a1437218e983725c256fa82bd5c2cb7e1937773db606f82754bd62c0d256b57e6246c703836342730edad65493db19a13b1ab8cccb7ede2c7e367ef4fa1cdcca857707b4e0881090692518c8214d0b8bdf89c9185e87976937b225a55d9b0b73ef886c9dca37d50274401c31265c30ea018a1ca33e65bb86a3a77766a616be95724fa3ef2f98dde5b48514a3a5ccc54cf3045b20327f95c7ed0168bad8d10efda603934aa6739a763c2551047fd2ebe09a00b93feefd7d13fd0be762e4d01cd3e343a83fa366a324671b37e422faea407f6d317625476006cf09893464c840b8af2327675279b838ea405c84227a3c574cd61cce37706aef9814d5e363e9fdd3d59ae349a9b6d68bf42276f823090b04855a4160a92c26e35449521e78738c4b3e5f1e81b7adabb6dcdcf41135e30c74da1fb9f1403f219be40bf75ac1db79c1af0ad8372c722f30b7245c096ad0ee49aa05ec2f8324932a9e39667021d03976dc632d1ff5af54d0e00d3833e09d39e292b7b2879bc87282147ccfeac38fac52ef84846ef7fea3689e3927a1abe509b416a4303cd644dc6e9752c413be1d7ed524550b320cbecb2af139c2217fca648ce1e57437d4f41326c7fc3fdb71425308dbfd6f29f920a4023eefc074b4e32dca84c09a3fce5453dc80e63c0a5e091797c04f66c4b9e921b00cb12f6f8e5c6841e9eb2f96866700abacd30ce3269db5d07b3a13b6b68fc033a9cd04bf5e1ce8cf5e20f13e56fbcb925ceae68dd32504ddfa128ffb4960f6595b760072e131f8457ff4115ca7131d7c1cb1fadc3afd59f89a7f35ce747c344d7bf0ace74050ba88d4c2ed9da2098e75bf7c86b92473c4908d1d1ed6b2f681b89a47653c33ed4e53ad54a1e425eed6a88e43ce0b89961b9c295abb35ebde3b815debd062c5dc31e76da7514fecd62a219f1d2e21be87af8f2c1e5811c4e7d54693af1ae660c9a95e5fee6d69baa32803dd17df1fbd8b3e53144d833e6ea9f68866e42d6638a22d5493f8a1ad8fb4a647a9b556678b73799f1a27afc9d7ac3a08629589e2d624550a9b1c7098444eb00eb2746b08419d5a0e457d36d50920de3dd0fed88cb5127d4fd0357901b334a2bd3e912fe9907bf0cc12075f95a5fa2033ae94ce0987be66844a2c89b442a967c562e5ab653a21eaa868a75b63d6604b08bc78361d567754a5ceb74e6d3edf6bcd6250d410d13e238f23b70c97537894", &(0x7f00000017c0)="74aac3307749eace7dc802d9dad602ec65deafc0388db3cbd65892d1a5b384825404ee960bf6bbe34cfb750c79208c5446923d3f9ee1f146de7dc11b07e246fb2798f1add15a95194ddb365712737ffa203cb79a4086c18c0d63180f740811154abfbcf76ed10bc7d41f07e02c0b0436cef1f6e4f41cd9176698ac321d4581d057014c94288f434b64860eb41ad15a27a8470054f97a60a64f7d570f79a2487496ebd2a5293cf4b9b40ac91d47a63910da4ace091a594d3f5f72225736e1acff05e4ccbd45748cac472eeaf9d7a019eb9e2d129f5526d4b0f0429d635a737792543ac2a363d493983de1cbd60bf8dbc85c5dba0b47d0dfe26e04fcfe12159a6610332db90e82b015f562931f0bf16e7dc348d0c80d725c7acac628f832364d035f4610a705b781c4287d6baf4dc1647f5f8f01478fa675f1b1c177aa5af411393c87e3f8c872a3dfe381875090c65ecdb54b0cb63d5e77b3efffd2b710acbae536542905edeeda62703251efb7024cdf21d456d893972bc6fdc0fe436289f6d59894ce27cb62c32a66526fd754bc62aff21688fc2454ad9c5c286de3faae81750e0911aab25968cd100a207f1356b92793537611f93e8978f723b4c0a5ae8a677712ecfb5dad51eeedee27c99fdf9602669057455d609c3c761fda24013936a2cd745168aaf143454835914e720ce8e29a96d71cb1a851ca6d4702aa14dcf6b454116f385b180658e421389fbc51a6ca4fa0af1d86208a10aa9b5db352b9853c864b06364c579ee52e0c7090be951bf9689a68fa4f6d5fdc28ffdeb7b7093a9b9cb50656ec5e5ec35eefa0e377bc45e5490dc50788eb2ab07636fa1cd428fdd377797c8400282df57bf1d9ac8e129920c3e5146192a1bab1ba0203f6a23b85a1e30f6a61ce4f7a78c173cc7763eede3c68d6d46c08bda8a2a8286e76b99bb88948e4c35956b96dfb78927f7f577aa8a2b1c5a3513074e6753028199488246c03e7504be4e204065e97ff04e0ccaae459586df7e11836c4b8879921440e20b0ee04b2257fd5a1ab00c285d3f4f65c60deeacdc94be20a9792c2a0440af0bb807ece6d3c0058a66106d4376449504dedd1fe231b8a91a85765ca06796e806950acaf1c5df59212cdd13e959434546ba4236a98eb5c5d21088f27cc70ca04352870332a3dcbcee3059dbdf4d6e9b093d296f856c14e26cb40ccc85bedb3f81223551976c7d389380020130956050d42a5c01c47418af65ca2f7bba4ea0ce2db15f967d48d19191466e22e26b251b807bbe430e456fa0843402b3a391e276c74271ac34bce9cdfac9c8c242f78ff3d18686dd5549a00b8ce6c5cfb4a4a8f2c125fdef6dbca913f0bd756a88218d097d4038dd73d28df7c0ecb031e95426669c3807dee2694c343dc612b0af670760171cfa2048dae49d3833d07292f69cda278d16fe7fb787ca44bd8a89ce2205861aae214d2447e363fe21e592a89f80af7dbb464e4ea1e7837e3974554f1cf194e176cb63c0662ba552f4f44f018ba956d8a0e7198bb01954da06651c4b81be3d7ec18c3060b47ef7420ad73e4c09eeac6a74827a8678e1d662d2425ee00faaa059fdd73f5c8944df41348abbb70bda8be937f2c0c237e8ee29441d0042c34a8a1fdd47d93d0cedd8778f08ee20cdd6a5af3a2579a373a435866079f1bda1c96e3b15a712789525687095c13c21e4c4d273aebe0e652d99a28e5c3e74ed4f7d8a2c53223c40a3c5d32f9bc9259ac78bb0c1d75e69d429ff62ef7868c77eb0da5554800e854c2939d80ec7e0954786d2a11b9fa1786c8e60502417eb59aa8afc0474b1a83348b4da8f08ac108d1b577a87cceadc9641e29603b4540b6582e69c4b5dc340dd2dbcb36affc9b1edf7536de39fe0670696185385b002f11c9c40db0f1ce69f93f6106e4a0e53229f109c30b9e586be630430c9f95d52782aa4909ef37b378474ac3f120c6be92ef2b676f7b13564b8c9052bd2660c2e587414fa4111462b6e9c4f77fdbafea24699c74f739deca6e08a7d09b9dc08d16ae82b8f68efe2d8a9aad5c85610f9932cffb098e15a8070773e8ef5ddc8f88296f1d1923598fccfb072728dccff7cadc7f8b38e0dab4b7be9af75124567198dcebb80cfd31c3c701a6cbf33da73a6f23c1c695127a1a7d62c434235e724a1d78a338cd77aa427a27d06c20c89fd36e9d7900e438dbd3a729105ffe1c8cb4c8e16a8ae9850e7d805b85078dfda56f06495f4c9a95d38735592334679e0f131028a61550ec384f09a00bfd17ab59bc990858413291b029c33d51f4b7deab2f788dcf0c116125b5806c3e2baf794b82b42e510ba25401caec185c31693c29035d03e7e1fb80bd937f0c8892f20d1255af06d69ffbe5119b23d44ea4c68dcd7c163be822b758ce26f68d7413efc010bd6e00fa6e21a3bc35465433023c79eb8e33be20cff6b394b5867afc3c7c3c51f0d834e4dfdac2e1ed0ef8072aa5b7be64399be0abc0e182d88934516ac52eabcf6127bff896765825661e9cdd0637950d420f3e9be32bf62c74ef8a4d867ae67ba6303bc1841a9fe52e5a0e2245bbf1849756ec4ef8bcdaa006caee1b9b5c4e86705a3b1603a5922bf367f9c8a7842c9df693c04b5940eb1b881eaee5c7041ffc91197c1e827afdf14a2126d3e41cad9a3a4fa201f0f3d9fb434772dc4160ce36f1815f8483baddf3634ad15d5410b490c36b8780756609ddfffaea37fda0eb259e7be25d17d9babb99f076ea182a691385c0d09aadacd6e0051d14b0abaa2eb2af3f2df1e6c3f62691ddbeb81f8e55e5e4f1aa447810da70ad8d9ef7f35c3fa92122ea883f71c7ea01120a4efaa39c14d55f753484ecd744a3f8bdffaa8167a988a23755a3f9bf4d4691dc220662ef38e510aa77ee247485af01ccf86367462f3f110a472af8d4fd33e8d779ab62096ea5164e54e5deaa6ce0358137ff15b2bc6116e2242fd270925fa0c13f3ff2cde7635b1247143568592d9a32ec054ebf9cc0b759565ed35a687e4c52d144394e3c74355249962cbc78191a8d479c83f01c38b450863acbc6802554a671f9ce1497175b0c480a92375d4fe9525e5afa7fbada22b7221548ee3f37222e51d60db3fb4e449132494f29c35ca5ed8d9572e6031bde01032c5dd59a1e5611cc8e56d9a7407e4b3e530b797793d0086d316b110a1435fc4d9879dbc7890abf07331d5f9cad0804e609fc0547f789a5fc5c0cf94b1aabff70199687fa19f29c838c77fd7de471c5efae711fb6dabba5cbe216205e39e07fcb1aab5abad9e20308714ff67aed60e101fbbeae5a772f2453b6fc52e1a389f62817c6ccb965e76027eebe79eb5742c2a205b1aafac7b10a876eebc12f0e2254a9bd6c5acf78c97738249b5c01acfe533c825400cf57099ad94b2ab5f56caff6d7643612ead2273dd2038d08877224034843156ccd4b136f42cd475585f152720fee9dbe2bc448b1f9e38797754e9b6e10620164765de608f556f5094515ca6313ad474173e48278d2aa420d2152bddff1f6065918e29032532c5d8dca289f03cff830ffddc2652d5d7de6fcd4759bb671b4a257dbc27341bda71e42fe1890651bc0c3b89f376d73be27c6207f0ceb46ac1cf0768c172da3482dbb2aacbd1162abb3a498b1939873c55a38fb044fe324f7dcf51c074878d9f765b0f8179dd8e82073c2a9af6d827e1ef75211284018be7a14ee0b70b122e70ba85567028e8f98669cc5fef08ba3d410ea5e24a63fb89942ce31f109d045c2dba06bca9c12b6467d35575233b72f82453c55995a0cbb04dbb60ea2f220545e3de7b549699e5549321ab4a7cc6d0d53af349a2fb8e10499864457f7ecc5f735b648a224582ca7f2cce4bd69e3c3b0b74c2fa5317e7a6714fa4069bf5a8e72ca14559a5f45d6a2441abdbd877e6c88012b2241f4a42634e80d61308e4ec614c38858fca1d6f72cbdccbaa3e28ffdf0c518ca5b1a9143aac2af6be987144425fb08300ec93b5d0dee720af28b95e329f9319f07626b2b0950b6b72d1c2c829c06a5306b43103a4c31bd71b8bda511077f0d14c54da620a1bef11d7809a038127fdb2bf09e2cd44088d7109ce825634ea67483a6d24c73547f46d8bc7bd9ab306fb7270bbc5d87be84b4ee28eccbecd44e332a96e5b8fcf4b7413ce3b1ca63dc8338428e363ce402e31ba282c707da817c4cfb61a1a1ab61f84fe3c5ae6e7d7894c19bf6c93eda35ad57f39f266fb63d305952a4a3d0567fe37421e48dc1ec5d890377e59b9e2e713e793152549282cc45cea25e22d26ad9eb882f298ad292dccbce7377c6e5f79844d7aa205b5397770ea710f071ef71653d20cd1f19407506e61c0dd4a02f5ba7bd70f6ad5c6c97bcf7a54b3d301bf93dffe578640b6d25157d268f2cd28a0b2ed848e7b60adf91b0fa838c2c40b8abf0bee560c9937f1953c5272b57c3663686bd7eb5d517410eabd0a7a14b6faa171aeda5c8872900520696d42fad538f5ed60032eb706e0f721ff5caef22100c41acb661aa0b2f3543c5ccb3e423ad8290e5152a04e5921f4ce1fb7a8b53b77754a37df809aef2782ac18d25a26263303043c79514e2b53a1252887f1fbf9d08f674787b88e4a8f7b57818d0c41c40b6879dfd18cc731844f06fa2c5581040a759324cf487d34475e6e1092d84ecc7c127b40b053cd7f5f8dfe58c0069a330a7e9901f892ea10c204bcc2e564934489e97643122de3702dcf02d5216c13f521a9670a2fdd9b608eade62d14d40aa8307be3d57bca2ffe277f62741a06783d1f9bff43c3a797505d0f4553852802e0337e568bc78884258906fdf6b908246e80710f93529673de95c6609b401b56a87cdb8058df798531c0c2a4c3836dc91197e99ae8cb75f079cf1ab78c4263633324a587369271967b0413dc3d2e07832c9ce244fd732a30e86ca31cbbc276b297f8cb8dd7a8d95f2d355c7d13510cb74afd784af8a9f5190bc616a8209af8adc1d24c77b2966a375b094cb03ac4266aad43daa3ede39fc7d3d7b2173a8e4548f4d24a93d4eef764fdb1ff6632e048e258d73231f04efcbeb45737074a627f632e10bdd97e712285511c35d7b2680faec049f1d7ad852076bf8ef397a30c9fb5cdd808bd5e9d3502e488bb7233074ab637ceee0a9c587e62dd27554c1f6b4182e69c89204cbe65ad4c99c4802fc4843f21d749c23898a98a282ce9756fb7964237644aece692bd6c4a981185eaeff3ee686800ab7eb065ba3c14122a772c762af1c25ad71f7736d6ae72ea1a5fb505276ecde3b1658caf0ace7ca9502ebfe383c99ff54e1cd8c07bb4f947602725e72dbd396a7a5834314bff2265b5da664be1f040dad84e27510c09f2e80604cf9d29ae85fd07ddcd372d3abf35a98b79165142d6522bf69e31f8e9d895d1cee33370c07a2c72636589d69c805e08388d067f256beb7eab419d2812558c5f9f4c6e7943bd880551270f7d14cc63b754beb9d3ba38b3c1a93a5c61fb0e95edb4089da3b0337b3d8c971a795a32f6cc050b4607324a4a2ecaf025edb26b15ae0c25f5848d55359b18dfa8867f514697659457d8b90b4d8ce4567c19b7f72fbe96cbcb8b73d0db551cc43e1deaf88e3eaacefa9c2ed44be62748d063e1ab7696347da4b34a8dc19e9ab70e9733adb83daf87c7e55aed147f88fe10c493d56a901926e452143aaf8890b35c9f117b69d2a0328c8faa88b9c349d1b9731cc1c72939482f6d79e9dbc3a3c427dadb14ba64586832c05e540d23aa4f53b2214e8b72d78"}}, &(0x7f0000002800)) timer_create(0x2, &(0x7f0000000300)={0x0, 0x1b, 0x4, @thr={0x0, &(0x7f00000000c0)}}, &(0x7f0000000340)=0x0) timer_getoverrun(r2) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) getsockname$packet(r4, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000680)=0x14) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={'syz', 0x2}, &(0x7f0000000740)="8706e3aff74bff34519d03577bd7fbe1c4ef791c6a70af828d22afdd1f39d8d81f4384fc0ece1f6fb67535c093eb476b6cf07b64d078748c35f4bace00c572522baf07", 0x43, 0xfffffffffffffffc) 05:22:44 executing program 1: r0 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0xa, 0x0, 0x0) 05:22:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:44 executing program 1: r0 = socket(0x10, 0x2, 0x0) sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ppp\x00', 0x0, 0x0) r3 = dup2(r2, r2) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x250}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x6c00, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_LINKINFO={0x18, 0x12, @ppp={{0x8, 0x1, 'ppp\x00'}, {0xc, 0x2, {0x8, 0x1, r3}}}}]}, 0x38}}, 0x0) 05:22:44 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) [ 691.454931][ T26] audit: type=1804 audit(1574140964.725:309): pid=21031 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/384/file0/file0" dev="loop4" ino=502 res=1 [ 691.594138][ T26] audit: type=1800 audit(1574140964.755:310): pid=21031 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=502 res=0 [ 691.668940][ T26] audit: type=1804 audit(1574140964.755:311): pid=21035 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/384/file0/file0" dev="loop4" ino=502 res=1 05:22:45 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x0, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000000)={0x0, 0x2, [@local, @random="1484883fd015"]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 05:22:45 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100010, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) r3 = open(0x0, 0x8001141042, 0x0) write(r3, &(0x7f0000000000)="b6", 0xfffffe7e) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f00000001c0)={0x100004}, 0xfd57) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000016c0)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@broadcast}}, &(0x7f0000000100)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0xe8) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000400)={r5, 0xffff, 0x1, 0x3, 0x2, 0x3f, 0x9}) pipe(0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r6, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:45 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x2, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:45 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) r2 = dup3(r0, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6(0xa, 0x100800000000002, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/fib_trie\x00') sendfile(r3, r4, 0x0, 0x88004) 05:22:45 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:45 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x0, 0x0) open(&(0x7f0000000280)='./file0\x00', 0x12000, 0x1b) r0 = perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nbd(0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 05:22:45 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) 05:22:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) r3 = socket$xdp(0x2c, 0x3, 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f00000001c0)={0x100004}, 0xfd57) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000016c0)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@broadcast}}, &(0x7f0000000100)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0xe8) sendmsg$xdp(r3, &(0x7f0000000780)={&(0x7f0000000680)={0x2c, 0x2, r5, 0x31}, 0x10, &(0x7f0000000740)=[{&(0x7f00000006c0)="6746e3cf0f11a52f40193f9268b9eb15aa0ff67dd5aa82a42ba4be3469bb4070f78f00d4836c30bb6fd6be6a846f4ef693737bfc3538d8547a5ae12353773a85b3927d7302d2725addcdcea74a5211166779e4644bf37f2a10f1fa5d3893961c", 0x60}], 0x1, 0x0, 0x0, 0x40000}, 0x0) pipe(0x0) r6 = creat(&(0x7f0000000400)='./file0\x00', 0x2) sendmmsg$nfc_llcp(r6, &(0x7f0000000680), 0x0, 0x2000) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r7, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100011, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:46 executing program 1: 05:22:46 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x3, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:46 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) 05:22:46 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:46 executing program 1: 05:22:47 executing program 1: 05:22:47 executing program 1: [ 694.214684][ T26] kauditd_printk_skb: 9 callbacks suppressed [ 694.214743][ T26] audit: type=1804 audit(1574140967.485:321): pid=21159 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/386/file0/file0" dev="loop4" ino=506 res=1 [ 694.384143][ T26] audit: type=1800 audit(1574140967.495:322): pid=21159 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=506 res=0 05:22:47 executing program 1: [ 694.446070][ T26] audit: type=1804 audit(1574140967.555:323): pid=21185 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/386/file0/file0" dev="loop4" ino=506 res=1 05:22:47 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:47 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100012, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 694.602708][ T26] audit: type=1804 audit(1574140967.865:324): pid=21194 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/370/file0/file0" dev="loop0" ino=508 res=1 [ 694.647534][T21195] FAT-fs (loop0): error, fat_free_clusters: deleting FAT entry beyond EOF [ 694.656152][T21195] FAT-fs (loop0): Filesystem has been set read-only [ 694.663543][ T26] audit: type=1800 audit(1574140967.865:325): pid=21194 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=508 res=0 [ 694.685618][ T26] audit: type=1804 audit(1574140967.865:326): pid=21195 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/370/file0/file0" dev="loop0" ino=508 res=1 [ 695.067020][ T26] audit: type=1804 audit(1574140968.335:327): pid=21207 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/387/file0/file0" dev="loop4" ino=510 res=1 [ 695.095922][ T26] audit: type=1804 audit(1574140968.335:328): pid=21213 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/387/file0/file0" dev="loop4" ino=510 res=1 05:22:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x15, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000740)=ANY=[@ANYBLOB="656e633d6f68657020686173683d6362636d616328626c6f7766697368290000000000f80e0000000000000000000000000000000000000000000000000000000000000000000000000000000000bf58c4b584c2abf4bb56e92fe943e01b194bb9fe20b69d69f5d8e5cf06fa1651d8274c1694ddca13142b5d2fe64cfd4312708cefd672650c982ad7d3e995"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0xffffffffffffffff, 0x4000) ioctl$KVM_GET_EMULATED_CPUID(r3, 0xc008ae09, &(0x7f0000000680)=""/175) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:49 executing program 1: 05:22:49 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100013, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:49 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x4, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:49 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:49 executing program 1: [ 696.122609][T21231] FAT-fs (loop5): bogus number of reserved sectors [ 696.185169][T21231] FAT-fs (loop5): Can't find a valid FAT filesystem 05:22:49 executing program 1: 05:22:49 executing program 1: 05:22:50 executing program 1: 05:22:50 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 696.913953][ T26] audit: type=1804 audit(1574140970.185:329): pid=21256 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/388/file0/file0" dev="sda1" ino=16873 res=1 05:22:50 executing program 1: [ 697.037271][ T26] audit: type=1804 audit(1574140970.205:330): pid=21245 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/371/file0/file0" dev="sda1" ino=16871 res=1 05:22:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={r1, r0, 0x0, 0x10, &(0x7f0000000240)='md5sum&,md5sum/\x00'}, 0x30) getpgid(r2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r3+30000000}, &(0x7f00000001c0)) r4 = request_key(&(0x7f0000000400)='syzkaller\x00', &(0x7f0000000680)={'syz', 0x0}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r4, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r6, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:52 executing program 1: 05:22:52 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100014, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:52 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x5, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:52 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 699.410589][T21288] FAT-fs (loop5): bogus number of reserved sectors 05:22:52 executing program 1: [ 699.488649][T21288] FAT-fs (loop5): Can't find a valid FAT filesystem 05:22:52 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:53 executing program 1: 05:22:53 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:53 executing program 1: 05:22:53 executing program 1: [ 700.169247][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 700.169269][ T26] audit: type=1804 audit(1574140973.445:335): pid=21320 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/372/file0/file0" dev="sda1" ino=16945 res=1 [ 700.245955][ T26] audit: type=1800 audit(1574140973.445:336): pid=21320 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16945 res=0 [ 700.285868][ T26] audit: type=1804 audit(1574140973.445:337): pid=21323 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/372/file0/file0" dev="sda1" ino=16945 res=1 [ 700.389519][ T26] audit: type=1804 audit(1574140973.485:338): pid=21303 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/389/file0/file0" dev="sda1" ino=16977 res=1 05:22:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) ioctl(r3, 0x3, &(0x7f0000000680)="1ef17ed01828078e07612543f6b33ae66fa33feef3b3f0cc61f92304271b07220bc0d9bd0c0696026264f999bf9bdd089b5f5089a8aad32901caebae12b6b515e7e6afb98f543f450d8ce85c0043991f36474d99476f3d68505850fd97d417aa276f3a4325b090f57b6deb133602a2f76314557388715a058b18f2b96bf35d73a27005289f6b1a584752a4a33991075b7d9f9dd0532e339663d1826c426647b5e75809e01fe008f4edd8ab7be6235fdc19b79e1c760ddf1b0d9e03afe29986ada7c4e402bfb6e62ed81b97e9ddcd42e1873f64aba97ac622c1a4f7459cd85fd6fcb092cd3913a19697a3198a467fcce14c0e9b98") 05:22:53 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:53 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 700.427794][ T26] audit: type=1800 audit(1574140973.485:339): pid=21303 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16977 res=0 [ 700.471473][ T26] audit: type=1804 audit(1574140973.485:340): pid=21322 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/389/file0/file0" dev="sda1" ino=16977 res=1 05:22:53 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100015, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:53 executing program 1: 05:22:53 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x6, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:53 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 700.533629][T21341] FAT-fs (loop5): bogus number of reserved sectors [ 700.552946][T21341] FAT-fs (loop5): Can't find a valid FAT filesystem 05:22:53 executing program 1: 05:22:54 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:54 executing program 1: 05:22:54 executing program 1: 05:22:54 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 701.528723][T21381] fuse: Bad value for 'fd' 05:22:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r3, &(0x7f0000008880), 0x62a, 0x0, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000400)={0x0, 0x0}) sched_setattr(r4, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x4}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:54 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:54 executing program 1: [ 701.683731][ T26] audit: type=1804 audit(1574140974.955:341): pid=21382 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/373/file0/file0" dev="loop0" ino=512 res=1 [ 701.792786][T21383] FAT-fs (loop0): error, fat_free_clusters: deleting FAT entry beyond EOF [ 701.811695][T21383] FAT-fs (loop0): Filesystem has been set read-only [ 701.822587][ T26] audit: type=1800 audit(1574140975.015:342): pid=21382 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=512 res=0 [ 701.875077][ T26] audit: type=1804 audit(1574140975.015:343): pid=21383 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/373/file0/file0" dev="loop0" ino=512 res=1 [ 701.896489][T21404] FAT-fs (loop5): bogus number of reserved sectors [ 701.908345][T21404] FAT-fs (loop5): Can't find a valid FAT filesystem [ 701.914656][ T26] audit: type=1804 audit(1574140975.085:344): pid=21392 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/390/file0/file0" dev="loop4" ino=514 res=1 05:22:55 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100016, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:55 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:55 executing program 1: 05:22:55 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x7, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 702.158210][T21414] fuse: Bad value for 'fd' 05:22:55 executing program 1: 05:22:55 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:55 executing program 1: [ 702.580739][T21431] fuse: Bad value for 'fd' 05:22:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f00000007c0)=ANY=[@ANYBLOB="656e633d6f61657020680000050000000000616328626c6f7766697368290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a35d8640df8753de4a00000000cf670c928b1ddb9f019115861391bbfc4aebf52f837abe6f295a99c8493b2fe5fc91469156b69eb7fbb3bf50a4f5d8bd26eff3d706c4e979d7e98903f63096ae23ac0afe221dde3384df98bc0e26a55df8265c4ab75462ab997c1cd36fb281696523ee81"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = syz_open_dev$cec(&(0x7f0000000400)='/dev/cec#\x00', 0x2, 0x2) ioctl$EVIOCGPHYS(r3, 0x80404507, &(0x7f0000000680)=""/241) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) syz_open_dev$binderN(&(0x7f0000000780)='/dev/binder#\x00', 0x0, 0x2) 05:22:56 executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:56 executing program 1: 05:22:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:56 executing program 1: [ 703.123009][T21458] FAT-fs (loop5): bogus number of reserved sectors [ 703.165225][T21458] FAT-fs (loop5): Can't find a valid FAT filesystem 05:22:56 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100017, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:56 executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000700)='/dev/ion\x00', 0x151100, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) r2 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xffffffffffff4a3a) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f00000006c0)={0x8, 0xfffffffffffffffa, 0x80000000000, 0xb3cb, 0x1a8, 0x9c7}) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)=ANY=[@ANYBLOB='enc=oaep hBsh=cbcmac(blowfish)\x00'/78], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = open(0x0, 0x8001141042, 0x0) write(r4, &(0x7f0000000000)="b6", 0xfffffe7e) fsconfig$FSCONFIG_SET_PATH_EMPTY(r4, 0x4, &(0x7f0000000400)='/dev/ptmx\x00', &(0x7f0000000680)='./file0\x00', 0xffffffffffffffff) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:56 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x8, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:56 executing program 1: 05:22:56 executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:56 executing program 1: 05:22:56 executing program 3: mkdir(0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:57 executing program 1: 05:22:57 executing program 3: mkdir(0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:57 executing program 3: mkdir(0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 704.336282][T21511] FAT-fs (loop5): bogus number of reserved sectors [ 704.365599][T21511] FAT-fs (loop5): Can't find a valid FAT filesystem 05:22:58 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100018, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:58 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:58 executing program 1: 05:22:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r3 = open(0x0, 0x8001141042, 0x0) write(r3, &(0x7f0000000000)="b6", 0xfffffe7e) ioctl$IOC_PR_CLEAR(r3, 0x401070cd, &(0x7f0000000000)={0x1}) read(r2, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:58 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x9, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:58 executing program 1: [ 704.931990][T21534] fuse: Bad value for 'fd' 05:22:58 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 705.135377][T21545] fuse: Bad value for 'fd' 05:22:58 executing program 1: 05:22:58 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:58 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000240), 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:58 executing program 1: 05:22:58 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000400)=0xfb87) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 705.441018][T21559] fuse: Bad value for 'fd' [ 705.712443][ T26] kauditd_printk_skb: 10 callbacks suppressed [ 705.712464][ T26] audit: type=1804 audit(1574140978.985:355): pid=21552 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/376/file0/file0" dev="sda1" ino=16892 res=1 [ 705.739838][T21571] FAT-fs (loop5): bogus number of reserved sectors [ 705.797134][T21571] FAT-fs (loop5): Can't find a valid FAT filesystem [ 705.933931][ T26] audit: type=1804 audit(1574140979.205:356): pid=21556 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/393/file0/file0" dev="loop4" ino=518 res=1 05:22:59 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:59 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100019, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:59 executing program 1: 05:22:59 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xa, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:22:59 executing program 1: 05:22:59 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:59 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xc, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xa, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:22:59 executing program 1: 05:22:59 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:22:59 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000240), 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:00 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x200000000002, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="2e000000110081aee405d10200600e00fa076b000800000000f3ff500befccd77f00000000081c5eda00b0eba06a", 0x2e}], 0x1}, 0x0) 05:23:00 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 706.846596][T21615] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.1'. [ 706.861410][T21616] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.1'. 05:23:00 executing program 1: socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='clear_refs\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000180)='stat\x00') sendfile(r1, r2, 0x0, 0x1) dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) write$P9_RMKNOD(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) read(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) dup(0xffffffffffffffff) [ 706.985016][ T26] audit: type=1804 audit(1574140980.255:357): pid=21590 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/377/file0" dev="sda1" ino=16892 res=1 [ 707.097419][T21621] FAT-fs (loop5): bogus number of reserved sectors [ 707.125135][ T26] audit: type=1804 audit(1574140980.255:358): pid=21591 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/377/file0" dev="sda1" ino=16892 res=1 [ 707.161985][T21621] FAT-fs (loop5): Can't find a valid FAT filesystem [ 707.269205][ T26] audit: type=1800 audit(1574140980.285:359): pid=21590 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16892 res=0 [ 707.420088][ T26] audit: type=1804 audit(1574140980.695:360): pid=21637 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/394/file0/file0" dev="sda1" ino=16522 res=1 05:23:00 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10001a, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:00 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:00 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xc, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:00 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) ioctl$RTC_PIE_ON(r2, 0x7005) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f7766697368290000000000000000000000000000000000000000000000802708c50000000000843fa409e140c030d9717e26841d6b0800"/98], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) r5 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r5, &(0x7f0000008880), 0x62a, 0x0, 0x0) ftruncate(r5, 0xffffffffe76c84df) 05:23:01 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:01 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xe, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:01 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000240), 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:01 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) pipe2$9p(&(0x7f0000000040), 0x4800) ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000000)={0x2, 0x2, [@local, @random="1484883fd015"]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 05:23:01 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, 0x0) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 708.033036][T21677] FAT-fs (loop5): bogus number of reserved sectors [ 708.071044][T21677] FAT-fs (loop5): Can't find a valid FAT filesystem [ 708.319986][T21689] picdev_read: 55 callbacks suppressed [ 708.319992][T21689] kvm: pic: non byte read [ 708.373263][T21689] picdev_write: 57 callbacks suppressed [ 708.373278][T21689] kvm: pic: non byte write [ 708.394912][T21689] kvm: pic: non byte read [ 708.409114][T21689] kvm: pic: non byte write 05:23:01 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, 0x0) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 708.426793][T21689] kvm: pic: non byte read [ 708.439928][T21689] kvm: pic: non byte write [ 708.461854][T21689] kvm: pic: non byte read [ 708.478983][T21689] kvm: pic: non byte write [ 708.504005][T21689] kvm: pic: non byte read [ 708.522205][T21689] kvm: pic: non byte write [ 708.548754][T21689] kvm: pic: non byte read [ 708.572188][T21689] kvm: pic: non byte write [ 708.586919][T21689] kvm: pic: non byte read [ 708.633685][T21689] kvm: pic: non byte write [ 708.653100][T21689] kvm: pic: non byte read [ 708.671387][ T26] audit: type=1804 audit(1574140981.935:361): pid=21699 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/395/file0/file0" dev="sda1" ino=16921 res=1 [ 708.673864][T21689] kvm: pic: non byte write 05:23:02 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, 0x0) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 708.794177][T21689] kvm: pic: non byte read 05:23:02 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = fcntl$getown(0xffffffffffffffff, 0x9) r2 = gettid() rt_tgsigqueueinfo(r1, r2, 0x19, &(0x7f0000000680)={0x32, 0x3, 0x7}) r3 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r3, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 708.819912][ T26] audit: type=1800 audit(1574140981.945:362): pid=21699 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16921 res=0 [ 708.839915][T21689] kvm: pic: non byte write [ 708.845101][T21689] kvm: pic: non byte read [ 708.855552][T21689] kvm: pic: non byte write [ 708.912502][ T26] audit: type=1804 audit(1574140981.945:363): pid=21703 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/395/file0/file0" dev="sda1" ino=16921 res=1 05:23:02 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10001b, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:02 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x10, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:02 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 709.000056][T21689] kvm: pic: single mode not supported [ 709.000062][T21689] kvm: pic: level sensitive irq not supported [ 709.012255][ T26] audit: type=1804 audit(1574140982.105:364): pid=21681 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/379/file0/file0" dev="loop0" ino=520 res=1 05:23:02 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) pipe2$9p(&(0x7f0000000040), 0x4800) ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000000)={0x2, 0x2, [@local, @random="1484883fd015"]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) [ 709.183098][T21727] fuse: Bad value for 'group_id' [ 709.254430][T21735] FAT-fs (loop5): bogus number of reserved sectors [ 709.267049][T21735] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:02 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:02 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x2000) read(r3, &(0x7f0000000680)=""/43, 0x100000053) [ 709.630489][T21754] fuse: Bad value for 'group_id' 05:23:03 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 709.820223][T21732] kvm: pic: single mode not supported [ 709.820236][T21732] kvm: pic: level sensitive irq not supported [ 710.008716][T21763] fuse: Bad value for 'group_id' 05:23:03 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:03 executing program 1: bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x6609, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$kcm(0xa, 0x0, 0x73) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000440)='lo\x00\x96o\xd6Q\xb9Y\xa9dJ,\x00\xd2\x97\x04\x03\xdc\r') ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, 0x0) 05:23:03 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:03 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:03 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:03 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x11, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:03 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 710.391445][T21790] FAT-fs (loop5): bogus number of reserved sectors [ 710.401905][T21790] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:03 executing program 1: socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1dc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={&(0x7f00000000c0), 0xa}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'nr0\x01\x00', 0x1132}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000780)='/dev/net/tun\x00', 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000780)='/dev/net/tun\x00', 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0x28, &(0x7f0000000600)}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000680)={0x0, 0x0, 0xc}, 0xc) socket$kcm(0xa, 0x3, 0x11) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x7, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'nr0\x01\x00', 0x1132}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000780)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'nr0\x01\x00', 0x1132}) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{}, {0x6}]}) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000700)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{}]}) openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz0\x00', 0x200002, 0x0) 05:23:03 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f0000000380)={0x0, 0x29, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f7766697368290000000000000000000000000000000000000000000000000000000000fd57f2afb5a500"/84], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:04 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:04 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r3 = socket(0x10, 0x5, 0x20) r4 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x1bb) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000040)={r5}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000400)={r5, 0x54}, &(0x7f0000000680)=0x8) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r6, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:04 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x10, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:04 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 711.315403][ T26] kauditd_printk_skb: 5 callbacks suppressed [ 711.315424][ T26] audit: type=1804 audit(1574140984.585:370): pid=21834 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/397/file0/file0" dev="sda1" ino=16657 res=1 05:23:04 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 711.429012][ T26] audit: type=1800 audit(1574140984.625:371): pid=21834 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16657 res=0 [ 711.539332][ T26] audit: type=1804 audit(1574140984.625:372): pid=21835 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/397/file0/file0" dev="sda1" ino=16657 res=1 05:23:04 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100030, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 711.623862][ T26] audit: type=1804 audit(1574140984.765:373): pid=21808 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/381/file0/file0" dev="sda1" ino=16882 res=1 05:23:04 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB, @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 711.653885][ T26] audit: type=1804 audit(1574140984.765:375): pid=21846 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/381/file0/file0" dev="sda1" ino=16882 res=1 [ 711.765550][T21856] FAT-fs (loop5): bogus number of reserved sectors 05:23:05 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x20c, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 711.836381][T21856] FAT-fs (loop5): Can't find a valid FAT filesystem [ 711.874266][ T26] audit: type=1800 audit(1574140984.765:374): pid=21808 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16882 res=0 05:23:05 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x37, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f776e697368290000000000000000000000fffffffffffffff4000000000000000000bb00"/79], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000380)='/dev/vcsa#\x00', 0x6b8, 0x400) r4 = open(0x0, 0x8001141042, 0x0) socketpair(0x10, 0x6, 0x8, &(0x7f0000002f40)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$rose(r5, 0x104, 0x2, &(0x7f0000002f80), &(0x7f0000002fc0)=0x4) write(r4, &(0x7f0000000000)="b6", 0xfffffe7e) ioctl$TUNDETACHFILTER(r4, 0x401054d6, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r3, 0xc06855c8, &(0x7f0000000700)={0x4, 0x8, {0x53, 0x7ff, 0x5, {0x3, 0x4}, {0x103}, @ramp={0xff, 0xb7, {0xaa7e, 0x8001, 0x7, 0x4}}}, {0x56, 0xe0, 0x2, {0xd3a0, 0x9}, {0x6, 0xd599}, @period={0x5c, 0x2, 0x3ff, 0x6, 0x1, {0x0, 0x400, 0xfff7, 0x100}, 0xa, &(0x7f00000003c0)=[0x5, 0x1000, 0x3, 0x8001, 0x100, 0x3, 0x1, 0x8001, 0xea, 0x7]}}}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r6, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) getsockopt$inet_dccp_buf(r6, 0x21, 0xe, &(0x7f0000000780)=""/111, &(0x7f0000000400)=0x6f) pipe(0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r7, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 712.394865][T21882] fuse: Unknown parameter 'grou00000000000000000000' 05:23:05 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000400)='/dev/qat_adf_ctl\x00', 0x20000, 0x0) ioctl$CAPI_GET_SERIAL(r3, 0xc0044308, &(0x7f0000000680)=0x7ff) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:05 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x9, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 712.639925][T21888] fuse: Unknown parameter 'grou00000000000000000000' 05:23:05 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 712.707516][ T26] audit: type=1804 audit(1574140985.985:376): pid=21889 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/398/file0/file0" dev="loop4" ino=526 res=1 05:23:06 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 712.814171][T21896] QAT: Invalid ioctl [ 712.823627][ T26] audit: type=1800 audit(1574140985.985:377): pid=21889 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=526 res=0 [ 712.863822][ T26] audit: type=1804 audit(1574140985.985:378): pid=21892 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/398/file0/file0" dev="loop4" ino=526 res=1 [ 712.907150][ T26] audit: type=1804 audit(1574140986.095:379): pid=21874 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/382/file0/file0" dev="loop0" ino=528 res=1 [ 712.952368][T21909] QAT: Invalid ioctl [ 712.967679][T21905] FAT-fs (loop5): bogus number of reserved sectors [ 712.983975][T21905] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:06 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfd}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f776669736829000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e9f7a4089f83ae21f10f1b1c9a2f2991686f2e1d4faa92ff9cb8d59a86a8ea8191f46bb5e0f72a41b1ecb62bd1de9cd170409639917c02996ddc4e78f9aa280dd47b84ceac7fda9bedf115f95a64d04714351e847d9b2d6be0b62ead9f5492a48a6267aea676b9d20fdf75afc8bb4020846de1de41def7e2f80f5b82c0b5b0683e7f99164c19626e260cd86b2a1a762d7c2693dcbfb2eec82f7d847dd226ed4b920e5654bca753897d9b1bc4f260dbf2f923d7e587491de5cd07fafc8cc486335648842f9de3c12969419aedab4a164f48"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) r3 = socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vga_arbiter\x00', 0x2, 0x0) ioctl$GIO_FONTX(r5, 0x4b6b, &(0x7f00000007c0)=""/4096) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000003c0)) fcntl$getown(r0, 0x9) r6 = getpid() sched_setscheduler(r6, 0x5, &(0x7f0000000380)) syz_open_procfs$namespace(r6, &(0x7f0000001940)='ns\x05ipc\x00\x86E\b4Cm\xaf\xa2\xab\xb9\xa4\xbe?1\xb7a\xc0U\xe8&\x8e%\xd0\xe9[6\xef\xd5Hk\x02a\xe6%(\xb2\xb7\x12\x827\x92\xff\x91\xc4>Y\x83\xc6l\xae\xac\xa4\x05@\x15k\x9f\x13\x14\xb4\xfa\x17\x9c\xdb1G\x91N\'\rY\xed(\xf2\xf0\'\x1da\x199\xa0=*@\x9cy8Rd\xc1\xf6\xda\xdc,\x82\xfd\x13D\x81\xde\xbd\x91\xa3\xb04yO\x88\xff \xe0\x8e^WRl\xb0\x12\xcfA\x18\xdeNN\x9b1\x9c\xf5H`\xdc\xbd^5\xd7\xa2\x15\x94\x92N\x92\xde\xfa@\xa2\x80\xc9\xf9\xde\xb1\xcb\xb81\x92t!\x00\x10\xaf\xf6\xb3\x9b\xbb\xefd\x02\xe1') r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r7, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:06 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100050, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:06 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x300, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 713.090549][T21919] fuse: Unknown parameter 'grou00000000000000000000' 05:23:06 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 713.504847][T21943] fuse: Unknown parameter 'group_i00000000000000000000' 05:23:06 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:07 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 713.797948][T21948] fuse: Unknown parameter 'group_i00000000000000000000' 05:23:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000700)='/dev/ion\x00', 0x151100, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) r2 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0xffffffffffff4a3a) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f00000006c0)={0x8, 0xfffffffffffffffa, 0x80000000000, 0xb3cb, 0x1a8, 0x9c7}) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)=ANY=[@ANYBLOB='enc=oaep hBsh=cbcmac(blowfish)\x00'/78], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = open(0x0, 0x8001141042, 0x0) write(r4, &(0x7f0000000000)="b6", 0xfffffe7e) fsconfig$FSCONFIG_SET_PATH_EMPTY(r4, 0x4, &(0x7f0000000400)='/dev/ptmx\x00', &(0x7f0000000680)='./file0\x00', 0xffffffffffffffff) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:07 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 714.039476][T21955] FAT-fs (loop5): bogus number of reserved sectors [ 714.095940][T21961] fuse: Unknown parameter 'group_i00000000000000000000' 05:23:07 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x500, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:07 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0xfffffffffffffe43, 0x0, 0x3, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f776669736829000000000000000092e3b9038f3a5da10000000000e1ff0000000000000000200000000000000000006f000000000000"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:07 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 714.173483][T21955] FAT-fs (loop5): Can't find a valid FAT filesystem [ 714.344189][T21976] fuse: Unknown parameter 'group_id00000000000000000000' 05:23:07 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100060, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:07 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 714.741640][T21997] fuse: Unknown parameter 'group_id00000000000000000000' 05:23:08 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:08 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:08 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x600, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 714.931715][T22005] fuse: Unknown parameter 'group_id00000000000000000000' 05:23:08 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 715.055733][T22009] FAT-fs (loop5): bogus number of reserved sectors [ 715.093801][T22009] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:08 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000740)={0x0, 0x0}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000780)='/dev/hwrng\x00', 0x0, 0x0) perf_event_open(&(0x7f00000006c0)={0x3, 0x70, 0x1f, 0x0, 0xff, 0x3, 0x0, 0x64, 0x10002, 0x6, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x2, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6bd, 0x5, @perf_bp={&(0x7f0000000680), 0x4}, 0x1000, 0x100000000, 0x6, 0x2, 0x83c, 0x3f, 0x8}, r3, 0x6, r4, 0xb) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) prctl$PR_MCE_KILL_GET(0x22) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) setsockopt$netrom_NETROM_T4(0xffffffffffffffff, 0x103, 0x6, &(0x7f0000000400)=0x1, 0x4) read(r6, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:08 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x300, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 715.289252][T22022] fuse: Bad value for 'user_id' 05:23:08 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 715.674740][T22045] fuse: Bad value for 'user_id' 05:23:09 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:09 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100070, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 715.880541][T22048] fuse: Bad value for 'user_id' 05:23:09 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 716.023178][T22053] fuse: Bad value for 'fd' 05:23:09 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 716.164688][T22061] FAT-fs (loop5): bogus number of reserved sectors 05:23:09 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100060, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 716.230680][T22061] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:09 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x700, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 716.349884][T22070] fuse: Bad value for 'fd' 05:23:09 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x400}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000007c0), 0x10) fcntl$setpipe(r1, 0x407, 0x0) write(r1, &(0x7f0000000340), 0x41395527) bind$alg(r1, &(0x7f0000000680)={0x26, 'aead\x00', 0x0, 0x0, 'ccm-aes-ce\x00'}, 0x58) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r2+30000000}, &(0x7f00000001c0)) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000400)=""/5, 0x5, 0x100, &(0x7f0000000700)={0x2, 0x4e20, @multicast2}, 0x10) r3 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r3, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r5 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000740)='/dev/video35\x00', 0x2, 0x0) ioctl$int_in(r5, 0xfc63, &(0x7f0000000780)=0x8) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r6, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x6d) 05:23:09 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 716.762996][T22092] fuse: Bad value for 'fd' 05:23:10 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 716.947323][ T26] kauditd_printk_skb: 11 callbacks suppressed [ 716.947370][ T26] audit: type=1804 audit(1574140990.215:391): pid=22094 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/401/file0/file0" dev="loop4" ino=538 res=1 [ 717.029929][ T26] audit: type=1800 audit(1574140990.215:392): pid=22094 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=538 res=0 [ 717.081582][T22102] fuse: Bad value for 'fd' [ 717.115764][ T26] audit: type=1804 audit(1574140990.215:393): pid=22095 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/401/file0/file0" dev="loop4" ino=538 res=1 05:23:10 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100090, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:10 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 717.371370][T22107] FAT-fs (loop5): bogus number of reserved sectors [ 717.400984][T22114] fuse: Bad value for 'fd' [ 717.444003][T22107] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:10 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 717.536911][ T26] audit: type=1804 audit(1574140990.805:394): pid=22086 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/386/file0/file0" dev="loop0" ino=540 res=1 05:23:10 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x600, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:10 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000400), 0xfc6f0b3bddaed3c9}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 717.701576][T22128] fuse: Bad value for 'fd' 05:23:11 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x900, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:11 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 718.045570][T22150] fuse: Invalid rootmode 05:23:11 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) r2 = open(0x0, 0x8001141042, 0x0) write(r2, &(0x7f0000000000)="b6", 0xfffffe7e) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000680)={0x0, 0x7, 0x0, 0x8, 0x7ff, 0x6, 0x1, 0x800, {0x0, @in6={{0xa, 0x4e20, 0x9, @local, 0x20}}, 0x5, 0x0, 0x1, 0x81, 0xfffff000}}, &(0x7f0000000400)=0xb0) setsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000740)={r3}, 0x8) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:11 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 718.307325][ T26] audit: type=1804 audit(1574140991.585:395): pid=22156 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/402/file0/file0" dev="loop4" ino=542 res=1 [ 718.311825][T22166] fuse: Invalid rootmode 05:23:11 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:11 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:11 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x1000a0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 718.552296][T22171] FAT-fs (loop5): bogus number of reserved sectors [ 718.572890][T22177] fuse: Invalid rootmode [ 718.597075][T22171] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:12 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:12 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x6, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 718.906699][T22193] fuse: Bad value for 'rootmode' [ 718.952898][ T26] audit: type=1804 audit(1574140992.225:396): pid=22144 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/387/file0/file0" dev="sda1" ino=16967 res=1 05:23:12 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x4f2c14fc7eb0399a) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) r2 = syz_open_dev$midi(&(0x7f0000000400)='/dev/midi#\x00', 0xfffffffffffeffff, 0x20000) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000740)={{0x2, 0x2, 0x67, 0x1ff, '\x00', 0x81}, 0x1, 0x20000000, 0x40, r3, 0x7, 0x1ff, 'syz1\x00', &(0x7f00000006c0)=['ppp0vmnet1\x00', '/cgroupwlan0,eth1\x00', '/dev/ptmx\x00', 'posix_acl_access\x00', '/dev/ptmx\x00', 'system\x00', 'user\x00'], 0x4e, [], [0x8, 0x0, 0x7, 0x53]}) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000680)) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)=ANY=[@ANYBLOB="656e633d6f920e0000000000003d6362636d616328626c6f77666973682900"/78], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 719.122875][T22201] fuse: Bad value for 'rootmode' 05:23:12 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xa00, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:12 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000004000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01", 0x11}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 719.448320][T22216] fuse: Bad value for 'rootmode' 05:23:12 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 719.601622][ T26] audit: type=1804 audit(1574140992.875:397): pid=22221 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/403/file0/file0" dev="sda1" ino=16933 res=1 [ 719.700942][ T26] audit: type=1800 audit(1574140992.875:398): pid=22221 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16933 res=0 [ 719.734748][T22231] fuse: Unknown parameter 'use00000000000000000000' 05:23:13 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 719.798866][ T26] audit: type=1804 audit(1574140992.905:399): pid=22223 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/403/file0/file0" dev="sda1" ino=16933 res=1 [ 719.856152][T22234] FAT-fs (loop5): invalid media value (0x00) 05:23:13 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x1000b0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 719.966859][T22234] FAT-fs (loop5): Can't find a valid FAT filesystem [ 720.019923][ T26] audit: type=1804 audit(1574140993.295:400): pid=22218 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/388/file0/file0" dev="loop0" ino=546 res=1 [ 720.039745][T22244] fuse: Unknown parameter 'use00000000000000000000' 05:23:13 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(0x0, 0x8001141042, 0x0) write(r0, &(0x7f0000000000)="b6", 0xfffffe7e) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f00000007c0)={0x4, 0x70, 0x11, 0x1, 0x8, 0x5, 0x0, 0x100000000, 0x441, 0x8, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x3, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000780), 0x4}, 0x80, 0x5d, 0x9, 0x1e435aad2f783dc2, 0x7, 0x101, 0x1}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0xf, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) r2 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000400)='/dev/video1\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r2, 0xc040564b, &(0x7f0000000680)={0x8000, 0x0, 0x101a, 0x2, 0x8000, {0x9, 0x7}}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r3 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r3, 0xc7, 0xfd}, &(0x7f0000000380)=ANY=[@ANYBLOB='enc=oaep hash=cbcmac(blowfish)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'/78], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/hwrng\x00', 0x8000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r5, 0xc0505405, &(0x7f0000000700)={{0xfffffffffffffffc, 0x3, 0x8000, 0x1, 0x7}, 0xffff, 0x3, 0x9170}) timer_settime(r4, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r6, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:13 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,use', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:13 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xc00, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 720.335690][T22258] fuse: Unknown parameter 'use00000000000000000000' 05:23:13 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x1000a0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:13 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) prctl$PR_SET_THP_DISABLE(0x29, 0x0) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000680)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f77666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000087d3418bd0ca6f918d43028f0cc02e40db5df6d10ab657a918aab1165e1fc7ce7f5a371f402286b6532ce7cf5a49baa8d722bc4f2fc97f7502d94fdb31734dd4cbe3a98f98c4c6197df85e8da1f58963addddc75d5b11bc4917fe07bef9f92e2fd03aefacc09c179c81d61aed323cd067ecfcd2ac932c9fc49cfbfa17588fab55786fa6e2ddfe17183dcb2ef0472a82db9984a585d9d1c1204dea8f34c803756c8c61e3e1909169735ab4e4c153701074b61bb10aab070ad0f2caeb60ff2e556932ed78d46efe67b7aa0c259"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) r2 = socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r2, 0x111, 0x2, 0x1, 0x4) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:13 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 720.695354][T22272] fuse: Unknown parameter 'user_i00000000000000000000' 05:23:14 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01", 0x11}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:14 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 720.971265][T22283] FAT-fs (loop5): invalid media value (0x00) [ 720.973693][T22279] fuse: Unknown parameter 'user_i00000000000000000000' [ 720.978021][T22283] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:14 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_i', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 721.244583][T22297] fuse: Unknown parameter 'user_i00000000000000000000' 05:23:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x1000c0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:14 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:14 executing program 2: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x7ee3a7a9}}, r0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:14 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xc02, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 721.666188][T22317] fuse: Unknown parameter 'user_id00000000000000000000' 05:23:15 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:15 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01", 0x11}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 722.077597][T22334] fuse: Unknown parameter 'user_id00000000000000000000' 05:23:15 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={r1, r0, 0x0, 0x10, &(0x7f0000000240)='md5sum&,md5sum/\x00'}, 0x30) getpgid(r2) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r3+30000000}, &(0x7f00000001c0)) r4 = request_key(&(0x7f0000000400)='syzkaller\x00', &(0x7f0000000680)={'syz', 0x0}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r4, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r5, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r6, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:15 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 722.310992][T22340] fuse: Unknown parameter 'user_id00000000000000000000' [ 722.341612][ T26] kauditd_printk_skb: 2 callbacks suppressed 05:23:15 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}, 0x800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, &(0x7f0000000680)={0x1, 0x8001}) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) r4 = open(0x0, 0x8001141042, 0x0) write(r4, &(0x7f0000000000)="b6", 0xfffffe7e) ioctl$IOC_PR_REGISTER(r4, 0x401870c8, &(0x7f0000000400)={0x7395, 0x4}) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 722.341634][ T26] audit: type=1804 audit(1574140995.615:403): pid=22314 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/405/file0/file0" dev="sda1" ino=16958 res=1 [ 722.353238][T22343] FAT-fs (loop5): invalid media value (0x00) [ 722.383440][T22343] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:15 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 722.468506][ T26] audit: type=1800 audit(1574140995.675:404): pid=22314 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16958 res=0 [ 722.552009][ T26] audit: type=1804 audit(1574140995.675:405): pid=22341 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/405/file0/file0" dev="sda1" ino=16958 res=1 [ 722.680524][ T26] audit: type=1804 audit(1574140995.935:406): pid=22335 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/390/file0/file0" dev="loop0" ino=552 res=1 05:23:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x1000d0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 722.760215][T22362] fuse: Bad value for 'fd' 05:23:16 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:16 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100013, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:16 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xe00, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 723.047556][T22379] fuse: Bad value for 'fd' 05:23:16 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270", 0x14}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 723.394068][T22392] fuse: Bad value for 'fd' 05:23:16 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:16 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r3 = getpgid(0x0) prlimit64(r3, 0xb, &(0x7f0000000280)={0x5}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r4, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 723.675525][T22401] FAT-fs (loop5): invalid media value (0x00) [ 723.694235][T22405] fuse: Bad value for 'fd' [ 723.752961][T22401] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:17 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 723.842373][ T26] audit: type=1804 audit(1574140997.115:407): pid=22412 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/406/file0/file0" dev="loop4" ino=554 res=1 [ 724.000165][T22425] fuse: Bad value for 'fd' 05:23:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}, 0x800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, &(0x7f0000000680)={0x1, 0x8001}) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r1+30000000}, &(0x7f00000001c0)) r2 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r2, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) r4 = open(0x0, 0x8001141042, 0x0) write(r4, &(0x7f0000000000)="b6", 0xfffffe7e) ioctl$IOC_PR_REGISTER(r4, 0x401870c8, &(0x7f0000000400)={0x7395, 0x4}) pipe(0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r5, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 724.023530][ T26] audit: type=1804 audit(1574140997.155:408): pid=22419 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/391/file0/file0" dev="loop0" ino=556 res=1 05:23:17 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 724.144445][ T26] audit: type=1804 audit(1574140997.215:409): pid=22413 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/406/file0/file0" dev="loop4" ino=554 res=1 05:23:17 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xff6, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 724.307148][T22434] fuse: Bad value for 'fd' 05:23:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x1000e0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:17 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100013, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:17 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270", 0x14}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 724.581032][T22445] fuse: Unknown parameter '0x0000000000000003' 05:23:18 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:18 executing program 2: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 724.842235][T22461] FAT-fs (loop5): invalid media value (0x00) [ 724.882544][T22461] FAT-fs (loop5): Can't find a valid FAT filesystem [ 725.058888][T22471] fuse: Unknown parameter '0x0000000000000003' [ 725.187095][ T26] audit: type=1804 audit(1574140998.455:410): pid=22441 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/392/file0/file0" dev="loop0" ino=558 res=1 05:23:18 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:18 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x1100, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 725.440251][T22482] fuse: Unknown parameter '0x0000000000000003' [ 725.463339][ T26] audit: type=1804 audit(1574140998.735:411): pid=22479 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/407/file0/file0" dev="loop4" ino=561 res=1 05:23:18 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 725.558056][ T26] audit: type=1800 audit(1574140998.745:412): pid=22479 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=561 res=0 05:23:19 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x1000f0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:19 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270", 0x14}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 725.687797][T22493] fuse: Unknown parameter '0x0000000000000003' 05:23:19 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100010, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:19 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:19 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 725.908516][T22502] fuse: Unknown parameter '0x0000000000000003' 05:23:19 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 726.133028][T22517] FAT-fs (loop5): invalid media value (0x00) [ 726.167371][T22517] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:19 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x8008, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 726.313219][T22528] fuse: Unknown parameter '0x0000000000000003' 05:23:19 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 726.684864][T22540] fuse: Unknown parameter 'fd0x0000000000000003' 05:23:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) r2 = socket$pptp(0x18, 0x1, 0x2) recvmmsg(r2, &(0x7f0000002640)=[{{&(0x7f0000000680)=@hci, 0x80, &(0x7f0000000a40)=[{&(0x7f0000000400)=""/46, 0x2e}, {&(0x7f0000000700)=""/46, 0x2e}, {&(0x7f0000000740)=""/72, 0x48}, {&(0x7f00000007c0)=""/174, 0xae}, {&(0x7f0000000880)=""/166, 0xa6}, {&(0x7f0000000940)=""/236, 0xec}], 0x6, &(0x7f0000000ac0)=""/232, 0xe8}, 0xffffff8b}, {{&(0x7f0000000bc0)=@xdp, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000c40)=""/7, 0x7}, {&(0x7f0000000c80)=""/57, 0x39}, {&(0x7f0000000cc0)=""/164, 0xa4}, {&(0x7f0000000d80)=""/14, 0xc}], 0x4, &(0x7f0000000e00)=""/251, 0xfb}, 0x80000001}, {{&(0x7f0000000f00)=@can, 0x80, &(0x7f0000002200)=[{&(0x7f0000000f80)=""/21, 0x15}, {&(0x7f0000000fc0)=""/120, 0x78}, {&(0x7f0000001040)=""/169, 0xa9}, {&(0x7f0000001100)=""/193, 0xc1}, {&(0x7f0000001200)=""/4096, 0x1000}], 0x5}, 0x2}, {{&(0x7f0000002280)=@x25, 0x80, &(0x7f00000024c0)=[{&(0x7f0000002300)=""/175, 0xaf}, {&(0x7f00000023c0)=""/134, 0x86}, {&(0x7f0000002480)=""/42, 0x2a}], 0x3}, 0x40}, {{&(0x7f0000002500)=@xdp, 0x80, &(0x7f0000002600)=[{&(0x7f0000002580)=""/118, 0x76}], 0x1}, 0x4008}], 0x5, 0x20, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) socket$pppoe(0x18, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r4 = syz_open_dev$dri(&(0x7f0000002780)='/dev/dri/card#\x00', 0x9, 0x40) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000027c0)={0x1, 0x0, 0x1, 0xd0}) ioctl$DRM_IOCTL_AGP_FREE(r4, 0x40206435, &(0x7f0000002800)={0x5, r5, 0x0, 0x2}) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000002840)='/dev/dlm_plock\x00', 0x2c08ac6afd3afc4e, 0x0) inotify_rm_watch(r6, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r7, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:20 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100120, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 727.030638][T22557] fuse: Unknown parameter 'fd0x0000000000000003' 05:23:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:20 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:20 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000007, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 727.274983][T22568] fuse: Unknown parameter 'fd0x0000000000000003' [ 727.358789][ T26] kauditd_printk_skb: 5 callbacks suppressed [ 727.358810][ T26] audit: type=1804 audit(1574141000.615:418): pid=22536 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/394/file0/file0" dev="sda1" ino=16971 res=1 [ 727.427848][T22573] FAT-fs (loop5): invalid media value (0x00) [ 727.433909][T22573] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:20 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:20 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000007, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:21 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xf60f, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:21 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:21 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 728.216800][ T26] audit: type=1804 audit(1574141001.485:419): pid=22565 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/409/file0/file0" dev="sda1" ino=16982 res=1 [ 728.296651][ T26] audit: type=1800 audit(1574141001.485:420): pid=22565 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16982 res=0 [ 728.338243][ T26] audit: type=1804 audit(1574141001.495:421): pid=22608 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/409/file0/file0" dev="sda1" ino=16982 res=1 05:23:21 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xff0f, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:21 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 728.576270][T22620] FAT-fs (loop5): invalid media value (0x00) [ 728.608591][T22620] FAT-fs (loop5): Can't find a valid FAT filesystem 05:23:22 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100300, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:22 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:22 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x8008, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:22 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:22 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000007, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 729.350149][ T26] audit: type=1804 audit(1574141002.625:422): pid=22648 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/396/file0/file0" dev="loop0" ino=570 res=1 05:23:22 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270ff", 0x15}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:23 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x20000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:23 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 729.922201][T22672] FAT-fs (loop5): invalid media value (0x00) [ 729.944048][T22672] FAT-fs (loop5): Can't find a valid FAT filesystem [ 729.978164][ T26] audit: type=1804 audit(1574141003.255:423): pid=22647 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/410/file0/file0" dev="loop4" ino=572 res=1 [ 730.156473][ T26] audit: type=1804 audit(1574141003.425:424): pid=22677 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/397/file0/file0" dev="sda1" ino=16999 res=1 05:23:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100408, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:23 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x40000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:23 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000007, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:23 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x8008, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:24 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:24 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 731.061324][ T26] audit: type=1804 audit(1574141004.335:425): pid=22702 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/398/file0/file0" dev="loop0" ino=574 res=1 [ 731.170114][ T26] audit: type=1800 audit(1574141004.355:426): pid=22702 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=574 res=0 [ 731.350209][ T26] audit: type=1804 audit(1574141004.625:427): pid=22730 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/411/file0/file0" dev="sda1" ino=16970 res=1 05:23:24 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x60000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:25 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100500, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:25 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:25 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:25 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 732.534499][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 732.534519][ T26] audit: type=1804 audit(1574141005.805:431): pid=22772 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/412/file0/file0" dev="loop4" ino=578 res=1 05:23:25 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 732.704512][ T26] audit: type=1800 audit(1574141005.835:432): pid=22754 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=578 res=0 05:23:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100600, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:26 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:26 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(0x0, 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:26 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 733.632309][ T26] audit: type=1804 audit(1574141006.905:433): pid=22791 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/400/file0/file0" dev="sda1" ino=16657 res=1 05:23:27 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xa0000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:27 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 734.130300][ T26] audit: type=1804 audit(1574141007.405:434): pid=22820 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/413/file0/file0" dev="loop4" ino=580 res=1 05:23:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0xffffffff00000000, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 734.324190][ T26] audit: type=1800 audit(1574141007.405:435): pid=22820 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=580 res=0 [ 734.452754][ T26] audit: type=1804 audit(1574141007.465:436): pid=22826 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/413/file0/file0" dev="loop4" ino=580 res=1 05:23:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100700, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:28 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 735.022949][ T26] audit: type=1804 audit(1574141008.295:437): pid=22835 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/401/file0/file0" dev="sda1" ino=16900 res=1 05:23:28 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xc0000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:28 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0xffffffff00000000, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 735.671545][ T26] audit: type=1804 audit(1574141008.945:438): pid=22848 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/414/file0/file0" dev="loop4" ino=582 res=1 05:23:29 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100804, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:29 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 735.973864][ T26] audit: type=1804 audit(1574141009.245:439): pid=22880 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/402/file0/file0" dev="sda1" ino=16913 res=1 [ 736.056002][ T26] audit: type=1800 audit(1574141009.295:440): pid=22875 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16913 res=0 05:23:29 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:29 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xe0000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:29 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0xffffffff00000000, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:23:30 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:30 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:30 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100900, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:30 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:23:31 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:31 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x100000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:31 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(0x0, 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 738.345117][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 738.345142][ T26] audit: type=1804 audit(1574141011.615:444): pid=22973 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/416/file0/file0" dev="sda1" ino=17019 res=1 05:23:31 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100804, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:31 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(0xffffffffffffffff, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 738.597550][ T26] audit: type=1800 audit(1574141011.655:445): pid=22973 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17019 res=0 [ 738.712661][ T26] audit: type=1804 audit(1574141011.655:446): pid=22976 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/416/file0/file0" dev="sda1" ino=17019 res=1 05:23:32 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100a00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 739.060755][ T26] audit: type=1804 audit(1574141012.335:447): pid=22974 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/404/file0" dev="sda1" ino=17004 res=1 05:23:32 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 739.191419][ T26] audit: type=1800 audit(1574141012.335:448): pid=22974 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=17004 res=0 [ 739.304338][ T26] audit: type=1804 audit(1574141012.345:449): pid=23005 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/404/file0" dev="sda1" ino=17004 res=1 05:23:32 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(0x0, 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:32 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x1fffff, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:33 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, 0x0, 0x0) [ 740.018887][ T26] audit: type=1804 audit(1574141013.295:450): pid=23032 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/417/file0/file0" dev="sda1" ino=17025 res=1 [ 740.097856][ T26] audit: type=1800 audit(1574141013.325:452): pid=23032 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17025 res=0 [ 740.176873][ T26] audit: type=1804 audit(1574141013.325:451): pid=23038 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/417/file0/file0" dev="sda1" ino=17025 res=1 05:23:33 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100b00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:33 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:33 executing program 1: r0 = gettid() r1 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000280)={0x28, 0x0, 0xffff8546, @host}, 0x10, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000380)) fcntl$setownex(r1, 0xf, &(0x7f0000000340)={0x0, r2}) ptrace$setopts(0x4206, r0, 0x2, 0x100029) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r3+30000000}, &(0x7f00000001c0)) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000040)) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) timerfd_settime(r4, 0x3, &(0x7f0000000240)={{0x77359400}, {r5, r6+10000000}}, &(0x7f00000002c0)) request_key(0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x0) r7 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/capi/capi20ncci\x00', 0x189000, 0x0) ioctl$sock_x25_SIOCADDRT(r7, 0x890b, &(0x7f0000000400)={@null=' \x00', 0x8, 'veth0\x00'}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) [ 740.381253][ T26] audit: type=1804 audit(1574141013.655:453): pid=23026 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/405/file0/file0" dev="sda1" ino=17027 res=1 05:23:33 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x1000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:34 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(0x0, 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:34 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, 0x0, 0x0) 05:23:34 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:34 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x2000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000240)=""/33, 0x21) set_mempolicy(0x2, &(0x7f00000000c0)=0x2, 0x8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd(0x0) ioctl$KVM_IOEVENTFD(r3, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, r4}) pselect6(0x40, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x0, &(0x7f0000000140)={0x1b4, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x7, 0x0, 0xf83, 0x3}, 0x0, 0x0) 05:23:35 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100c00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:35 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x3000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:35 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, 0x0, 0x0) 05:23:35 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:36 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000240)=""/33, 0x21) set_mempolicy(0x2, &(0x7f00000000c0)=0x2, 0x8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd(0x0) ioctl$KVM_IOEVENTFD(r3, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, r4}) pselect6(0x40, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x0, &(0x7f0000000140)={0x1b4, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x7, 0x0, 0xf83, 0x3}, 0x0, 0x0) 05:23:36 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90}, 0x90) 05:23:36 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100d00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:36 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x4000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:36 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:37 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x0, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200), 0x4) pipe(0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000240)=""/33, 0x21) set_mempolicy(0x2, &(0x7f00000000c0)=0x2, 0x8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd(0x0) ioctl$KVM_IOEVENTFD(r3, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, r4}) pselect6(0x40, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x0, &(0x7f0000000140)={0x1b4, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x7, 0x0, 0xf83, 0x3}, 0x0, 0x0) 05:23:37 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90}, 0x90) 05:23:37 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 744.074715][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 744.074750][ T26] audit: type=1804 audit(1574141017.345:458): pid=23177 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/420/file0/file0" dev="loop4" ino=597 res=1 05:23:37 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x5000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:37 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100e00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 745.055402][ T26] audit: type=1804 audit(1574141018.325:459): pid=23215 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/410/file0/file0" dev="sda1" ino=16785 res=1 05:23:38 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90}, 0x90) 05:23:38 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90}, 0x90) 05:23:38 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:38 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x6000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 745.391899][ T26] audit: type=1804 audit(1574141018.665:460): pid=23223 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/421/file0/file0" dev="loop4" ino=601 res=1 05:23:38 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100f00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:39 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, 0x0, 0x0) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:39 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100e00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 746.180787][ T26] audit: type=1804 audit(1574141019.455:461): pid=23255 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/411/file0/file0" dev="sda1" ino=16689 res=1 [ 746.330431][ T26] audit: type=1800 audit(1574141019.455:462): pid=23251 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16689 res=0 05:23:39 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:39 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000340)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x68, r1, 0x5, 0x0, 0x0, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x0, @media='udp\x00'}}}}, 0x68}}, 0x0) 05:23:39 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x7000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:40 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x0, 0x2, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_NMI(r2, 0xae9a) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup2(r3, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 746.740514][ T26] audit: type=1804 audit(1574141020.015:463): pid=23288 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/422/file0/file0" dev="loop4" ino=605 res=1 [ 746.874889][ T26] audit: type=1800 audit(1574141020.015:464): pid=23288 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=605 res=0 05:23:40 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, 0x0, 0x0) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:40 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101100, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 747.001820][ T26] audit: type=1804 audit(1574141020.015:465): pid=23290 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/422/file0/file0" dev="loop4" ino=605 res=1 [ 747.110720][T23305] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. 05:23:40 executing program 1: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r0, 0x104, 0x1, &(0x7f0000000100), 0x4) 05:23:40 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100e00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:41 executing program 1: socket$kcm(0x29, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff, 0x4}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, 0x0}, 0x40) socket$kcm(0x29, 0x2, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={r0, 0x1, 0x0, 0x1, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x14, 0x5, &(0x7f0000000640)=ANY=[@ANYBLOB="5d2900000400000018000000b4c50094ffdb105b37b5810000000000000071f8c086bd0dff934e126f947d9fa2381a9a881a661c53f683976fc66db5e7e523c6a8", @ANYRES32, @ANYBLOB="00000000cb0000008b42172cae482db54cc3f0cdc992a11ef49f7331b401211006a70d82371b9722faf208f638d055003e529c5ab26411"], &(0x7f00000000c0)='GPL\x00', 0x37f45aa2, 0x89, &(0x7f00000002c0)=""/137, 0xa2980, 0x1, [], 0x0, 0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000200)={0x2, 0xc, 0xc8f, 0x1}, 0x10}, 0x70) sendmsg$kcm(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="2e0000002300817ee45de087185082cf0400b0eba06ec400002339e00586f9835b3f00009148790000f85acc7c45", 0x2e}], 0x1}, 0x20000000) 05:23:41 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 747.906197][T23337] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.1'. [ 748.045229][ T26] audit: type=1804 audit(1574141021.315:466): pid=23299 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/412/file0/file0" dev="sda1" ino=16657 res=1 05:23:41 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x8000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:41 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, 0x0, 0x0) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 748.250518][ T26] audit: type=1804 audit(1574141021.525:467): pid=23345 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/423/file0/file0" dev="sda1" ino=16881 res=1 [ 748.259898][T23356] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.1'. 05:23:41 executing program 1: socket$kcm(0x29, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff, 0x4}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, 0x0}, 0x40) socket$kcm(0x29, 0x2, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={r0, 0x1, 0x0, 0x1, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x14, 0x5, &(0x7f0000000640)=ANY=[@ANYBLOB="5d2900000400000018000000b4c50094ffdb105b37b5810000000000000071f8c086bd0dff934e126f947d9fa2381a9a881a661c53f683976fc66db5e7e523c6a8", @ANYRES32, @ANYBLOB="00000000cb0000008b42172cae482db54cc3f0cdc992a11ef49f7331b401211006a70d82371b9722faf208f638d055003e529c5ab26411"], &(0x7f00000000c0)='GPL\x00', 0x37f45aa2, 0x89, &(0x7f00000002c0)=""/137, 0xa2980, 0x1, [], 0x0, 0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000200)={0x2, 0xc, 0xc8f, 0x1}, 0x10}, 0x70) sendmsg$kcm(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="2e0000002300817ee45de087185082cf0400b0eba06ec400002339e00586f9835b3f00009148790000f85acc7c45", 0x2e}], 0x1}, 0x20000000) 05:23:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101200, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 748.832083][T23374] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.1'. 05:23:42 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x703}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000c40)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6#\xd9\xa1W\x1c\xb96\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\x97\x80\xe9\xa1S\f\xc7?\xa6\x95I\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~\xff\xff\x00\x00#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xd5\x1b\xca\xa9\xc7[\xa2\xef\xacM\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xb4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\x04R\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xafh_\x9c\x91\xc1q_|L\x11\x03\x94\xc0\t=\x17\x95P\xd7\xcdH\x1c8^ARL\x9b\x1f\xf6P\rSj\x95\xd9o\x03\xd4\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x13\x82Rk\x9cAz\xab\rT\xadLO\f\x17Y\x1dg\x10\xe3LL\x1fC\xfa\xd9\xb0\xfb\xb4\xf3[\xdf\xd0\xd6\x82\xf6~0\xb8\xf4\xb0X\xfew\xbdY\n\xd6\x105\x9c\xb7\xe5F\xc1:9\xb8\xc2\x85\b\xfd\x92\xb0k\x93\xd7\xc40J\xc2\xf0=p\xd6\xe3\xe4W:\xd2\xf6\xfc\x83\xb1\xcb\xd1K\xb9(\"9(~\xf4\xf4\x94`\xe8\xdb\x17\xf9\xcf#)T\xcdj^\xa61\x12\x91 \xd7\x92\xc0\xd0s\xa9\xe4\x18:') r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={'nr0\x01\x00', 0x703}) 05:23:42 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:42 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x100e00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 749.336812][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 749.336834][ T26] audit: type=1804 audit(1574141022.605:470): pid=23365 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/413/file0" dev="sda1" ino=16579 res=1 [ 749.423711][ T26] audit: type=1800 audit(1574141022.605:471): pid=23365 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16579 res=0 [ 749.533936][ T26] audit: type=1804 audit(1574141022.605:472): pid=23384 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/413/file0" dev="sda1" ino=16579 res=1 05:23:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(0x0, 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:43 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x8800000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 749.826909][ T26] audit: type=1804 audit(1574141023.095:473): pid=23377 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/424/file0/file0" dev="loop4" ino=610 res=1 05:23:43 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101300, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:43 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl(r1, 0x1, &(0x7f0000000100)="81") 05:23:43 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 750.695395][ T26] audit: type=1804 audit(1574141023.965:474): pid=23418 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/414/file0/file0" dev="sda1" ino=16593 res=1 05:23:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(0x0, 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 750.784669][ T26] audit: type=1800 audit(1574141023.995:475): pid=23416 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16593 res=0 05:23:44 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) socket$inet6(0xa, 0x400000000001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open(0x0, 0x141042, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x0, 0x0) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000000), 0x4) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)) ioctl(r0, 0x1, &(0x7f0000000100)="814a") 05:23:44 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x6, &(0x7f0000000080)={@rand_addr="f2b4deefa010a59fe25bac80f36f805a", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000}, 0x20) 05:23:44 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x9000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 751.193905][ T26] audit: type=1804 audit(1574141024.465:476): pid=23450 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/425/file0/file0" dev="sda1" ino=17009 res=1 [ 751.234987][ T26] audit: type=1800 audit(1574141024.495:477): pid=23450 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17009 res=0 [ 751.252808][T23463] EXT4-fs warning (device sda1): ext4_block_to_path:105: block 1838172801 > max in inode 16530 [ 751.290632][ T26] audit: type=1804 audit(1574141024.495:478): pid=23451 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/425/file0/file0" dev="sda1" ino=17009 res=1 05:23:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(0x0, 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:44 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101400, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:44 executing program 1: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f0000000040)) 05:23:44 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80030, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0x400000) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_int(r1, &(0x7f0000000040)='memory.max\x00', 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0x400000) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000140)={0xffffffffffffffff, r2, 0x29, 0x2}, 0x10) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.stet\x00', 0x26e1, 0x0) r4 = socket$kcm(0x2, 0x1000000000000002, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000001700)={&(0x7f0000000300)='./file0\x00'}, 0x10) setsockopt$sock_attach_bpf(r4, 0x1, 0x3e, &(0x7f00000002c0)=r3, 0x161) sendmsg$kcm(r4, &(0x7f0000000540)={&(0x7f0000000380)=@in={0x2, 0x4e23, @rand_addr=0x7fffffff}, 0x80, 0x0}, 0xfd00) r5 = gettid() perf_event_open(0x0, r5, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140)=r5, 0x12) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000001800)='\\wlan1}lo(cgroup]\x00') write$cgroup_subtree(r4, &(0x7f0000000280)={[{0x0, 'memory'}]}, 0xfdef) r6 = socket$kcm(0x11, 0x2, 0x0) socket$kcm(0x29, 0x0, 0x0) r7 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r7, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[{0x18, 0x0, 0x1, "336ff3a0"}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0x12, &(0x7f00000000c0)=r6, 0x10000007b) socket$kcm(0x2, 0x0, 0x0) 05:23:44 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 751.809302][ T26] audit: type=1804 audit(1574141025.085:479): pid=23486 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/415/file0/file0" dev="loop0" ino=614 res=1 05:23:45 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x373, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$SEG6_CMD_SET_TUNSRC(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) pipe2(0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f00000000c0)="8174ae688e1800a01f16d921576a769f", 0x10) r0 = getpid() tkill(r0, 0x9) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b70200000344f11dbfa30000000000001702000012feffff7a0af0ff01ffffff79a4f0ff00000000b7060000ff1900007e640200000000005502faff71c10e1d0404000001007d60b7030000001000006a0a00fe000000008500050000000004cf000000000000009500000000000000a81bbfa3982de7b0efc5733ed236e4add6de094e0832aaa6912a8b2ce571c45841e41f44ae7c5e0200000080000000b38a748355f0b886bd005362df1d4fdd860db5808942b7de2243533ef6d62a46b3009a54f4fd7db0d4968a384b0f59c7919b899d5fdb68832e986440ff0a7edfa0cb231ccd00000000000000000000007777e2704653f620f5898a327a5ce13419b2272c3c7fea60493073807c4b7bbaed91f33fb382d990b1e92e4d6e0f9ad2c199d6068f17429722ec5f1c7cc5869ff455896712198c4e2ddf8b86e714229527a59cca000077c138346ab2d5ca40b24cfd6a02fa0c92728807982df1a63de3a29bb744af81a4cd8f3ad2d9582da7a9ba2ebdd0b424ac416e66af9ebcfea905d37cf226312cb81ec8439ced91f5c93f7f4d256c19f48eafd4cfb37217578aa3b61d06e7fa69393516301460142f832fd7dbe55efdb06dcf91fd2464cb130033d649d2110c63698e826155a614d79de13b60fc8506e5b19d78d36652ac986653065513a7a100f9607bc20c3db1869274fe438ac95cd1830d884593dfba3f214bba2f5886b7c708c14d77fbb4b5550de898cd6fec383c568193468e07419cdc1b14255b84d56d2f96c0b93fc899517978d02bda8373b836d1b3806fd46844585ed4b2fb0f4b889089d49e654bf8cf809768b6dbcb788b770cde3e613b874f3c0a81dd8fd8e21c56d6a84668d87441d26fc222fd968d333e7c4aed527d78f2d405691a6f4fb3f9cec1c713384357b5948086a6b70823ab4cce75a6d20315e30fa3ab7621127bd4e59651298d02fdce53509e35151bc89b82d6a5b573f7ef10b930596bb5411edd6eb6"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 05:23:45 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xa000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:45 executing program 3: perf_event_open(&(0x7f0000000440)={0x2, 0x373, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, 0x0, 0x0) sendmsg$SEG6_CMD_SET_TUNSRC(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, 0x0, 0x0) r0 = getpid() tkill(r0, 0x9) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b70200000344f11dbfa30000000000001702000012feffff7a0af0ff01ffffff79a4f0ff00000000b7060000ff1900007e640200000000005502faff71c10e1d0404000001007d60b7030000001000006a0a00fe000000008500050000000004cf000000000000009500000000000000a81bbfa3982de7b0efc5733ed236e4add6de094e0832aaa6912a8b2ce571c45841e41f44ae7c5e0200000080000000b38a748355f0b886bd005362df1d4fdd860db5808942b7de2243533ef6d62a46b3009a54f4fd7db0d4968a384b0f59c7919b899d5fdb68832e986440ff0a7edfa0cb231ccd00000000000000000000007777e2704653f620f5898a327a5ce13419b2272c3c7fea60493073807c4b7bbaed91f33fb382d990b1e92e4d6e0f9ad2c199d6068f17429722ec5f1c7cc5869ff455896712198c4e2ddf8b86e714229527a59cca000077c138346ab2d5ca40b24cfd6a02fa0c92728807982df1a63de3a29bb744af81a4cd8f3ad2d9582da7a9ba2ebdd0b424ac416e66af9ebcfea905d37cf226312cb81ec8439ced91f5c93f7f4d256c19f48eafd4cfb37217578aa3b61d06e7fa69393516301460142f832fd7dbe55efdb06dcf91fd2464cb130033d649d2110c63698e826155a614d79de13b60fc8506e5b19d78d36652ac986653065513a7a100f9607bc20c3db1869274fe438ac95cd1830d884593dfba3f214bba2f5886b7c708c14d77fbb4b5550de898cd6fec383c568193468e07419cdc1b14255b84d56d2f96c0b93fc899517978d02bda8373b836d1b3806fd46844585ed4b2fb0f4b889089d49e654bf8cf809768b6dbcb788b770cde3e613b874f3c0a81dd8fd8e21c56d6a84668d87441d26fc222fd968d333e7c4aed527d78f2d405691a6f4fb3f9cec1c713384357b5948086a6b70823ab4cce75a6d20315e30fa3ab7621127bd4e59651298d02fdce53509e35151bc89b82d6a5b573f7ef10b930596bb5411edd6eb6"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 05:23:45 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x0, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:45 executing program 1: sendmsg$TIPC_CMD_SHOW_STATS(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x3ad, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x1}) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f00000000c0)=0x3) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f00000006c0)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6\xf23F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0_\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\xa9\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&k\x80K\xd1>\xa6\xff(\xb1\x01\xe7\xa5\xce-A\xb0\xec\x190r-q\x83\xb3mN\x91\'\xc5\xf8\xfe\x18\x16\xb7R6\xa9R\xf4H\xa7\x84\x98\xfc\xf9\xa6\xd6\x8d\xa7\xd5_\xc0\x93\xde\x1f`\xff\xcf\xe1)N\x85&\x8b\x06I\xa2\x13\x02\x00\x00\x00\x00\x00\x00\x00[\xae5\x82}\xb7h!\xd9\xce\xe9\x06\b\rs^\x8d\x14\xc1\x97m@6\x1d\xfc\x92@-\xb6\xe5N\x84\xbc\xc0\x1f\xfbI\'M\xdd\xc6*\x06&\f\b\xa6\x92)D}\x87\x80\xea\xb9l\x80H\xea\x82o6\xfa)\x15\xdc@\xf4\x86\xd6_\xf9+/Q\xd5\x8a;\x8b\xe1\x1d\xd0\xec\x8ek\xdb\xa8\xf3Ir\xdb1`B&\xe8A\xd1\xea\xb4$5%aL\xc1\xbd\x91\xc3\x90\x06i <1\xaa\"\xd5\xbb\xe9\xc7SX\xbfm{>\xd4\xc3(E[\xb0J13\xbbG\x8a\xb4\x8aMs\x9f\xcf\xb8g\xab\x12\x8cj\x95}\xb1\bc\xc4u\xf4\xe2\x88\xfa\xde\xec\xdf\xb9\x98\x84\x028\xd9_n\x9f\x86\x88\xe6\x15b\x01]\x01a\xe7\xb9\xb0\xbdk\xaa\xa1\xc1') ppoll(&(0x7f00000000c0)=[{}], 0x20000000000000d8, 0x0, 0x0, 0xfffffffffffffd6a) 05:23:45 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x2, 0x2, [@local, @random="1484883fd015"]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 752.639991][T23532] device nr0 entered promiscuous mode [ 752.820256][T23540] picdev_read: 120 callbacks suppressed [ 752.820271][T23540] kvm: pic: non byte read [ 752.863606][T23540] picdev_write: 124 callbacks suppressed [ 752.863619][T23540] kvm: pic: non byte write [ 752.881741][T23540] kvm: pic: non byte read [ 752.888840][T23540] kvm: pic: non byte write [ 752.898656][T23540] kvm: pic: non byte read [ 752.907764][T23540] kvm: pic: non byte write [ 752.919570][T23540] kvm: pic: non byte read [ 752.927749][T23540] kvm: pic: non byte write [ 752.939975][T23540] kvm: pic: non byte read [ 752.949198][T23540] kvm: pic: non byte write 05:23:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101500, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 752.981203][T23540] kvm: pic: non byte read [ 752.997205][T23540] kvm: pic: non byte write [ 753.003025][T23540] kvm: pic: non byte read [ 753.014639][T23532] device nr0 entered promiscuous mode [ 753.027998][T23540] kvm: pic: non byte write [ 753.068037][T23540] kvm: pic: non byte read 05:23:46 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 753.089837][T23540] kvm: pic: non byte write [ 753.095449][T23540] kvm: pic: non byte read [ 753.121382][T23540] kvm: pic: non byte write [ 753.132250][T23540] kvm: pic: non byte read [ 753.142813][T23540] kvm: pic: non byte write 05:23:46 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xc000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:46 executing program 3: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x5aeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0xaf01, 0x0) r1 = dup(r0) ioctl$SG_GET_COMMAND_Q(r1, 0x2270, &(0x7f00000000c0)) 05:23:46 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x0, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:46 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x2, 0x1, [@local]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 05:23:47 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x2, 0x1, [@local]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 05:23:47 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:47 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101600, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:47 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@mcast2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400000000}, 0x20) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xffc7}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="0100000000000000280012000c0001007665746800000000ececfac5e025573fb5926c7ae92af81800020814a79f7488f611d01cb85041b7f809000000004600006df0840107d3c3bc1747ef4939dd822dafd6037136a70f304dbcdee66ed673df5c98c00033e06a14e3b513ef72364106b249dd59b35aafee80aa0a9b2e3bbfb4941d2ed7d7fc3c3dae0a3a354339e3572311b364ba77c4e343d199812b3862a78324fd19d159913729e3afec87ff2f99746c2aed6d90fff50cc840305b5f78eae0", @ANYRES32=0x0, @ANYBLOB="0b4a1914200cc3ad134d722638676806c8290e7b562b6cf4fa7af6933aa62720930c5bde67868a7ae19a80ff6b106ddb9c0c311a7feda8455842b5365ce6d9082f1f056abd876b3e43df416758c774ccb2812e65015ed0b8842bd64eaedb3091495364373194c8291924cde4eb65b0168d36955facea07381b9a4e74fa4c0f111cc2fbf6cd1ea6877a05e7d76dc889950a0af8a3842cf9e6364c087a3d48f2dfc7e7f89b7aa5060d8e3c2e7630e2a22d7e017e36c2e9fcd5e64ba064ca4f8e00a658f5fefd6b640a426762cd0f8368575b72e7b5a6431e3e326a41614b2f54f06fa19d4a475b9da7f71d8bdc5e22c3e9e6ddfe7b23706ad4e0e97bef4388bbbdb5e2cb77e43eb48248565888a7a67a38fe5344e4d43ddccca47ad855d1174aed891ab7cb13c7773d32cee8d2a16aca453da81632505308f03920d7fd3c360ebb9451374df5632a7c45adf36fd435da0c0217370b4c9a6e1d63e0fa0ccaaee41f1f885ea0e9e58e9828a4b8ba15adf788ec35a8b7812ec90544402f24fd4aa56d6b6cc69503e0b9937ba71bd84d4ad99d88d26ebe9d2d1634f5db9ae05d89fcffd8aea9e4d611fde1ce2b86c0e738a88254f9b55dac78a4cc4fba181da2a30d235de529b13e53d8d89a"], 0x5}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000080)={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68]}, @dev, @local}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000140)={@local, @rand_addr="6409c0b80e989ba29fb30dc012b97603", @ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400003}) [ 754.470120][T23577] kvm: pic: level sensitive irq not supported [ 754.501766][T23577] kvm: pic: single mode not supported [ 754.507990][T23577] kvm: pic: level sensitive irq not supported [ 754.513916][ T26] kauditd_printk_skb: 6 callbacks suppressed [ 754.513935][ T26] audit: type=1804 audit(1574141027.785:486): pid=23587 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/417/file0/file0" dev="sda1" ino=17070 res=1 05:23:48 executing program 3: openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, 0x0) prlimit64(r0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x3f, 0x3}, 0x0) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RWALK(0xffffffffffffffff, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r1, 0x0) write$P9_RWALK(r1, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x8) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r1, r2) close(0xffffffffffffffff) socket$inet_udp(0x2, 0x2, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000040)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @sint}]}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_IRQ_LINE(0xffffffffffffffff, 0x4008ae61, &(0x7f0000000000)={0x0, 0x10}) write$binfmt_elf32(r5, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) 05:23:48 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x0, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:48 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xc020000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:48 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:48 executing program 3: mmap(&(0x7f000071c000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) open(&(0x7f00009b7000)='./bus\x00', 0x0, 0x0) mlock(&(0x7f00009ed000/0x4000)=nil, 0x4000) mmap(&(0x7f0000847000/0x600000)=nil, 0x600000, 0x0, 0x1010, 0xffffffffffffffff, 0x0) [ 755.630840][ T26] audit: type=1804 audit(1574141028.905:487): pid=23652 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/428/file0/file0" dev="loop4" ino=622 res=1 [ 755.721418][ T26] audit: type=1800 audit(1574141028.905:488): pid=23652 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=622 res=0 05:23:49 executing program 3: connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1}, 0x1c) r0 = openat$proc_capi20ncci(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x18, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x1, 0x0) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000240)='.\x00', 0xc0000080) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x10000294}, 0x2, &(0x7f00000004c0)={&(0x7f00000008c0)=ANY=[]}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, 0x0, 0x39d) r2 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, 0x0, 0x39d) r3 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, 0x0, 0x39d) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f00000005c0)=ANY=[], 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000200)={'gretap0\x00', {0x2, 0x4e23, @multicast2}}) r4 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r4, 0x40106614, &(0x7f0000000380)) [ 755.859374][ T26] audit: type=1804 audit(1574141028.905:489): pid=23654 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/428/file0/file0" dev="loop4" ino=622 res=1 05:23:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101700, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 756.132840][ T26] audit: type=1804 audit(1574141029.405:490): pid=23638 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/418/file0/file0" dev="loop0" ino=625 res=1 05:23:49 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000002046, 0x0) r1 = dup2(r0, r0) write$P9_RMKNOD(r1, &(0x7f0000000000)={0xff06}, 0xffffff57) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)) r2 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r2, 0x5412, &(0x7f0000000100)={0x3}) 05:23:49 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:49 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0xa, 0x5, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) setsockopt$sock_attach_bpf(r1, 0x29, 0x11, &(0x7f0000000200)=r2, 0x9cd) 05:23:49 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xe000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:49 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 756.975236][ T26] audit: type=1804 audit(1574141030.245:491): pid=23709 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/429/file0/file0" dev="sda1" ino=17078 res=1 05:23:50 executing program 3: prlimit64(0x0, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl(r1, 0x1, &(0x7f0000000100)) [ 757.094364][ T26] audit: type=1800 audit(1574141030.285:492): pid=23709 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17078 res=0 [ 757.239559][ T26] audit: type=1804 audit(1574141030.285:493): pid=23711 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/429/file0/file0" dev="sda1" ino=17078 res=1 05:23:50 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101800, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 757.608116][ T26] audit: type=1804 audit(1574141030.885:494): pid=23700 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/419/file0" dev="sda1" ino=17081 res=1 05:23:50 executing program 3: prlimit64(0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl(r1, 0x1, &(0x7f0000000100)) [ 757.724012][ T26] audit: type=1800 audit(1574141030.915:495): pid=23700 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=17081 res=0 05:23:51 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:51 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x8000000a, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c9243fbf0322168078aba9d7ae45b0052772a9567bb821942ce72590f1bf41d20d4c000000279bd612811df1fcaa94a96d58db92af7f9298918ae95b745777a1968e48d46358c8735e3b009f9d01000000000000005b5895e126de3d6d7c6949c6a87cf3ab2fbe80d1028d6e727a596c761e274e8f7bf745addbe19bd7642d38323564278e0410a966da6a254b9c2fa9c5d27796310a13c91878b74c9d615ae752a67e9373b0bc80f98ca3686a79c2dd0d6428fcbacb482ba7a33878f84fdc417a06", 0xf8}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 758.045181][T23749] ptrace attach of "/root/syz-executor.1"[23748] was attempted by "/root/syz-executor.1"[23749] 05:23:51 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:51 executing program 1: openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x4000, 0x0) 05:23:51 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xfffffff, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:51 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001b00)=[{&(0x7f00000005c0)=""/2, 0x2}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='status\x00') preadv(r0, &(0x7f00000017c0), 0x73, 0x0) 05:23:51 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x40000000002, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000040)=0x7, 0x168) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) sendto$unix(r2, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) [ 758.523634][T23777] raw_sendmsg: syz-executor.1 forgot to set AF_INET. Fix it! 05:23:52 executing program 1: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f00000002c0)=ANY=[@ANYBLOB="e6ff0300540000552331fe0500fac9067f13675ab4f2", @ANYBLOB="850081008ca31d3f003b54c91df8a31be46a014d43e66871c22ee20ce70f39885b2007369348b27eceb52aec5737ca70af71bee3b7a6117929e7b1d46d38b6a6b6c3285bb01e4d5d627b0f0911da0beb35118732bb0cbf909651c8c600fbde031f3161edefb1ba0706eb9644ce21b8e89e5300004c001f00ff6a4518c96e417975eb8dbfcd05c1"], 0x9d}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) 05:23:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101900, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:52 executing program 3: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x4008550d, 0x0) 05:23:52 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:52 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:52 executing program 3: perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x6}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6000000}, 0x0) [ 759.509545][T23798] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 759.567854][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 759.567934][ T26] audit: type=1804 audit(1574141032.845:500): pid=23771 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/420/file0" dev="sda1" ino=16522 res=1 [ 759.617241][T23798] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 759.715786][T23798] EXT4-fs (loop1): ext4_check_descriptors: Inode table for group 0 overlaps superblock 05:23:53 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x11000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 759.853455][T23798] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 05:23:53 executing program 3: socket$kcm(0x29, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff, 0x4}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x100000000000001, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000440)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, 0x0}, 0x40) socket$kcm(0x29, 0x2, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={r0, 0x1, 0x0, 0x1, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x14, 0x5, &(0x7f0000000640)=ANY=[@ANYBLOB="5d2900000400000018000000b4c50094ffdb105b37b5810000000000000071f8c086bd0dff934e126f947d9fa2381a9a881a661c53f683976fc66db5e7e523c6a8", @ANYRES32, @ANYBLOB="00000000cb0000008b42172cae482db54cc3f0cdc992a11ef49f7331b401211006a70d82371b9722faf208f638d055003e529c5ab26411"], &(0x7f00000000c0)='GPL\x00', 0x37f45aa2, 0x89, &(0x7f00000002c0)=""/137, 0xa2980, 0x1, [], 0x0, 0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000200)={0x2, 0xc, 0xc8f, 0x1}, 0x10}, 0x70) sendmsg$kcm(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)="2e0000002300817ee45de087185082cf0400b0eba06ec400002339e00586f9835b3f00009148790000f85acc7c45", 0x2e}], 0x1}, 0x20000000) 05:23:53 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) lseek(0xffffffffffffffff, 0x0, 0x2) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x0, 0x2, [@local, @random="1484883fd015"]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 760.213518][T23849] netlink: 26 bytes leftover after parsing attributes in process `syz-executor.3'. [ 760.365574][ T26] audit: type=1804 audit(1574141033.635:501): pid=23844 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/431/file0/file0" dev="sda1" ino=17093 res=1 05:23:53 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 760.435397][T23852] kvm: pic: level sensitive irq not supported [ 760.435732][T23852] picdev_read: 139 callbacks suppressed [ 760.435746][T23852] kvm: pic: non byte read 05:23:53 executing program 3: prlimit64(0x0, 0xe, 0x0, 0x0) getpid() open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000240)={0x0, 0x401, 0x1000}) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x62a, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000580)={{{@in=@multicast1, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x80, 0x33}, {0x0, 0x7fffffff, 0x0, 0x0, 0x5, 0x7, 0x2000000000004}, {0x0, 0x3}, 0x0, 0x6e6bb8, 0x6, 0x1, 0x2, 0x3}, {{@in=@dev, 0x4d5}, 0x0, @in6=@mcast1, 0x3503, 0x8476f732d1874694, 0x0, 0xb8, 0x3, 0x4e9}}, 0xe8) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x2000) fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000540)='./file0\x00', 0x0) 05:23:53 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101a00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 760.491714][T23852] picdev_write: 120 callbacks suppressed [ 760.491782][T23852] kvm: pic: non byte write [ 760.514622][T23852] kvm: pic: level sensitive irq not supported [ 760.516366][T23852] kvm: pic: non byte read [ 760.557027][ T26] audit: type=1804 audit(1574141033.825:502): pid=23841 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/421/file0/file0" dev="loop0" ino=629 res=1 [ 760.587371][T23852] kvm: pic: non byte write [ 760.592194][T23852] kvm: pic: level sensitive irq not supported [ 760.592596][T23852] kvm: pic: non byte read [ 760.659467][T23852] kvm: pic: non byte write [ 760.673233][T23852] kvm: pic: level sensitive irq not supported [ 760.675283][T23852] kvm: pic: non byte read 05:23:54 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 760.736346][T23852] kvm: pic: non byte write [ 760.761763][T23852] kvm: pic: level sensitive irq not supported [ 760.762255][T23852] kvm: pic: non byte read [ 760.799309][T23852] kvm: pic: non byte write [ 760.814586][T23852] kvm: pic: level sensitive irq not supported [ 760.814921][T23852] kvm: pic: non byte read [ 760.877657][T23852] kvm: pic: non byte write 05:23:54 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x2f6ee7df, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 760.925939][T23852] kvm: pic: level sensitive irq not supported [ 760.931172][T23852] kvm: pic: non byte read [ 760.973678][T23852] kvm: pic: non byte write [ 761.000407][T23852] kvm: pic: level sensitive irq not supported [ 761.000863][T23852] kvm: pic: non byte read [ 761.069720][T23852] kvm: pic: non byte write [ 761.106299][T23852] kvm: pic: level sensitive irq not supported [ 761.110587][T23852] kvm: pic: non byte read [ 761.190753][T23852] kvm: pic: non byte write [ 761.267976][T23852] kvm: pic: level sensitive irq not supported [ 761.275060][T23852] kvm: pic: non byte read [ 761.326049][T23852] kvm: pic: non byte write 05:23:54 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x1d2, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000040)="b8f20000000f23c00f21f835010002000f23f8520f01ba00000000d8830d8e00000f01d1660fc736c4e2ed9f533ca6c4c3a148dc00c4e178533506000000", 0x3e}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0xfefd, 0x40, 0x0, 0xfffffffffffffdd4) ioctl$FS_IOC_MEASURE_VERITY(0xffffffffffffffff, 0xc0046686, &(0x7f0000000180)=ANY=[@ANYBLOB="26b2"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 05:23:55 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 761.722557][T23852] kvm: pic: single mode not supported [ 761.740229][ T26] audit: type=1804 audit(1574141035.015:503): pid=23898 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/432/file0/file0" dev="loop4" ino=631 res=1 05:23:55 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[@ANYRES32], 0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r1, 0x104, 0x2, &(0x7f0000000100), 0x4) [ 761.849994][ T26] audit: type=1800 audit(1574141035.045:504): pid=23898 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=631 res=0 [ 761.869612][ T26] audit: type=1804 audit(1574141035.045:505): pid=23900 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/432/file0/file0" dev="loop4" ino=631 res=1 [ 762.043271][ T26] audit: type=1804 audit(1574141035.315:506): pid=23895 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/422/file0/file0" dev="sda1" ino=17113 res=1 05:23:55 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:55 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x101b00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:55 executing program 3: 05:23:55 executing program 1: [ 762.149757][ T26] audit: type=1800 audit(1574141035.375:507): pid=23889 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=17113 res=0 05:23:55 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xdfe76e2f, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:55 executing program 1: 05:23:55 executing program 3: 05:23:55 executing program 3: 05:23:56 executing program 1: 05:23:56 executing program 3: 05:23:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:56 executing program 1: [ 763.349274][ T26] audit: type=1804 audit(1574141036.625:508): pid=23974 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/433/file0" dev="sda1" ino=16545 res=1 05:23:56 executing program 3: [ 763.428812][ T26] audit: type=1800 audit(1574141036.665:509): pid=23974 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16545 res=0 05:23:57 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x102000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:57 executing program 1: 05:23:57 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:57 executing program 3: 05:23:57 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xf60f0000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:57 executing program 3: 05:23:57 executing program 1: 05:23:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:57 executing program 1: 05:23:57 executing program 3: 05:23:57 executing program 1: 05:23:57 executing program 3: [ 764.731698][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 764.731772][ T26] audit: type=1804 audit(1574141038.005:512): pid=24001 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/424/file0/file0" dev="sda1" ino=16849 res=1 [ 764.851067][ T26] audit: type=1800 audit(1574141038.005:513): pid=24001 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=16849 res=0 [ 764.939876][ T26] audit: type=1804 audit(1574141038.005:514): pid=24008 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/424/file0/file0" dev="sda1" ino=16849 res=1 [ 764.968058][ T26] audit: type=1804 audit(1574141038.195:515): pid=24034 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/434/file0/file0" dev="sda1" ino=17128 res=1 [ 765.006469][ T26] audit: type=1800 audit(1574141038.195:516): pid=24034 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17128 res=0 [ 765.029521][ T26] audit: type=1804 audit(1574141038.205:517): pid=24036 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/434/file0/file0" dev="sda1" ino=17128 res=1 05:23:58 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x103000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:58 executing program 1: 05:23:58 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xff0f0000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:58 executing program 3: 05:23:58 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:58 executing program 1: 05:23:58 executing program 3: 05:23:58 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:58 executing program 1: 05:23:58 executing program 3: 05:23:59 executing program 1: 05:23:59 executing program 3: [ 766.194632][ T26] audit: type=1804 audit(1574141039.465:518): pid=24056 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/435/file0/file0" dev="loop4" ino=635 res=1 [ 766.296693][ T26] audit: type=1804 audit(1574141039.475:519): pid=24064 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/435/file0/file0" dev="loop4" ino=635 res=1 [ 766.375240][ T26] audit: type=1800 audit(1574141039.515:520): pid=24065 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="sda1" ino=17131 res=0 05:23:59 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x103f00, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:59 executing program 1: 05:23:59 executing program 3: 05:23:59 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:59 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xffff1f00, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:23:59 executing program 1: 05:24:00 executing program 3: 05:24:00 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:00 executing program 1: 05:24:00 executing program 3: 05:24:00 executing program 1: 05:24:00 executing program 3: [ 767.625223][ T26] audit: type=1804 audit(1574141040.895:521): pid=24117 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/426/file0/file0" dev="sda1" ino=17144 res=1 05:24:01 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x104000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:01 executing program 1: 05:24:01 executing program 3: 05:24:01 executing program 2: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:01 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0xffffff0f, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:01 executing program 3: 05:24:01 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$midi(0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000000)={0x2, 0x2, [@local, @random="1484883fd015"]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 768.419776][T24172] picdev_read: 56 callbacks suppressed [ 768.419794][T24172] kvm: pic: non byte read [ 768.480613][T24172] picdev_write: 55 callbacks suppressed [ 768.480627][T24172] kvm: pic: non byte write [ 768.509134][T24172] kvm: pic: non byte read [ 768.519484][T24172] kvm: pic: non byte write [ 768.528226][T24172] kvm: pic: non byte read [ 768.533207][T24172] kvm: pic: non byte write [ 768.539235][T24172] kvm: pic: non byte read [ 768.543901][T24172] kvm: pic: non byte write [ 768.550509][T24172] kvm: pic: non byte read [ 768.555323][T24172] kvm: pic: non byte write [ 768.564732][T24172] kvm: pic: non byte read [ 768.569787][T24172] kvm: pic: non byte write [ 768.575596][T24172] kvm: pic: non byte read [ 768.583988][T24172] kvm: pic: non byte write [ 768.628127][T24172] kvm: pic: non byte read [ 768.652894][T24172] kvm: pic: non byte write [ 768.671449][T24172] kvm: pic: non byte read [ 768.676232][T24172] kvm: pic: non byte write [ 768.705162][T24172] kvm: pic: non byte read [ 768.725679][T24172] kvm: pic: non byte write 05:24:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:02 executing program 3: r0 = socket(0x10, 0x80002, 0x0) socket(0x0, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r1 = getpid() sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) tkill(r1, 0x9) socket$inet6(0x10, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040aeee, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) semget$private(0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c0000006400010700"/20, @ANYRES32, @ANYBLOB="080080"], 0x2c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x332, 0x0) 05:24:02 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000100)=ANY=[@ANYBLOB="070000000000000002000000000b3900e300eb06001c00000000000000335464f71ec81b6a2e9c455a57dd2c21294369314538d3e6a0fcb64544f402c790c99e52941502f41c7944b0266751200000004000000081457f47495e424bdf4aa02db521010100006c6dc20f75c979d6c893d3ff0f000000000000cab49a7e9b9d3c4e0925a9ed2720d386d257413da9844a1cdbb32a990908000000a6b7a7b6b9a525cb8916eef6b4620655d76877fd8637"]) 05:24:02 executing program 2: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:02 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x105000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:02 executing program 1: perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000003c0), 0x6}, 0x0, 0x4000000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)="e68f17fae199a208ab2ba86743006ecfcea4dd852d69581e13d7af68119a177143c60dfa10fb3647d0f9ee9528640933c8514e6a2cbcefda643c1d611c469c9af2a242e0643d11877f7172c41cd773132274eaea3399fc769a913446781d1bdc23eabb4ff4a9d776bae6bbc5847fb212c57be53ff691b75322ad377be6b43f5d17ff4498ca01da78ab58231341710407bfc8ec7692bfe38f139943c95b464074153ecbc496bb5b68116742198b50025e2971cc20ce1c2a187e359f0a0197dad723e245b4cb2a874a2dd6e1", 0xcb}, {&(0x7f00000001c0)="e438367eda39f30ed248c0fd224fb22d3649c0af0370441e92d28fe9de74ce74899e1dd82fa0e4448ce1086d8c3eb99f337dbfb3e82f38aaceebdd3274bbf699f8b23e1c", 0x44}, {&(0x7f0000000240)="97a954849b742263a8903a632646064d023fe4ba01aafd0ef142e7bdb2c655db250f85121cae971fe3ec3c063779a7578a360e51a37eaab7cfce8e8fd70c21b7e7732a03baaada", 0x47}, {&(0x7f00000002c0)="d706b47c52e15a93e5f2f0ed0dcc75622f34610cb9290534dc85f226b670665af0dfe060eba4bb333df462b3ad46aead13073facc7bd920337afb6f35ee969357e7e3bb0e40413b6f429afde2b57a15eeb6bec6d4ddc7be7d829860f21d6ea0f9282b92a7b6e71853b6dbc8b6e72b09305c59f841f9507b1461b8812c416a80f5a5fb0bbe5e0c3db548b11368cd8d23c6b9ca7c9a3a99ad4d113c50e", 0x9c}], 0x4}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1, &(0x7f00000004c0)='\x00'}, 0x30) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.stet\x00', 0x26e1, 0x0) r4 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x3e, &(0x7f00000002c0)=r3, 0x161) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f1, &(0x7f0000000580)='ip6_vti0\x00') r5 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={r6, r5, 0x0, 0x1, &(0x7f0000000040)='\x00'}, 0x30) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x2000, 0x2, 0x0, 0x7, 0x0, 0x0, 0x3}, r6, 0x0, 0xffffffffffffffff, 0x2) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.stet\x00', 0x26e1, 0x0) r8 = socket$kcm(0x2, 0x1000000000000002, 0x0) socketpair(0x4, 0x3, 0x3f, &(0x7f0000001a40)={0xffffffffffffffff}) sendmsg$kcm(r9, &(0x7f0000003200)={0x0, 0x0, &(0x7f0000002d80)=[{&(0x7f0000002b40)="be1ea9616430158f4004eb4d425e814c46161f40ec1ac0421ba41dbe11455869b12b465591a84e14b2bb2c47077504d47622bb649a749762cc", 0x39}, {&(0x7f0000002b80)="716bde73ec6fb5fc7319df36a13b3d983599", 0x12}, {&(0x7f0000002bc0)="7221414b2053be02a2af15d940ab1c420bf62771d4a1f65602e954056e75083c6ad4d747e6421b7f9f2b77f44484fa71daf6a40e9efa2253b69dafb6ca117f88f3428024153538da0b256c66e65732d4902d635ae4d1e54f5ef402eb50e8a172243773afd33445988c8430e1933b4590a8de4f9313eaeccf1689109ef9f494782bd5a9371547d1971d31c0ef648ffe4e7fa24cf1c15c8495de98e2814217fcdb19bedee456fc3997c32c76503b73ad01b6224ac61dd62ed0c44ba01c21359dd442ff2134bd39548078062af4c033341d63ba41d7cfdc9a0f7016", 0xda}, {&(0x7f0000002cc0)="9c31c85ccf8503b7792067c6f39d7f7096db0323749bfacbb6addac9e95909139ab0f1dcd5688abd3d1ba5275b5e64684d0c2848a3d9c4d45c359a9127575ac18832986abcd967c92e0403d936c072723bbebaa4ace93196e7b3c6127655289dc25935641ef43e57ab101ed0ed4dea2474750b4ea8aac640a27ada9e4e8f820b59a8f07175b7c131001c392ca993e992369e54dc", 0x94}], 0x4, &(0x7f0000002dc0)=[{0xd0, 0x86, 0x7f, "a4360618702bdb35b91726ce8905d2635d49db22449a5c0f1dc6eec33b16a2d8f494196c93d244736f1a71422c53f26d989850bc64e0423135a550f4867b2dc701b4f8fcae4dc821f329536483bf1b3a5ba386f18d8b85bd9331f992243724a5af6def68d206390d44acba8f50dd6a5a6c7b2da9aa65195da1dd955904f78f7df05e5ea7cd824bd86253f14c59ce9a3e3a999f4c7e2091759ebde5b59323488990f4841677d9b84f389cb32a395ddec04e82b5dee0bf2f203e367746b2e17509"}, {0xd0, 0x105, 0x5, "0611aec9ea61920d1d8e4d4c5c6822e72b234fe72d8ff4ca19fea41d89b427d02d289cb3e698e78b6327561f2380ae015f9a730929b410cabb58ad3225b167c82228328d050ecf4230286b26c98bec8429a6577d485387727f14fc50bfc976041e2197cb440532d865febcf1c6465ebf0312b4518a651d6bcc9655f1657313c9e096842e597c5b149fe4ccc5d7d9bfed1ee8dcaf94c47171eb5788aabc46adf8c1f8e0a4d9709770c974feb09e1b8e86c4b76b699b493ec37766416e9190aedd"}, {0xa0, 0x10f, 0x4, "7791cdebf483888f219ccebc73f8d2f3cdf727bb6a5ef019d3f7dd89615fd11f26e7f00c73cc39e4f2962c64c405fcd545a7b3cda0aecd524ad6551004121476d47d46f32efb5bb7028b9f53eb4f4b393474a8bacc8b34384c988b0654c9264f993644e10ee8585fc0076fc000b1b9672a3056e3f3213d1e5417b512e5a7b16e1fbfa97ad9058a7c5d96acfa4c"}, {0xb8, 0x11, 0xb25, "26f21ac715faee9b9e4f4b825dc6110941fbc763d98238e89a5a30f1f6a167911a6ede5a995f908f64e811418994a6eeeffeb3612d0f10a8fb90f1e6bca7eeaf12f20e4d932ff1e5bada0d9bbbfc0f827cce04b0dc5d4642230e3600c8f10a5dd733e18f80dc4684a0c735fed1d6be88821a8e3d09e3db40b2c11548e80c4f3dd6295ff9e9607e53b4baec63f01450f89c8cf751c7a3255ff534b92d5c8ac25df199e0f1af"}, {0x98, 0x30b, 0x56, "9dcad9ec8a9cc959c5e94677b240c85b94211bfad9df9d2851857d7dc21392bc9fc7bd42b5909a275951941a6a68f0ffca21fc70aea165cbbae3913be016394548f73f076ab53b8ea3a436fea1344786df341bbc34c6b917774fc61f78aaf979f8a129862a8a30a15b69495c8f8b69aa90462b389ab34692b541ccb13369bc22acfcbe41e389"}, {0x38, 0x116, 0x5, "370399648e618f80b0af30de2bbc53c85388afa76aae994f0d8982ce39137d4295c3f49fae"}, {0x68, 0x113, 0x4, "051804dd2f2d21d5a9b21971ae3331c5bbe402489b4a50720a3b9962b3ae5cd0b9296934fdc1c6c653c47b83ba7ee5c7f45da6305d5857f015ccefb232fb78638c63b49853a3f03172c50b4a2ccfaf6a51545a3dd1"}], 0x430}, 0x8000) setsockopt$sock_attach_bpf(r8, 0x1, 0x3e, &(0x7f00000002c0)=r7, 0x161) r10 = socket$kcm(0xa, 0x2, 0x11) sendmsg$kcm(r10, &(0x7f00000001c0)={&(0x7f0000000100)=@in6={0xa, 0x4e22, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x10}}}, 0x80, 0x0}, 0x0) sendmsg$kcm(r10, &(0x7f0000002b00)={&(0x7f0000000640)=@generic={0x11, "d45ca3dcaf868d18e5926c18c0a28435ff7d654238061efa456e3699fee3177ccd7ffab171965418b72d4783530833f315d09ffc673a9cb36c37b0eb1eba49e06b6979f0cc8f6f11a88d66712d2b7e0824ee2558b162bce3303db071a3bc91ea1c28cb437841b970df98ad138ff231b4b1deaa470367444f97a97c66c287"}, 0x80, &(0x7f0000002a80)=[{&(0x7f00000006c0)="d5b045d14037fe2eed5f29019bc28bbf4c163b7abc9b100242c2afa12a95f5c348444b11eb71fb0bee937c6ac3861e486083f0aba1681ae653d31e3c4cfd50292a4897ee23278df2", 0x48}, {&(0x7f0000000780)="36060cc258fb039e289b7b15e5f8eac247be5ca87f4d894d0f648fe32b9715c52b3bf0d3abde6994594573f04e09881d96c6e9befbb0024a9837d687586306c124340dca8fe678178c189daa29d81ad4a30cab5ee75576a5d760c64fcf427f40266ed7fdcb343220ebf7eaf69c0fd6b316e8b99ee005bed1db8cf17a92adcbbd9af4222fd8aaa8ea1850619dec1e309d14501e02693de31729a2f60a7663f152b81eaf71e13abf75e110da9648864b3205e15ef620d85fc246b0891966ec0549ea45a52c22d23bdc263b5bed75a5640744e0", 0xd2}, {&(0x7f0000000880)="3c66c57d8ebdc8f903abc685c4477a1fecc6f996892c5c06db17f573513fe4029ee3cf987834832f5e84ec369c5f763c7f55fb22353558fd229d322443602a5a4b6de7dd4153e9216c8075325bb2d59b7e90a46a0ba821b1a2f0452e040cd86397785ffe355780486e8b7fd6e2af875521d14b284a75898c78928a43d87c8b0ce25db4427f030938762517e8c7609dc539a14afc372c6cca3a5f5aed06268c6b6725c2629f17efb0316d462b63c6a974792312028e9841051d1d8be16f51c60b88313502fde2cdb5acc0b5d213ce8445a14402116f102ca4744608ce859ea92253d1148d983e211a9b8f7e251ab2fdf28712fc75b2e73a0585a74f2a55af1f1dee62abedcec9c25fa2d0e30f69cedceb629f23a9aecb6d399dc03db0a2ed13bd972d80697522d96f96cd48aa2430ea2b0506281f3022b1e9f2e6316faae9a74cecc5263b5a3363455d4c9ecee7ce20777086e8a47851562ce41c21a0c850761ddfcaa290db06b40f451f5b09b4235438e6882301664f3ed31c8cc8cbd333d8b19eb9c06e4fd76762484bc890509bd58710818550bd95e90222386dd5446fe0eb4f86b0ae8b1a5804df008b95dedad26ad5fb7f07d69065f8394e030d1421c25976c4bc49d815f1a50cde42c0ef39e1ac849fbd4da0a70ca6d08164c27d71b6d9bb461b62d8bfdf6f23b56d77a58269de5474bd0c778fda31f04fa667dfb99202b159ed88672c79e7d04341444c8588cac5d97afb4e6cb5e09040e5342e6c381ace79c9c69fb942d02bef785c6013cf4e7d0c0f91430c6b60bbc8d22a081b50c28bc84cd8a84a899def3cd07715d70c7a88c8eb629648a909aa64907e85797f5dde36037661414b5ad8aaa1e6e7437062e4d8602bbd380d90273a92ad499925f31cb6209c35e97f9d5808c2642a4a6f570699dcf5a3a7d589ff7b6f0bf17af620f5f75ec7a4a7b65582986bc9871a0b5e7bf4f0bb57acccfbf5242e8fa2b63d6ae334fab55f56d9d484b825e6bc9b77e42ac2ec07be61a1693796221b3c7a46c40a38e23d51a9df82cbe7692b221b37ef7a0642528f45891acf7da2739d31eed00416d75c2467400c9e377a0a2e892d0b26c35b7c21a83297055c25b096129110fbfbdc77de1c2162a04612f802b2b1d95ed18a38d6cc5db71734bdfefa0a35221f9299a8cf652607f03aeeeddc060ed8d5873effc0e24f0f443f66262635f5fbdc33b5ba2c58a84cda8d74fa4d6264e1fc01dfb242ce7be91a155b44d3fa0007906441d64e96a7a35d70e5b7dd33c52bf944d551bee6d3728389786d4ed1975c1c2dd5372907ed32d69d4a56da11f266a6dd9bd718fad39a71a438331afd38eb291d85ccc20cbc111a502de3b3f6ef24f2063560059d2af5614d83f819954c169eeb303bde25c4eab4002772b6120156458f89a0d23aac02bb39bcae9b030686762bb5ce6de849681a5a12804e709cc3cc831eadec8a60795ba2458e2cf0e2a3cfe30c3491124e3e75471c14ea77bf15b0b9497c1eeac3f2e40508906ab88c6d20793462f7b63c806c84ab638063e98a96dc9e1137aa96175696a1cda66e09bf32c210a52c3aca20528583b3abafffbad4562f0426e139398cbfc1a266857c325ac5c77e6b849fa7d89371bc57a2487e149ff585e2b9f6636c309aedd22ef651f3461d7e9b4883c3af53018e455b4c202508906c80d3119797671cd0cf596ed09daa54fc196455ac45138a20768a601cc489494204d09ce34cadfe767dd8ea0bda13a36b4a843a82fd24b1ad4389ed53b07be1d4e3b4afc366230c19edac32f74ea4562d4888902e9a270244c9a662817a67e70d7b39e33f8d49eab4368bda80f8c7397e04c55ee4318089012aa3d40d66bbeaca96337c85d59762598f303bc94e93f69a26fe6d8fda4e302baca1a8077363ccc3a781d00bfe0ef849956f34eda16d39c27977b6354ed1a1cf57d37a30828d3e324e5ed1cf7c77361ac63cc0fbb6b0ce0d214844d97f9fb8c455175fdb04e4fe9e4bc83bb6db96916cc68dc56810ae47c5eb08c0e69d5a1e77f4e106cbd93146dd61eb57c703167a28c33a562854dbc2bcc5291fec250b616932333a6bd27c5c97cb944d6fc1a0575d1a7791f081065f97d8ac74fa533164dbaa4304e450b06462511ef7be0c7692007fdae60a8185b20adcd0e78561b07ae62ae013d8d5e97b6f281b2302d2d35b1c4201918b9fff33a919374bfe90ba2c9dab26afcc862d273e1c2fbbc031b579a29777b972f997f7c9f05a1d3085fd0a196c90868159d733c8d5d20029c897fccc2eb2281e32293139abf1e9eb66118f46b932320171c01b264cd9f111d79360cdc03a774a138fc2d0449d9d4616998c2091865270b4ff2dedf8e43a28df882f227de1847f543847f6548749a73b87fa12cfaf185c45afbf7f6f811f167d3e28c4e5fda0388ee9d772172b0ba94d87c925d7c2f52b7f83e0e99efe62ababe7adc8efaf6695319afbc71b6b3b2603335caf0063f6a68f768b4150cf0fe02aed1f3709a094f82b6d2e00aad5e2a7120d04d75bcbfb0b1311f132dded687eec7e80494099b0b0822ae695d37dc868155df3d2a6a21e5515e842387ab51a98ac8e31aa7696318adf299972c357b1b9e5e363bc2c85cb69edda6bdb7da01e84549116f7c59e88d425b0057b5066019b50cadbc6739134a2851936ac728f31763450c6c6d293b22bc8aa3e20ecabbe239261958a719447dd06fd5a5803c12273de78f31b50cc4fa003aa9a53eb667314760fb3dcc325e8f8e321fbef77259248b634d08f81049db9ca7e7139f626b76de81e0e7f97602d23c6cd1b26d0e8fa882183a1906197bdabdc4d900131e2d8e14a63ab02df4f8b6a7930384690572217bc959f233dc5cb0754d73c764910b6ac3b48641319106c6e2a714a8fec019de5bd8c35c711b1f44fe6d5ceb75cfcda8e894ee8b37d7a04832ddfc1b12921ed89086dbb0e4a38939f5b747f1ae4eeb06dc9106adbed7a7a823a448bea91ba15be2f77e4e397128f4cefa0e448ac64268034cf7841d7d9775dbea1202d977368d46fabe71ec7051cd4a2b9c34fe3be8ec13161ee72ec82603859f0e85a4fa76cf0d80b032c022b074074fdc64bb221f2a870e8925facd74da97837727026eb8f3bab73dce28eeb431a21155aa7e16111f959467b8ac1b4060e79e5a4be12e8378f0148ecceb90faa41b3889d60c36e2f1021aea33216b30871ab093a89e56b0ab76a7a8529e464cee0a2c1268dcddafe5d9eb6a86fd3552110b61456abf8692734eb630d4a11ba49fa5701e362baf8abeb6d87b10d8a06dd74d2c6bf6cb5bea885753716d763e30f361d28a7dc1c6547f0bc651cbb7140de2315e7b6d0eaf4cfda5ae948747c8272a6ef694436c0746227cc344e3faf931da25de1d3c23614e313feb518b8da888af987a436f4aa5fdc7d31637d8ec1e55a31bce5f13d05fe563a4f630b64081e0c3f62f263acb1016051d43cc830b1cd95f51be0d944ebd1a5473a87e058fd34ab735a7db2c3d72787e00687394f73c38ec93457c2cd3712d8454a1f0d4d1e73e0ceb9b7059069d10bc9f097d25d6301edb03f0de0a122e6e10e8914c9f4ff66540c1c465d26ef598081c71d56494ecc5db2019eb09eb36022b5926e462973700eeb8f284d4dd1afd70f52fae3a5aa3fde0fc87328b44bb580cd6e0e1713a548b2b9c163c8f04f8da0f2e9213af627ee4d8966566e37333e7c03865c885a803d4733fa515e00e1a0a00a23bffd6184e9f09d173af931385d591fb402fc60f1a3e204782c982fbf10a36c61e7689533df0bb7d94856601597e9e4ebec71c7c65484b6a63cffd52cb56b204bb93ef8df83a04783eeddf466c7bf8fc8b81f604241198495002985a91251da16b3c8b83174926a147aaa4a373ffbf68ceea5015490973182f7a7a58bc5d30aa63892facf7eac39bfa2125538d6c2e4d5f4c4d5886b4262ae055893c3148e52f61b7475cb4d0fcd438eb683127f952cf4a300e53592e77ec75c469100c4597bfb0df907de7a7f87d134e66035093fd8573ec99db45580919766d4ec227ac5a27b12402ec7aeba5ec2fcecae5c5a450a6d6f4a1e5af5cff04b8de33c11329c1aba2ecb5bafa24efe4751fd576909d58c6e31090e1ccde3489ffa9cb329e348c6a7650f8667ce17b4cb37984eed679619a477bfcc79431629df802573c55c88a64907a7e308a5789a9e5c0ceac9fb90c509942dbb7a522990b1c8249d69c8ee8cc417f8cef360e4776669c25f9a8c254f8f2e6ba340bb6e190f4b6e55a913bd2d59097c66e6afc254167335aca4e200236db29d9a18dcbe0f2b224ec456982796209d2475a21d605d43874a4464695bc9d9d77371aa77c0694af6528daa995f9cb32ef374a9c35b1bd689297ea3d80aa39b095a177abf49383fd7c5503240d32f6f2a9c2d9ea106bf9e7808f6d204884fb6440740941bbad6a41f23dc07dcdb0c28c4b998eab8a8d08ffb2c969c33e72e8900583fccbe8edd26959ecf074018278651d6b44dfadcacbbc7aee869aab1b7d5bf79b5cf1a87d9179328e7dc8e5a803ade6de6bbc7cd7c7f4eb758b242600e02d262282150d973ecfd5ded8b6a05b48506f6b2a46bef40caaaf95dfbc3e8a38ec077e972d5645ca3fe9882703df98636f8c49f834c72476265ab83ec93f8a819cbd143bb6b666890164961620f024bddacab7c1eb92441fd0917b58b1628f04f40fe66b7bca2f65d6c0df356b544717ca28fa4e63ce1d5e4f54089cda68feb8a592f470440f5de127d2fb54377e3b0db2d032a9627f808db512dfd26f424a82333ff2598e104b5c5f70ccc0b61577f6a2abad28da4e9fe655ba2355b9c08d0b028a9ee2bd2376f2cd68d2c5bf5afe33c820837b94b4660120df6d4d84619706650ee8a0acd8b741290b3d1622e4c2cca16ed406389784ad6044184422199c7ef84fdc8dc8ab7180a628bc98b4e5d1b3cce2e11cb6f4e21c4e954c6f660f774e58f15127f88b38e3b675e2340438990089e47dfb88a8a30943c4d86ea06569dfdf5c53de3997552c887d971e0753942b0c1aedae9330505c59c00135cf3d50cdf0b6726cf4749d50a22a6817e7aa2ec07470ef1c79b33086020cca7807b05d4a0e845cf605456f121524bea9d8ad3e8f507bf16f7c7940b52482ad398449a506378c81c065436242b291583954e8b454647a9a243f93f473d0f3c7036662a3156de9c654a4e0e34f4b7e94dcebb39bcfea39d53b187ed0df85654310565984bec969a82f602848538d75d2815ab75889b037d8d2c118d2aed1a8786d6eb7e0271d156825c1d5f1c6af9e049611d2ec18ba81de880845b471436f927fd727de61b940dfad05a4d75b663b85b060f887ec5bb44620c5c346e56ea4fc7cdf2fb5f4f825316f94063a2c4bc2429154486907c6bdc8004b016f5a180e08bb440833b1412ead02ac2a7f202228a8b7e62a75a13d5bd0c91bf88147f047fa244661d31ad7f3081c72cf8d707f8a23ce479013ccc6488c91cd39cb857cdd6387e9533edb4c74b7b815e2f25219ba98de29a9078fc0ef5e6d52b96332d43dea199be3eda8544ae615ee5ef9cb34a0392267ad8a7d3e68382a12b24f22a3541b6f45da6c3152eeba193a665008b270c98a9e8157478efc131a9ee0b5fd765d5841d3a5399bc9b28156f30c65221f9e692e72d6ae82d2ca3e426451bc4780d2e3ce66aeedeea359749bab8f3881da162541dad55b96923cbc74516ba6082ac3891a21f80efceb4464e3097d146", 0x1000}, {&(0x7f0000001880)="b2f6191ec5753cc2b69f718a3aa60641664bae0c76157934b80abcc920582c496bda115bc00a4324b64079e36bdc56e981ec75d68ce928e83d95444dc47cde27c0e5cdf626cff45ee90b515c8c14557f8c423b17ff3291a26b6291266440303fb6adb7d7e3af63a134af8763f5c122af0680b7a670836434c52e1e00a056d4c45c1b3cab4521943576fc92ee4fbd7ff1840e2c4e789019b6e3d7f71d45457520de41c8469ccbd544e36828b2b748b6fba4dc433879ed410bc885e012", 0xbc}, {&(0x7f0000001940)="e86bd2a87f99e1653d6b0fae7703625d6a1cf8125ec1c6ca91ed33347a107c615afcf71f26ec81878848d0a7c5ebde71d368b9b5f8425004a6c2cac99cf337e0d54d3c17a81cf24c42735fbdc1bf618690929d741c9097cbbf1fd3ff8ef533874fa284796f981f3362b53c6503dd56515447dd58f87755183df4108dee9ace95b2f09174f39c482d8af49ac9b3a4afcca5f5b2e12d46a8220b582a6ff32049397e95d1c9cc946b0e12a71b7887c7e420bcf3f731f3ecf59933ccf7567965184cae2d692711ba464071c584b73380a4d67608c3386d58c55215fda2f569f64860bbd5fd10681bdd18e2d2b773b0", 0xed}, {&(0x7f0000001a40)}, {&(0x7f0000001a80)="74b6fa631650c541984dd453f243dd3f6cbb3587e328e1f31b13407a678e8229108204de8fc79b51fe4b2b4d66f09197d0ba32a8494c33195727a446bd184f5a9ee33b1a6d291cef35a75113eb097c50cf2a7132123550b0d52873580d65f28790b164b71a62b1a32610e3b9481878c0085c4abd3ab0e565efc3060261c4350c72575acdb67d1c6d2fed217fb8a671f43312619b21df830acbee7147072654101163c2518e7cbb8b6b10b2ae6b7e9b0fd1a7a2836bd8abcab4a99a268a9fca43dd3fe10ea0c61c63e498dff42e8b970453f1fd2f1a4f7345dbc255bc01cd9aa340b4fbe22e7e0609d27caf5ecc975cd6ba5e3c4d243b214efe827e4bc8edfe1115109bad80834564ddd8f0a552d25a564b57655d044a004ca48e0ff702f8c394e6dc3f99bba856fff3bb6a143ec4aabfd456a3991305c42e3f4e08aa3eeafebde5494a4c5e2d232b369d6c19669c5918a13aae115f509245a2ecf0070e90e5c0894817b23edaba30c30cb1614178379a072a92caf58671601b2972412364118b1fca23144e28e31adf0040685d5ebb55335fd9e156ff4dc3331bcc9252216027ec76626641e3a94da7be25511c54626cb82d560e9301db784d2a72393efe1c102b623e6e428bacaa58aadd21762d2443b3765e157055028267c2ee31497569effcca47156c0e6001347591ea6ff15e0f97dcfc286d2218cfbd762b7b03c24a3d0300065f587c6591411fcbb7ca5ebec7dda97ba9bf279fbdeba5bd106145ca8c49374dfe91d14257c60aa65ca53062eba6a0237f0a802d0e327360418a4787e22c2c1bf5af11a8b9983697686614e80f260026622e31e497dbabb088c60510cece9c9dc56224912a93763fe24becd0527cbecffada1fcdd644048618f0c4a1481c0c08229291d770ab4777d932b5fce24552726d6182423b418446fd80acb959386f7a460b73ee836b842fb89ccf712f515da8759b92937f751a1733b60fdcf31e1de5717045a5018930e4ba52b7be256d751f791e27f09c6d5fac3fe5ab39969a0d4415938cc332708841a7d7ba6a9d015e6568f5ef192befa5bc9810c4017073592e8ba528ae84e0702596fa9fd11be4a583723703461a3bdb46565794a19c07bfb71b70db8a8456ca99ec9cf84a1d7e4766674e05161d191bc7a72a40d3a2a0a28251fd108a008ae2d22dd8e71d4241697a3f31d05fa63b168160556425fd1fc1ada6e67395c270cc50035b215b5b2633faa20f627136b9a36d42db0f81b62fbb588ba3311fc091af18c4dd9a83759ec0a51c2856bf17beb3f2b6c33173e12b909ed19b84ad79d9ad9dad9adac45a93e780d9969db8916f5c8c3d48828ffb78680fe74f56c2578b277c59abeea9e41db0e8daf7e1a5c12bfb72081f6342def0908a6ea10141d09daec8099ea1016df574ef9a14e050f64d3d1b94c837e1561464c5a74b9f3cc0ea15f7d9ec7331ba9ec967c18d80a1fbae52a9639416b0fd7e2314c6fde4ad9fc418fdbc837bd8551265d42871735ef14645fbe26106e747e7c55cd275ae064a92aa063799884f6b7f9dcbf07316e04877b55dd6ef2224214348c8d3bb9762a0c607cd4cbe142c02a79b6b6dcd853180672dddb14825aea59273318b7351ba37415fff13723dfb2857523b630cd03f5234f2f0a30b657cb0a2bab6542dd00f574d561b58cbab4099e252f3cc02801c8924893564b3aaa892f731ace2fe27c84c07af3ed82a19d40bb94863ea061c2c075b11406c1d4c37c6f026d37a6ccf515008a3d5a4bd1b46873063feebf0e43d8354e3ac49b557fb39dc6fbafa0e0363bc7b7df5b7633a6732b4bcd9603adf1eb2db0148aee8c9674fd8833ad80733822a2c930dfc1b533c1d739d9c32eded801bff7058e368bd117363577a67b434a5cf7a87edd39dcca4e9a64d2e52c28fd9f6f04f4317fc9bf9c3c4ad287018229ac1b89c4c5875c13e09c6c6ba00d602b29d7c0c5d25e060b033c25fb6db485809874b011979aa93422cecf8db80908a6ed4530907295346e09bcad9a4397496d1ca34061fc88a29a7bd1a1df9e7258c774b6dcfb671bdf1a95f5b90f9d94098428d55758d91860f05cec5f1d4bc456f5e81ef75f219e8abcf04c712d3061b25ddbeb674d61d06a1c2d5869642fbd12be61003fb5998d530fd7118ce349a709d5e1630f19146237ab28f215c495098c694d31808bb3e39f335df9bc3a328b7fc37a9da575bf39d92ad8400c05e32b9acf5ae269f9b2c605d322caefd0b3e342fbe1dc9c77af684692a07e753f28f48052bf30c951cb60b7e22b84d6bf579f1ff4fc40be729308b2d55978c2c6fb6f0ba1d49146200e16f25bebc2cdb8cb7e484a277b67ac9e0a0b9b5c3999687284fa74a50cd47e47b8092da2af149cb512e97d4017f5a40a1b2a3b25f3895ca184f54df487f92dc0feaaf4aea05e2f0b57f882d3d523b1c7585eaf451fac7fdc75f7219a9bb3227d5b634b49842f77c470dffa79fe1ee886556e3d326570275dfd75b7712b1a617e182835265903ceb6fcbe08334671f54244415cae0c40b9b371a8d2682a0665645f0cc0ca9c0cd3f477860129b8356e0e5570effef28feaeaa45e40492bb1ac47840d4589eaad33bcb010bfcfe51fb435848a6e5628face8fb2271b2120176102f4d7fa30777a14e0092abc1a670014d80f072b1d67427cc2f590fb22ac6549611f9f27d2d1bc70476ea73e44adc215e1b34ab433159c80d7aa565a0a1e80e5d319db22c191b14fe3c5df476c4d8ba1a8148247b80771f9b8ee0088dc450c2713d3cab66760d6105e23ae91697e4ccea52d028b811b1c0e3c7b83126aa4aaf61fdd5361db6b1b1a2461f69fa64aad4acd168f861a0901d770dd17cd3fba9e818dbac367e9d00fb3be976a825ab18d16ea20a2a416c828a2411fc432bf1041d901215ee752570bde4dccf5c1a7bf82df7dc54f69bd29a948984b7d6e20210756fc9902712c601fb05c9cf22a2ba069138cb1a03aade34edce0cf7e81b00f9aa9419894518fd31c44759998087e30493bc34aa000fc463c0f1e6c7267fd9af2b40877326524d9a184f832b90b98c82214833a3a7777dee79fabd22df220be9774ebe7867d7f12f650741aa64836a686205e29bc8ba136c0da3474188e7825af47025006adcc9eb6c998c8d2fcc99ac7af2fc6a9142f2a27c17f69d58332af9e5ad59788fe5e5ec3e77c74b5aa8dc24149001b68bfab74c38daf2ee6ab9c7ac8f502c63432253e95c6ea6a4a67e5255ea89ca7e5e96b732ca138a3e55f1a53ef5e059515515474f7240a3992a817d2d209316fc093f70ec6e85434ee806d5ae1f03ad11098eddca17dc97835e76c3f199dac6ac634d6ac977dbdc24473453601e72bb4e6c683a1b1f5d9aed7a1c82204dcfd82f5325dc08ccfb61e6bf03274a5bd9ad00b7a9cf92a3086a46dac202308f10979573157a4b48c29567302374a7469a8907fc4522512945fbc91fdd73062dd096645ec9679e176129b25d7685e0799253623ecf31b4ba0d36f3022e5784a7756098b24151f0b79bf39b3f5a93ee428bebefe8bf5dbaa7f2026a81a20f4b5701e104bbc03faef9b91d2decfb91eb81452db4e2a515cb4b7537e6642f9182c7109851dec39a7385ea4eaf326bcf14c727c676e4d4a31838ad4d7455edd6712848b1820a66c7073239f8d5bfd4cb2d8e1d694c1abff0218fb4a4ac494cb1aa5af06ca672a91ffb4225ae14575a20ac097486fd2b014e65046052854af34d24cfc07de590d9ebc43f3059dd186b20a0b15fe5c6a479969aeca9cabe003bfb5441382da39b8a44641c27bf4028dcd377a058a0bfa83a1676511292b70aea2a05df11b48cb1db790f1f363ce4e420d61e9b4659dc7c5bfb2be570faaa3a407b199dad3c53710333f2a6a1d55c72dcdd83c52fe887eaffdc6a403bc78454cbdcb436752f926665add7b46515e18c8c8c8699157949dcacf0a4b53b6381b05764f3f064e1f66ef511226f93b6bfcee78986f2ec10032da8af060c11777e7ccb184907c49257b8d77720302e4aa5a77fe6bb1e82c04167ef52067ffa85537d9cf8dfbd90d3f447d10c29fb81a30f6611f940fb8754afc9c5937c69e8ca5593aab00a36d3f3e494e23419788f9fa777ef3143052912d2fbd7285d04e2c9845e96994134c75bef061466041f30f8b2c4d5ea1b57ef49373279545c41b4ab1eb7eccd6c516605040d12038d512e37d9ec5d4b48789b6021f5ecf6986cba23b600674023ee7375ad025963c8264657baae618ad6f24aaef3fd4096d6fb10e8af1f740c6d935dc45c9c654b242dd5a2f7a7c873224ebf7d2bd888b7d71cb02e35be0093b957307ad712434b0705dfeec0f83638dd8643c620c5a0aacc30a586b9ee266c31fb5385c3457e9867a200adb7d90fb95ad5f3b47a1616911f133299cc48b7ca3dbc00867c02a69e4cbf9c27724e0f887a25eb44b6995c9c589e3268073ef893c05094d8337363381866b898fcc062bf7831fc4ad8b937fa6cc7c503f4944d60598bb7ac1c39c2de5a97fdb789582ac3275e9d1476aef636f6b9c4dd41ff7580450bc396bce151749682efc80378d798d6e1d86430065b7708eea4b381cd3a821b09f581f0fae0b036c9c6983c222108f183d33a1a2698f45071f10557f6aab6cc0f20ed4a7d42a5b2feba51118cf3ecacc6341c6d96b3db9c37bf8dace2d2ce5234034c2f065198d60d58941356951f2effb00cf7330e6e3078008a2801734fd58bc2973724f893506e0502f895cca93160e4da6fc221e9d8a26a840282b5c3f0d004861ae0c4ee468429132559d43d645336496329f24b5487231dd8c9b30279de06e1b3acab7f0beb55f236efc77e86ad619706db226a452ade3714c8d9abc63dc45402af31582a9b116bab747b097fdc4cf8140c8bc85d541c503526510a81b732925b47bb2032785cd34352f9b57bcc5f735f8174cdde7f4c455bad29e2ceaad5bdf8123a74f0978e4c2b71fe7d87451bc87cc8223db519934af6d3bb633cb9dfc2402e8d9d138169a4c92de0c50ebc58571fc3d29ee666a9d908fd595f3e13cc38297f9a412dca6e99790a2e1b46ed9425411bfdea0591310f957b96b80da2755d0e5097d69577d0ba38898b4a421f39b69478bacf8e6156b5216da2393c8e254076d50d4616ae45622ccbf6d812b04e305ea3979b0af7b25ed226ed8d9494cd0e5ca674fa503375e4150e019189bda427a6535678b0b1720fe05c5bf97ad93224dd84738a0d45d7951023823480b9f13e6a1941506b5d34deb3623fb9c67f62c8fabbaad788fa7c8e9f45aecc306cfbe92bb8e414bf64e064113be6b9060fa592e6c3ba8d3496174806be6ca114caf4ad77300da73bb69b83e178d258083ef138013ea67dd4b2d11ca32196e2c2dacd557137658357d85eaba43fad25d1d152143871386921d62fac52e09530411677fc3f84f7a22fd27ef066b38d4a243c6e851f21cb33b3cb296d31b783883ce1dc8f84a744e747867c27b0e3405859630c8334d61d6dcd49b2674114594f0070aa92d72ab0a97dd53bf244fe99480c16fc7d37af3b6ea9638cc6b567451b8d45a1c4426a15a47250bd9de5895ed61c4b54dc4b9fe7a6e6b5b36aa5ac058d5a5eb4a1e6fe6e4c2c77cad918c5e77204853f0b1e2f0788d595705a3787a0a30cfcc8c5f2ec06fe5eab175458524827ab374dae95d738f00015571654d9ba6c6668a7ab6d092effb812ce2b11df6a32ded81ef75ca88837434d2146f85c815134543705448d0704", 0x1000}], 0x7}, 0x41080) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={0x0, r7, 0x0, 0xf, &(0x7f00000005c0)='vboxnet0md5sum\x00', 0xffffffffffffffff}, 0x30) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.stet\x00', 0x26e1, 0x0) r12 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r12, 0x1, 0x3e, &(0x7f00000002c0)=r11, 0x161) ioctl$TUNGETVNETHDRSZ(r11, 0x800454d7, &(0x7f0000000540)) r13 = perf_event_open(&(0x7f0000000440)={0x1, 0x70, 0x88, 0x20, 0x40, 0x8, 0x0, 0x8, 0x8, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x3, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8000, 0x0, @perf_bp={&(0x7f0000000400), 0x2}, 0x2070, 0x6, 0x7, 0x4, 0x600000000000000, 0x4, 0x3}, r6, 0xc, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r13, 0x2401, 0x20) 05:24:02 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x2, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:02 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') r2 = gettid() tkill(r2, 0x10010000000035) 05:24:03 executing program 3: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:03 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:03 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:03 executing program 2: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 770.405299][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 770.405390][ T26] audit: type=1804 audit(1574141043.675:526): pid=24242 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/438/file0/file0" dev="sda1" ino=17125 res=1 [ 770.523730][ T26] audit: type=1800 audit(1574141043.675:527): pid=24242 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17125 res=0 [ 770.587062][ T26] audit: type=1804 audit(1574141043.675:528): pid=24243 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/438/file0/file0" dev="sda1" ino=17125 res=1 05:24:04 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x106000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 770.887333][ T26] audit: type=1804 audit(1574141044.165:529): pid=24226 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/428/file0/file0" dev="sda1" ino=17164 res=1 05:24:04 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x3, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:04 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x3000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:04 executing program 2: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:05 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 771.901620][ T26] audit: type=1804 audit(1574141045.175:530): pid=24293 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/429/file0/file0" dev="sda1" ino=17163 res=1 05:24:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0xe00000000000000, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) [ 772.091452][ T26] audit: type=1804 audit(1574141045.265:531): pid=24290 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/439/file0/file0" dev="sda1" ino=17171 res=1 [ 772.229699][ T26] audit: type=1800 audit(1574141045.265:532): pid=24290 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17171 res=0 [ 772.280522][ T26] audit: type=1804 audit(1574141045.295:533): pid=24295 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/439/file0/file0" dev="sda1" ino=17171 res=1 05:24:05 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x4, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:05 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x107000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:05 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f0000000140), &(0x7f00000001c0)) r0 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r0, 0xc7, 0xfd}, &(0x7f0000000640)=ANY=[@ANYBLOB="656e633d6f61657020686173683d6362636d616328626c6f77660000000000000000000000000000000000000000000000000000000000f6ffffff00000000000000000000000000000000000000653cd6185fc439a667a6fe6e7e1e6d71c781fad6796f4fa3bc81ef554c9b41fbe86d32c525fa5e86cf8dae64"], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x1, 0x2) ioctl$DRM_IOCTL_GET_MAP(r2, 0xc0286404, &(0x7f0000000200)={0x0, 0xa1, 0x0, 0x10, &(0x7f0000ffd000/0x2000)=nil, 0x80}) 05:24:06 executing program 2: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:06 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000002, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 773.180736][ T26] audit: type=1804 audit(1574141046.455:534): pid=24334 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/430/file0/file0" dev="loop0" ino=641 res=1 05:24:06 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f0000000140), &(0x7f00000001c0)) r0 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r0, 0xc7, 0xfd}, &(0x7f0000000380)=ANY=[@ANYBLOB="656e633d6f61650400686173683d6362636d616328626c6f77666973682900"/78], &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000100)={0x1ff, 0x4}, 0xc) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x2}, 0x0) 05:24:06 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x5, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 773.653196][ T26] audit: type=1804 audit(1574141046.925:535): pid=24358 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/440/file0/file0" dev="sda1" ino=17165 res=1 05:24:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0x8000000, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:24:07 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x109000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) clock_nanosleep(0xe, 0x0, &(0x7f0000000140)={0x0, r0+30000000}, &(0x7f00000001c0)) r1 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r1, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000200)=0x10001, 0x4) pipe(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) read(r3, &(0x7f0000000640)=""/27, 0xfffffffffffffebd) 05:24:07 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x6, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:07 executing program 2: syz_mount_image$vfat(0x0, &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:07 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000002, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) clock_gettime(0x0, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f0000000140), &(0x7f00000001c0)) r0 = request_key(&(0x7f0000000240)='user\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000300)='system\x00', 0xffffffffffffffff) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000340)={r0, 0xc7, 0xfd}, &(0x7f0000000380)={'enc=', 'oaep', ' hash=', {'cbcmac(blowfish)\x00'}}, &(0x7f0000000440)="60c632fd775628dc0eb55e05877f507cb0c7e1d5f4b91edc20811d34f58fee294081a989015c5bf9ca39fe8e3c64ea886877aab85e5148fb770672ece8c540244d04fc79c6befdc44e9b62d1ab958d6094eac889c746106e3ab88c480aa3655ebffcfc3b9ed26bd93aab9c63780f008bf03ceb8a7ce6d8c48d5e1644a12b1d83a704204a4dfca32b600b0ecdc566562f54e22f8f7c85601c4b1cfd84af5f8681fda1e972f1a5e309f9e6a5427752edf3c12ef1ed3ac2781c740bf9bcd66ed1517293482153fc21", &(0x7f0000000540)=""/253) socket$caif_seqpacket(0x25, 0x5, 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write$FUSE_NOTIFY_DELETE(r2, &(0x7f0000000400)={0x3b, 0x6, 0x0, {0x0, 0x1, 0x12, 0x0, 'usercgroup%\\]{eth0'}}, 0x3b) write(r3, &(0x7f0000000340), 0x41395527) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f0000000100)=0x65c8, 0x4) 05:24:08 executing program 1 (fault-call:3 fault-nth:0): mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:08 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:08 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10a000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 775.370776][T24433] FAULT_INJECTION: forcing a failure. [ 775.370776][T24433] name failslab, interval 1, probability 0, space 0, times 0 [ 775.476880][T24433] CPU: 1 PID: 24433 Comm: syz-executor.1 Not tainted 5.4.0-rc7+ #0 [ 775.484812][T24433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 775.494963][T24433] Call Trace: [ 775.498255][T24433] dump_stack+0x11d/0x181 [ 775.502580][T24433] should_fail.cold+0xa/0x1a [ 775.507165][T24433] __should_failslab+0xee/0x130 [ 775.512040][T24433] should_failslab+0x9/0x14 [ 775.516534][T24433] kmem_cache_alloc+0x29/0x5d0 [ 775.521363][T24433] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 775.527249][T24433] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 775.533488][T24433] getname_flags+0x91/0x380 [ 775.538069][T24433] ? __sb_end_write+0xbe/0x100 [ 775.542827][T24433] getname+0x23/0x40 [ 775.546772][T24433] do_sys_open+0x27f/0x4f0 [ 775.551199][T24433] __x64_sys_open+0x55/0x70 [ 775.555801][T24433] do_syscall_64+0xcc/0x370 [ 775.560409][T24433] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 775.566296][T24433] RIP: 0033:0x45a639 [ 775.570186][T24433] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 775.589785][T24433] RSP: 002b:00007fe934f50c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 775.598264][T24433] RAX: ffffffffffffffda RBX: 00007fe934f50c90 RCX: 000000000045a639 [ 775.606225][T24433] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040 [ 775.614190][T24433] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 775.622153][T24433] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe934f516d4 [ 775.630231][T24433] R13: 00000000004fb41f R14: 00000000004dccc0 R15: 0000000000000004 [ 775.639353][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 775.639373][ T26] audit: type=1804 audit(1574141048.915:538): pid=24402 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/432/file0" dev="sda1" ino=16875 res=1 05:24:09 executing program 1 (fault-call:3 fault-nth:1): mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:09 executing program 3: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000002, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:09 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:09 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x7, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 776.028682][T24455] FAULT_INJECTION: forcing a failure. [ 776.028682][T24455] name failslab, interval 1, probability 0, space 0, times 0 [ 776.096031][T24455] CPU: 1 PID: 24455 Comm: syz-executor.1 Not tainted 5.4.0-rc7+ #0 [ 776.104009][T24455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 776.114064][T24455] Call Trace: [ 776.117390][T24455] dump_stack+0x11d/0x181 [ 776.121730][T24455] should_fail.cold+0xa/0x1a [ 776.126359][T24455] __should_failslab+0xee/0x130 [ 776.131218][T24455] should_failslab+0x9/0x14 [ 776.135786][T24455] kmem_cache_alloc+0x29/0x5d0 [ 776.140573][T24455] __alloc_file+0x4d/0x210 [ 776.144994][T24455] alloc_empty_file+0x8f/0x180 [ 776.149766][T24455] path_openat+0x74/0x36e0 [ 776.154182][T24455] ? __rcu_read_unlock+0x66/0x3c0 [ 776.159214][T24455] ? aa_file_perm+0x1f1/0x8a0 [ 776.164085][T24455] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 776.170361][T24455] ? _parse_integer+0x137/0x150 [ 776.175258][T24455] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 776.181217][T24455] ? __read_once_size+0x41/0xe0 [ 776.186085][T24455] do_filp_open+0x11e/0x1b0 [ 776.190641][T24455] ? __check_object_size+0x5f/0x346 [ 776.195850][T24455] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 776.201834][T24455] ? __alloc_fd+0x2ef/0x3b0 [ 776.206404][T24455] do_sys_open+0x3b3/0x4f0 [ 776.210876][T24455] __x64_sys_open+0x55/0x70 [ 776.215391][T24455] do_syscall_64+0xcc/0x370 [ 776.219910][T24455] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 776.225805][T24455] RIP: 0033:0x45a639 [ 776.229760][T24455] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 776.249365][T24455] RSP: 002b:00007fe934f50c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 776.257855][T24455] RAX: ffffffffffffffda RBX: 00007fe934f50c90 RCX: 000000000045a639 [ 776.265853][T24455] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040 [ 776.273827][T24455] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 776.281798][T24455] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe934f516d4 [ 776.289768][T24455] R13: 00000000004fb41f R14: 00000000004dccc0 R15: 0000000000000004 [ 776.413071][ T26] audit: type=1804 audit(1574141049.685:539): pid=24471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/442/file0" dev="sda1" ino=17180 res=1 05:24:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 776.587285][ T26] audit: type=1800 audit(1574141049.685:540): pid=24471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17180 res=0 [ 776.618349][ T26] audit: type=1804 audit(1574141049.685:541): pid=24474 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/442/file0" dev="sda1" ino=17180 res=1 05:24:10 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10b000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 776.908649][ T26] audit: type=1804 audit(1574141050.185:542): pid=24475 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/433/file0/file0" dev="loop0" ino=645 res=1 [ 777.007088][ T26] audit: type=1800 audit(1574141050.215:543): pid=24475 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="file0" dev="loop0" ino=645 res=0 [ 777.063294][ T26] audit: type=1804 audit(1574141050.215:544): pid=24486 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/433/file0/file0" dev="loop0" ino=645 res=1 05:24:10 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x8, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:10 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:10 executing program 1 (fault-call:3 fault-nth:2): mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:10 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) perf_event_open$cgroup(&(0x7f0000000100)={0x5, 0x70, 0x6, 0x40, 0x7, 0x7f, 0x0, 0x0, 0x20010, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8d99, 0x0, @perf_config_ext={0x7834c221, 0x6}, 0x2c, 0x9, 0x7fffffff, 0x5, 0x3, 0x1, 0x2}, r0, 0x9, 0xffffffffffffffff, 0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000200)={{{@in=@dev, @in6}}, {{@in6=@initdev}, 0x0, @in=@multicast2}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) r3 = socket$inet6_sctp(0xa, 0x0, 0x84) setsockopt$inet6_MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000180)={{0xa, 0x4e20, 0x2, @empty, 0x7}, {0xa, 0x4e23, 0x5, @mcast2, 0x800}, 0xffff, [0x0, 0x1, 0x5, 0x6e, 0x7, 0xffffff80, 0x1, 0x9]}, 0x5c) listen(r2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) dup(r4) sendto$inet6(r1, 0x0, 0xfffffffffffffe32, 0x20004004, &(0x7f0000000040)={0xa, 0x20004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000080)="39a110", 0xffffffffffffffc1, 0x40, 0x0, 0xfffffffffffffe5b) r5 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r5, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x1bb) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x66, &(0x7f0000000040)={r6}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000000)={r6, 0x39cf}, 0x8) [ 777.585179][T24517] FAULT_INJECTION: forcing a failure. [ 777.585179][T24517] name failslab, interval 1, probability 0, space 0, times 0 [ 777.637370][T24517] CPU: 1 PID: 24517 Comm: syz-executor.1 Not tainted 5.4.0-rc7+ #0 [ 777.645296][T24517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 777.655347][T24517] Call Trace: [ 777.658679][T24517] dump_stack+0x11d/0x181 [ 777.663071][T24517] should_fail.cold+0xa/0x1a [ 777.667670][T24517] __should_failslab+0xee/0x130 [ 777.672526][T24517] should_failslab+0x9/0x14 [ 777.677132][T24517] kmem_cache_alloc+0x29/0x5d0 [ 777.681947][T24517] ? kmem_cache_alloc+0x1f3/0x5d0 [ 777.686982][T24517] security_file_alloc+0x48/0x110 [ 777.692051][T24517] __alloc_file+0xa3/0x210 [ 777.696475][T24517] alloc_empty_file+0x8f/0x180 [ 777.701338][T24517] path_openat+0x74/0x36e0 [ 777.705754][T24517] ? __rcu_read_unlock+0x66/0x3c0 [ 777.710788][T24517] ? aa_file_perm+0x1f1/0x8a0 [ 777.715467][T24517] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.721903][T24517] ? _parse_integer+0x137/0x150 [ 777.726769][T24517] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 777.732663][T24517] ? __read_once_size+0x41/0xe0 [ 777.737522][T24517] do_filp_open+0x11e/0x1b0 [ 777.742029][T24517] ? __check_object_size+0x5f/0x346 [ 777.747283][T24517] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 777.753237][T24517] ? __alloc_fd+0x2ef/0x3b0 [ 777.757755][T24517] do_sys_open+0x3b3/0x4f0 [ 777.762201][T24517] __x64_sys_open+0x55/0x70 [ 777.766865][T24517] do_syscall_64+0xcc/0x370 [ 777.771378][T24517] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 777.777265][T24517] RIP: 0033:0x45a639 [ 777.781161][T24517] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 777.800823][T24517] RSP: 002b:00007fe934f50c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 777.809245][T24517] RAX: ffffffffffffffda RBX: 00007fe934f50c90 RCX: 000000000045a639 [ 777.817266][T24517] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040 [ 777.825318][T24517] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 777.833289][T24517] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe934f516d4 [ 777.841441][T24517] R13: 00000000004fb41f R14: 00000000004dccc0 R15: 0000000000000004 [ 777.890049][ T26] audit: type=1804 audit(1574141051.165:545): pid=24522 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/443/file0/file0" dev="sda1" ino=17188 res=1 [ 777.965005][ T26] audit: type=1804 audit(1574141051.165:546): pid=24523 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/443/file0/file0" dev="sda1" ino=17188 res=1 [ 778.029839][ T26] audit: type=1800 audit(1574141051.165:547): pid=24522 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17188 res=0 [ 778.169287][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 05:24:11 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10c000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:11 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:11 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x9, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:11 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 778.934014][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 05:24:12 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) perf_event_open$cgroup(&(0x7f0000000100)={0x5, 0x70, 0x6, 0x40, 0x7, 0x7f, 0x0, 0x0, 0x20010, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8d99, 0x0, @perf_config_ext={0x7834c221, 0x6}, 0x2c, 0x9, 0x7fffffff, 0x5, 0x3, 0x1, 0x2}, r0, 0x9, 0xffffffffffffffff, 0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000200)={{{@in=@dev, @in6}}, {{@in6=@initdev}, 0x0, @in=@multicast2}}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) r3 = socket$inet6_sctp(0xa, 0x0, 0x84) setsockopt$inet6_MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f0000000180)={{0xa, 0x4e20, 0x2, @empty, 0x7}, {0xa, 0x4e23, 0x5, @mcast2, 0x800}, 0xffff, [0x0, 0x1, 0x5, 0x6e, 0x7, 0xffffff80, 0x1, 0x9]}, 0x5c) listen(r2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) dup(r4) sendto$inet6(r1, 0x0, 0xfffffffffffffe32, 0x20004004, &(0x7f0000000040)={0xa, 0x20004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000080)="39a110", 0xffffffffffffffc1, 0x40, 0x0, 0xfffffffffffffe5b) r5 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r5, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x1bb) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x66, &(0x7f0000000040)={r6}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000000)={r6, 0x39cf}, 0x8) 05:24:12 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 779.408661][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 05:24:12 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:12 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10d000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:13 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0xa, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:13 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x3, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 779.908120][T24610] FAT-fs (loop2): bogus number of reserved sectors [ 779.981903][T24610] FAT-fs (loop2): Can't find a valid FAT filesystem 05:24:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:13 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$mice(&(0x7f00000015c0)='/dev/input/mice\x00', 0x0, 0x101001) r2 = syz_genetlink_get_family_id$team(&(0x7f0000001640)='team\x00') r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f00000001c0)={0x100004}, 0xfd57) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000016c0)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@broadcast}}, &(0x7f0000000100)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0xe8) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f00000001c0)={0x100004}, 0xfd57) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f00000016c0)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@broadcast}}, &(0x7f0000000100)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0xe8) r7 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f00000001c0)={0x100004}, 0xfd57) getsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f00000016c0)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@broadcast}}, &(0x7f0000000100)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r8}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0xe8) getsockname$packet(0xffffffffffffffff, &(0x7f0000001680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000016c0)=0x14) r10 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f00000001c0)={0x100004}, 0xfd57) getsockopt$inet6_IPV6_IPSEC_POLICY(r10, 0x29, 0x22, &(0x7f00000016c0)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@broadcast}}, &(0x7f0000000100)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@mcast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r11}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, 0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000001880)={&(0x7f0000001600)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001840)={&(0x7f0000001700)={0x110, r2, 0x100, 0x70bd25, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0xf4, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}]}}]}, 0x110}, 0x1, 0x0, 0x0, 0x8000}, 0x800) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x24, 0x33, 0x119, 0x0, 0x0, {0x2}, [@generic="ffd38d9b", @nested={0xc, 0x1, [@typed={0x8, 0x14, @u32}]}]}, 0x24}}, 0x0) 05:24:13 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:13 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) r1 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000001d0081", 0x7}], 0x1}, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000080)=0x82) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)="debdd050a7582c37", 0x8}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') write$cgroup_subtree(r0, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) accept4(r2, 0x0, &(0x7f0000000040), 0x0) 05:24:14 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 780.727040][ T26] kauditd_printk_skb: 5 callbacks suppressed [ 780.727057][ T26] audit: type=1804 audit(1574141053.995:553): pid=24634 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/436/file0/file0" dev="loop0" ino=653 res=1 05:24:14 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x300, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 780.923264][ T26] audit: type=1804 audit(1574141054.115:554): pid=24619 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/445/file0/file0" dev="sda1" ino=17204 res=1 05:24:14 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0xb, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 781.066824][T24666] FAT-fs (loop2): bogus number of reserved sectors [ 781.070981][ T26] audit: type=1800 audit(1574141054.115:555): pid=24619 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17204 res=0 [ 781.093763][T24666] FAT-fs (loop2): Can't find a valid FAT filesystem [ 781.128640][ T26] audit: type=1804 audit(1574141054.115:556): pid=24626 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/445/file0/file0" dev="sda1" ino=17204 res=1 05:24:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10e000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:14 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:14 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x3f00, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:15 executing program 3: setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000d10ffc), 0x4) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x4002) io_setup(0xc32f, &(0x7f0000000440)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) ioctl$TIOCLINUX6(r4, 0x541c, &(0x7f0000000ec0)={0x6, 0x81}) setsockopt$inet6_tcp_buf(r3, 0x6, 0x0, &(0x7f0000000780)="7ea2489387a42967d669cac636490db8130941fca67fc3324091e17f8a61fce88c9665943b5886f108e08f717d37c953992c95f1989bebb5ff8daea8e86fed57b5277a9e3921c8c0d56f65dab893ca84fb0ff877e9b24c1f313f03ce", 0x5c) readv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000580)=""/219, 0xdb}, {0x0}, {&(0x7f0000000480)=""/47, 0x2f}], 0x3) sendmsg$rds(0xffffffffffffffff, &(0x7f0000000e80)={&(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000100)=""/16, 0x10}, {&(0x7f0000000140)=""/37, 0x25}, {&(0x7f0000000180)=""/93, 0x5d}, {&(0x7f0000000200)=""/233, 0xe9}, {&(0x7f0000000300)=""/56, 0x38}], 0x5, &(0x7f0000000d80)=ANY=[@ANYBLOB="580000000000000014010000080000000400000010000000", @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="01000080000000000500000000000000000200000000000002000000000000000600000000000000410800000000000048000000000000001401000001000000090100001f000000", @ANYPTR=&(0x7f0000000500)=ANY=[@ANYBLOB='\x00'/41], @ANYBLOB=')\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000f00)=ANY=[@ANYPTR=&(0x7f0000000680)=ANY=[@ANYBLOB='\x00'/112], @ANYBLOB='p\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000900)=ANY=[@ANYBLOB='\x00'/163], @ANYBLOB="a300000000000000", @ANYPTR=&(0x7f00000009c0)=ANY=[@ANYBLOB='\x00'/255], @ANYBLOB="ff00000000000000dabea1b88b53610c3b0355a30a6de3b4b2e3a9a2c28fe37c349919590551b4aed26dac89bbd962acee96ae2fed3aaf5909e7f74a4ee7c71ff0f427b40ce0ace2b6ab26", @ANYPTR=&(0x7f0000000ac0)=ANY=[@ANYBLOB='\x00'/184], @ANYBLOB="b800000000000000", @ANYPTR=&(0x7f0000000b80)=ANY=[@ANYBLOB='\x00'/101], @ANYBLOB='e\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000fc0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007f921d7210b0c310dc3ce018359986e800"/189], @ANYBLOB="ad00000000000000"], @ANYBLOB="0600000000000000cc00000000000000000000000000000058000000000000001401000009000000ff010000bf000000", @ANYPTR=&(0x7f0000000740)=ANY=[@ANYBLOB="b906000000000000"], @ANYPTR=&(0x7f0000000d40)=ANY=[@ANYBLOB="5003000000000000"], @ANYBLOB="000000000000000007000000000000000800000000000000010000000000000000000000000000000100000000000000"], 0xf8, 0x4000}, 0xa085) write$P9_RATTACH(r3, &(0x7f0000000080)={0x35a}, 0xfffffff4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x960000, r0, &(0x7f0000000800)="371d848c24591792863b2d5d6bc3c76a000001000000000079e6ae1a07de1d42fd46fdfada485aaea1cda588838353786b2ff4f7b644e0839054fcd3486dfe9795b35eae35042b0ae441065b6570a16e9f59424cf705c5958d33fbfcec4080876e65ccb6cc4a9a8e6a0f46559eb725fdab41865ab93895a77a3e494f920e9617dc006dcbe35e9ff7112f2a58bbd9f7123b6661186821900b092f90a53e27d726e56671cc23bf1472b65c3131051de54ab9b1fe6b7b515163790da97ebdaf688dc5b30aed84cbb5c86c3c0a64548106e6a4bfd61442897160333d8ad0b914906fb8839422a3", 0x2c84e1972a71ed36, 0x0, 0x0, 0xffffffe4}]) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000cc0)=ANY=[@ANYRES32=0x0, @ANYBLOB="4848cc54cbdd582eb37c82fd7257c51f981274a85d221a158245285210d6a3c5994f01a5ec963fabd1b107e4141d16f13c286e0c55c4e45d9243154e6e0000010400"/76], 0x0) 05:24:15 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 781.961391][ T26] audit: type=1804 audit(1574141055.235:557): pid=24705 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir264217301/syzkaller.BdFZbn/560/bus" dev="sda1" ino=17219 res=1 05:24:15 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 782.035900][ T26] audit: type=1804 audit(1574141055.295:558): pid=24705 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir264217301/syzkaller.BdFZbn/560/bus" dev="sda1" ino=17219 res=1 [ 782.166643][ T26] audit: type=1804 audit(1574141055.435:559): pid=24681 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/437/file0/file0" dev="loop0" ino=657 res=1 05:24:15 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x1000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 782.307944][ T26] audit: type=1804 audit(1574141055.585:560): pid=24703 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir264217301/syzkaller.BdFZbn/560/bus" dev="sda1" ino=17219 res=1 05:24:15 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0xc, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 782.380617][T24726] FAT-fs (loop2): bogus number of reserved sectors [ 782.423703][ T26] audit: type=1804 audit(1574141055.615:561): pid=24719 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir264217301/syzkaller.BdFZbn/560/bus" dev="sda1" ino=17219 res=1 [ 782.447980][T24726] FAT-fs (loop2): Can't find a valid FAT filesystem [ 782.494530][ T26] audit: type=1804 audit(1574141055.635:562): pid=24716 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/446/file0/file0" dev="loop4" ino=659 res=1 05:24:15 executing program 3: setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000d10ffc), 0x4) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x4002) io_setup(0xc32f, &(0x7f0000000440)=0x0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r2, 0x0) ftruncate(r0, 0x48280) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpu.stat\x00', 0x0, 0x0) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f0000000240)={0xffff, 0x401, 0x1000}) ioctl$TIOCLINUX6(r4, 0x541c, &(0x7f0000000ec0)={0x6, 0x81}) setsockopt$inet6_tcp_buf(r3, 0x6, 0x0, &(0x7f0000000780)="7ea2489387a42967d669cac636490db8130941fca67fc3324091e17f8a61fce88c9665943b5886f108e08f717d37c953992c95f1989bebb5ff8daea8e86fed57b5277a9e3921c8c0d56f65dab893ca84fb0ff877e9b24c1f313f03ce", 0x5c) readv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000580)=""/219, 0xdb}, {0x0}, {&(0x7f0000000480)=""/47, 0x2f}], 0x3) sendmsg$rds(0xffffffffffffffff, &(0x7f0000000e80)={&(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000100)=""/16, 0x10}, {&(0x7f0000000140)=""/37, 0x25}, {&(0x7f0000000180)=""/93, 0x5d}, {&(0x7f0000000200)=""/233, 0xe9}, {&(0x7f0000000300)=""/56, 0x38}], 0x5, &(0x7f0000000d80)=ANY=[@ANYBLOB="580000000000000014010000080000000400000010000000", @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="01000080000000000500000000000000000200000000000002000000000000000600000000000000410800000000000048000000000000001401000001000000090100001f000000", @ANYPTR=&(0x7f0000000500)=ANY=[@ANYBLOB='\x00'/41], @ANYBLOB=')\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000f00)=ANY=[@ANYPTR=&(0x7f0000000680)=ANY=[@ANYBLOB='\x00'/112], @ANYBLOB='p\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000900)=ANY=[@ANYBLOB='\x00'/163], @ANYBLOB="a300000000000000", @ANYPTR=&(0x7f00000009c0)=ANY=[@ANYBLOB='\x00'/255], @ANYBLOB="ff00000000000000dabea1b88b53610c3b0355a30a6de3b4b2e3a9a2c28fe37c349919590551b4aed26dac89bbd962acee96ae2fed3aaf5909e7f74a4ee7c71ff0f427b40ce0ace2b6ab26", @ANYPTR=&(0x7f0000000ac0)=ANY=[@ANYBLOB='\x00'/184], @ANYBLOB="b800000000000000", @ANYPTR=&(0x7f0000000b80)=ANY=[@ANYBLOB='\x00'/101], @ANYBLOB='e\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000fc0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007f921d7210b0c310dc3ce018359986e800"/189], @ANYBLOB="ad00000000000000"], @ANYBLOB="0600000000000000cc00000000000000000000000000000058000000000000001401000009000000ff010000bf000000", @ANYPTR=&(0x7f0000000740)=ANY=[@ANYBLOB="b906000000000000"], @ANYPTR=&(0x7f0000000d40)=ANY=[@ANYBLOB="5003000000000000"], @ANYBLOB="000000000000000007000000000000000800000000000000010000000000000000000000000000000100000000000000"], 0xf8, 0x4000}, 0xa085) write$P9_RATTACH(r3, &(0x7f0000000080)={0x35a}, 0xfffffff4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x960000, r0, &(0x7f0000000800)="371d848c24591792863b2d5d6bc3c76a000001000000000079e6ae1a07de1d42fd46fdfada485aaea1cda588838353786b2ff4f7b644e0839054fcd3486dfe9795b35eae35042b0ae441065b6570a16e9f59424cf705c5958d33fbfcec4080876e65ccb6cc4a9a8e6a0f46559eb725fdab41865ab93895a77a3e494f920e9617dc006dcbe35e9ff7112f2a58bbd9f7123b6661186821900b092f90a53e27d726e56671cc23bf1472b65c3131051de54ab9b1fe6b7b515163790da97ebdaf688dc5b30aed84cbb5c86c3c0a64548106e6a4bfd61442897160333d8ad0b914906fb8839422a3", 0x2c84e1972a71ed36, 0x0, 0x0, 0xffffffe4}]) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000cc0)=ANY=[@ANYRES32=0x0, @ANYBLOB="4848cc54cbdd582eb37c82fd7257c51f981274a85d221a158245285210d6a3c5994f01a5ec963fabd1b107e4141d16f13c286e0c55c4e45d9243154e6e0000010400"/76], 0x0) 05:24:15 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10f000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:16 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x2000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 783.003105][T24758] fuse: Bad value for 'fd' 05:24:16 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x3000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:16 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:16 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0xd, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:17 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10f0ff, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:17 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) socket(0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) write(r1, &(0x7f0000000340), 0x41395527) ioctl$sock_ax25_SIOCADDRT(r1, 0x890b, &(0x7f0000000140)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x16c, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x0, @local}}, 0x0, 0x5, 0x2, "a77760f5a7645bc43c241d69912dda0c63c2a66726f8cfafd6c8fe2c98de7ba44947a79015f0fe57917cb62a93987a938fdedfce7bbb24fec2fba09c41fb233245f2604b9e07b8ab79ec15ef2818a179"}, 0xd8) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100)=0x206c, 0xfee4) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$EBT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x81, 0x0, 0x0) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, 0x0, 0x0, &(0x7f0000000200)=""/20, 0x14, 0x3e8}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) fadvise64(r4, 0x8bae, 0x1, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) [ 783.708434][T24786] FAT-fs (loop2): bogus number of reserved sectors [ 783.746406][T24786] FAT-fs (loop2): Can't find a valid FAT filesystem 05:24:17 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0xe, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:17 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x3f000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:17 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:18 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x40000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:18 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 784.929936][T24844] FAT-fs (loop2): bogus number of reserved sectors [ 784.962449][T24844] FAT-fs (loop2): Can't find a valid FAT filesystem 05:24:18 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0xf, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:18 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:18 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0xf6ffffff, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:18 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:18 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10ff0f, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:19 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:19 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:19 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0xfffffff6, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 785.901059][ T26] kauditd_printk_skb: 11 callbacks suppressed [ 785.901078][ T26] audit: type=1804 audit(1574141059.175:574): pid=24872 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/441/file0/file0" dev="loop0" ino=667 res=1 [ 786.165349][T24905] FAT-fs (loop2): bogus number of reserved sectors 05:24:19 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x10, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 786.207567][T24905] FAT-fs (loop2): Can't find a valid FAT filesystem 05:24:19 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) 05:24:19 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x1000000000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x10fff0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:20 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x100000000000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:20 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000240), 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 787.078992][ T26] audit: type=1804 audit(1574141060.355:575): pid=24923 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/442/file0/file0" dev="loop0" ino=673 res=1 05:24:20 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x11, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:20 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) 05:24:20 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x200000000000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 787.384342][T24964] FAT-fs (loop2): bogus number of reserved sectors [ 787.431320][T24964] FAT-fs (loop2): Can't find a valid FAT filesystem 05:24:21 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000240), 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:21 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x300000000000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 787.821113][T24990] FAT-fs (loop2): bogus number of reserved sectors [ 787.840362][T24990] FAT-fs (loop2): Can't find a valid FAT filesystem [ 787.869426][ T26] audit: type=1804 audit(1574141061.145:576): pid=24955 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/450/file0/file0" dev="loop4" ino=675 res=1 05:24:21 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x200000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:21 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x9000000000000f3, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:21 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x400000000000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 788.487659][T25023] fuse: Bad value for 'fd' 05:24:21 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) [ 788.555734][ T26] audit: type=1804 audit(1574141061.825:577): pid=24977 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/443/file0" dev="sda1" ino=17234 res=1 05:24:21 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x3f00000000000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:22 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000240), 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:22 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x12, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 788.945057][T25043] FAT-fs (loop2): bogus number of reserved sectors [ 789.016875][T25043] FAT-fs (loop2): Can't find a valid FAT filesystem 05:24:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x0, 0x0) 05:24:22 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000000000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 789.150330][ T26] audit: type=1804 audit(1574141062.425:578): pid=25024 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/451/file0/file0" dev="sda1" ino=17232 res=1 [ 789.214859][ T26] audit: type=1800 audit(1574141062.425:579): pid=25024 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=17232 res=0 [ 789.278360][ T26] audit: type=1804 audit(1574141062.425:580): pid=25026 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/451/file0/file0" dev="sda1" ino=17232 res=1 05:24:22 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x200020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 789.541226][ T26] audit: type=1804 audit(1574141062.815:581): pid=25046 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/444/file0/file0" dev="loop0" ino=679 res=1 [ 789.660813][ T26] audit: type=1804 audit(1574141062.855:582): pid=25054 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir345626080/syzkaller.jOYhnp/444/file0/file0" dev="loop0" ino=679 res=1 05:24:23 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:23 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0xf6ffffff00000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:23 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:23 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x500, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:23 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x2) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 790.149942][T25101] FAT-fs (loop2): bogus number of reserved sectors [ 790.200173][T25101] FAT-fs (loop2): Can't find a valid FAT filesystem 05:24:23 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x0, 0x0) [ 790.556305][ T26] audit: type=1804 audit(1574141063.825:583): pid=25117 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/452/file0/file0" dev="sda1" ino=17247 res=1 05:24:23 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x3) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:24 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:24 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x200120, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:24 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x4) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:24 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:24 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:24:24 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x0, 0x0) [ 791.332048][T25159] FAT-fs (loop2): bogus number of reserved sectors [ 791.338852][T25159] FAT-fs (loop2): Can't find a valid FAT filesystem 05:24:24 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x300) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) [ 791.842865][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 791.842885][ T26] audit: type=1804 audit(1574141065.115:588): pid=25152 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir068693308/syzkaller.cmjsrz/453/file0/file0" dev="loop4" ino=683 res=1 05:24:25 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x4000000, 0x0) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x3800) io_submit(r2, 0x0, &(0x7f0000000540)) 05:24:25 executing program 1: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x3f00) mount$fuse(0x0, &(0x7f0000000080)='./file0/file1\x00', 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0xfffffed0) write$FUSE_ENTRY(r0, &(0x7f0000002000)={0x90, 0x0, 0x2}, 0x90) 05:24:25 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000010, 0x300020, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 792.266002][T25199] ================================================================== [ 792.274148][T25199] BUG: KCSAN: data-race in fuse_get_req / fuse_set_initialized [ 792.281678][T25199] [ 792.284012][T25199] read to 0xffff8881259e9704 of 4 bytes by task 25186 on cpu 0: [ 792.291636][T25199] fuse_get_req+0xb6/0x450 [ 792.296056][T25199] fuse_simple_request+0x7f/0x640 [ 792.301081][T25199] fuse_lookup_name+0x20a/0x460 [ 792.305937][T25199] fuse_lookup+0x7c/0x210 [ 792.310270][T25199] fuse_atomic_open+0x194/0x230 [ 792.315133][T25199] path_openat+0x23d1/0x36e0 [ 792.319732][T25199] do_filp_open+0x11e/0x1b0 [ 792.324241][T25199] do_sys_open+0x3b3/0x4f0 [ 792.328659][T25199] __x64_sys_open+0x55/0x70 [ 792.333161][T25199] do_syscall_64+0xcc/0x370 [ 792.337666][T25199] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 792.343538][T25199] [ 792.345863][T25199] write to 0xffff8881259e9704 of 4 bytes by task 25199 on cpu 1: [ 792.353572][T25199] fuse_set_initialized+0x22/0x40 [ 792.358601][T25199] process_init_reply+0x96/0xb90 [ 792.363542][T25199] fuse_request_end+0x324/0x530 [ 792.368394][T25199] fuse_dev_do_write+0x582/0x1bd0 [ 792.373421][T25199] fuse_dev_write+0xba/0x100 [ 792.378004][T25199] new_sync_write+0x388/0x4a0 [ 792.382672][T25199] __vfs_write+0xb1/0xc0 [ 792.386913][T25199] vfs_write+0x18a/0x390 [ 792.391152][T25199] ksys_write+0xd5/0x1b0 [ 792.395389][T25199] __x64_sys_write+0x4c/0x60 [ 792.399973][T25199] do_syscall_64+0xcc/0x370 [ 792.404475][T25199] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 792.410354][T25199] 05:24:25 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{0x0}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x4, &(0x7f0000000180)=0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r4, 0x4, 0x3800) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x900000000000006, 0xc00000000100000, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 792.412667][T25199] Reported by Kernel Concurrency Sanitizer on: [ 792.418819][T25199] CPU: 1 PID: 25199 Comm: syz-executor.1 Not tainted 5.4.0-rc7+ #0 [ 792.426694][T25199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 792.436786][T25199] ================================================================== [ 792.444823][T25199] Kernel panic - not syncing: panic_on_warn set ... [ 792.451388][T25199] CPU: 1 PID: 25199 Comm: syz-executor.1 Not tainted 5.4.0-rc7+ #0 [ 792.459252][T25199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 792.469283][T25199] Call Trace: [ 792.472558][T25199] dump_stack+0x11d/0x181 [ 792.476914][T25199] panic+0x210/0x640 [ 792.480791][T25199] ? vprintk_func+0x8d/0x140 [ 792.485364][T25199] kcsan_report.cold+0xc/0xd [ 792.489940][T25199] kcsan_setup_watchpoint+0x3fe/0x460 [ 792.495296][T25199] __tsan_unaligned_write4+0xc4/0x100 [ 792.500649][T25199] fuse_set_initialized+0x22/0x40 [ 792.505664][T25199] process_init_reply+0x96/0xb90 [ 792.510590][T25199] ? set_global_limit+0x60/0x60 [ 792.515423][T25199] fuse_request_end+0x324/0x530 [ 792.520254][T25199] ? set_global_limit+0x60/0x60 [ 792.525086][T25199] fuse_dev_do_write+0x582/0x1bd0 [ 792.530136][T25199] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 792.536014][T25199] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 792.541896][T25199] fuse_dev_write+0xba/0x100 [ 792.546478][T25199] new_sync_write+0x388/0x4a0 [ 792.551155][T25199] __vfs_write+0xb1/0xc0 [ 792.555378][T25199] vfs_write+0x18a/0x390 [ 792.559612][T25199] ksys_write+0xd5/0x1b0 [ 792.563835][T25199] __x64_sys_write+0x4c/0x60 [ 792.568411][T25199] do_syscall_64+0xcc/0x370 [ 792.572903][T25199] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 792.578805][T25199] RIP: 0033:0x45a639 [ 792.582685][T25199] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 792.602270][T25199] RSP: 002b:00007fe934f0ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 792.610660][T25199] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a639 [ 792.618609][T25199] RDX: 0000000000000090 RSI: 0000000020002000 RDI: 0000000000000003 [ 792.626563][T25199] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 792.634527][T25199] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe934f0f6d4 [ 792.642476][T25199] R13: 00000000004ca81c R14: 00000000004e2960 R15: 00000000ffffffff [ 792.651793][T25199] Kernel Offset: disabled [ 792.656112][T25199] Rebooting in 86400 seconds..