[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   15.334334] random: sshd: uninitialized urandom read (32 bytes read)
[?25l[?1c7[ ok 8[?25h[?0c[   15.401149] random: sshd: uninitialized urandom read (32 bytes read)
.
[   15.586077] random: sshd: uninitialized urandom read (32 bytes read)

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.32' (ECDSA) to the list of known hosts.
syzkaller login: [   25.422352] urandom_read: 1 callbacks suppressed
[   25.422355] random: sshd: uninitialized urandom read (32 bytes read)
2018/08/29 21:38:50 fuzzer started
[   26.483598] random: cc1: uninitialized urandom read (8 bytes read)
2018/08/29 21:38:52 dialing manager at 10.128.0.26:39683
2018/08/29 21:38:59 syscalls: 1
2018/08/29 21:38:59 code coverage: enabled
2018/08/29 21:38:59 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled
2018/08/29 21:38:59 setuid sandbox: enabled
2018/08/29 21:38:59 namespace sandbox: enabled
2018/08/29 21:38:59 fault injection: CONFIG_FAULT_INJECTION is not enabled
2018/08/29 21:38:59 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2018/08/29 21:38:59 net packed injection: enabled
2018/08/29 21:38:59 net device setup: enabled
[   40.142207] random: crng init done

INIT: Id "3" respawning too fast: disabled for 5 minutes

INIT: Id "6" respawning too fast: disabled for 5 minutes

INIT: Id "2" respawning too fast: disabled for 5 minutes

INIT: Id "5" respawning too fast: disabled for 5 minutes

INIT: Id "1" respawning too fast: disabled for 5 minutes

INIT: Id "4" respawning too fast: disabled for 5 minutes
21:40:26 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
mount(&(0x7f00000012c0)='./file0\x00', &(0x7f0000000240)='./file0\x00', &(0x7f0000000100)='tmpfs\x00', 0x0, &(0x7f0000000080))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
mount(&(0x7f0000000080)='./file0/file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='fuseblk\x00', 0x20a0, &(0x7f00000001c0)="b150195015af8c72ef9573b4")

21:40:26 executing program 2:
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)

21:40:26 executing program 7:
syz_mount_image$f2fs(&(0x7f0000000100)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f0000000280), 0x0, &(0x7f0000000480)=ANY=[])

21:40:26 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000fb6000)=""/28, 0x3f0)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf})
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f00000002c0)={0xffffff7f, 0x0, 'client0\x00', 0x0, "e1b460e3215c7c84", "82bc520a99453fb1bee724d5aaf19a46e9229731c3603cd24bda888240b9eca4"})
r1 = gettid()
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000))
tkill(r1, 0x1000000000014)

21:40:26 executing program 4:
creat(&(0x7f0000000040)='./file0\x00', 0x0)
unlink(&(0x7f0000000000)='./file0\x00')

21:40:26 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000002d0019010000000002000000030000000c0000000800030002d00000"], 0x1}}, 0x0)

21:40:26 executing program 6:
syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00')

21:40:26 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='cmdline\x00')
rt_sigprocmask(0x0, &(0x7f0000000040), 0x0, 0x8)
preadv(r0, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/172, 0x6}], 0x1, 0x0)
syz_open_procfs(0x0, &(0x7f00000001c0))

[  120.707773] IPVS: Creating netns size=2536 id=1
[  120.838136] IPVS: Creating netns size=2536 id=2
[  120.900396] IPVS: Creating netns size=2536 id=3
[  120.937279] IPVS: Creating netns size=2536 id=4
[  120.998355] IPVS: Creating netns size=2536 id=5
[  121.050678] IPVS: Creating netns size=2536 id=6
[  121.095295] IPVS: Creating netns size=2536 id=7
[  121.153314] IPVS: Creating netns size=2536 id=8
[  121.554448] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  121.599668] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  121.769581] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  121.852617] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  121.879644] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  121.937239] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  121.957602] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  122.000298] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  122.008691] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  122.063436] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  122.176258] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  122.216018] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  122.231282] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  122.255614] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  122.275650] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  122.297661] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  122.316689] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  122.325385] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  122.355968] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  122.383375] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  122.417181] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  122.434310] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  122.454385] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  122.469470] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  122.477138] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  122.539049] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  122.618555] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  122.628317] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  122.640337] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  122.653184] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  122.666922] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  122.677427] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  122.687676] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  122.710549] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  122.731798] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  122.741818] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  122.756703] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  122.764296] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  122.777695] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  122.793781] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  122.805516] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  122.818605] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  122.835457] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  122.846624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  122.855129] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  122.862180] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  122.871588] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  122.880451] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  122.891039] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  122.908473] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  122.918287] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  122.938445] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  122.947465] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  122.954967] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  122.975232] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  122.988759] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  123.022156] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  123.029652] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  123.038484] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  123.054645] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  123.069266] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  123.079258] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  123.092207] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  123.105165] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  123.137419] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  123.181080] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  123.228317] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  123.239553] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  123.254840] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  123.284312] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  123.306249] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  123.319271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  123.347840] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  123.355552] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  123.395304] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  123.424548] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  123.442656] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  123.461239] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  123.481611] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  123.495529] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  123.511857] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  123.522171] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  123.533427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  123.542920] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  123.559498] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  123.570628] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  123.584146] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  123.604433] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  123.619521] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  123.627605] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  123.635121] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  123.658342] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  123.665813] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  123.681712] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  123.698486] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  123.705992] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  127.130754] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  127.364265] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  127.382532] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  127.395527] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  127.408359] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  127.470062] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  127.597529] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  127.623318] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  127.641163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  127.649515] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  127.673437] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  127.685547] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  127.698772] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  127.853031] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  127.874753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  127.883067] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  127.908166] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  127.960101] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  128.014445] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  128.104203] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  128.124510] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  128.147691] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  128.154444] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  128.169748] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  128.180238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  128.193942] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  128.297048] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  128.303998] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  128.313926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  128.338013] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  128.348393] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  128.355827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
21:40:34 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x2)
socketpair(0x3, 0x7, 0x401, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f00000000c0))
r2 = socket$inet6(0xa, 0x8080a, 0x0)
getsockopt$inet6_int(r2, 0x29, 0x84a, &(0x7f0000000100), &(0x7f0000000040)=0x4)

[  129.060977] tmpfs: No value for mount option '±PP¯Œrï•s´'
[  129.082410] tmpfs: No value for mount option './file0/file0'
[  129.094190] tmpfs: No value for mount option '±PP¯Œrï•s´'
21:40:34 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={<r1=>0xffffffffffffffff})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
sendmsg$unix(r3, &(0x7f00000001c0)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f0000000140), 0x0, &(0x7f0000000180)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0)
sendmsg$unix(r2, &(0x7f0000e4ffc8)={&(0x7f0000beb000)=@abs, 0x8, &(0x7f000000d000), 0x0, &(0x7f000053c000)=[@rights={0x18, 0x1, 0x1, [r2]}], 0x18}, 0x0)
close(r2)
close(r1)

21:40:34 executing program 0:
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000080))
r0 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000380), 0x0, 0x0, 0xfffffffffffffffb)
r1 = add_key$keyring(&(0x7f0000000440)='keyring\x00', &(0x7f0000000280), 0x0, 0x0, r0)
r2 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f00000002c0), 0x0, 0x0, r1)
add_key(&(0x7f0000000140)='dns_resolver\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000180)="c6a34e987940ea478d9bd365b9e4621e334652733324b7773a3df8a7504d9e18e2e4a839fcd9030000000000000028945d12a9caae603ff81c4dc32ed3d70fb5d4c5b866305249060000005277822d0e0616a2e5b74c48e38b9936f298c6feec95ad327c724ec507bd34b94e99623f014bf81ea54900ac54a99aa04e1a7f000000e8d3bfa2f3abce9736aac3e0b19d5a697bc438cd49bc1cf3af72c2180bbee78e9a7237c02e10ac77e3a4fd8a6e2bdca6a9a1d7da1a3e559fdafb6703c73b3c4c10865302fb324f16327996273625d9f0a54ef16bdb08f22ed11fd80b74eb861aebe51b0912c0f79486c25c49524ffe4f00", 0xf2, r2)
r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0)
sendmmsg(r3, &(0x7f0000001080)=[{{&(0x7f00000003c0)=@in={0x2, 0x4e24, @multicast1}, 0x80, &(0x7f0000000bc0)=[{&(0x7f0000000040)="708ddc78026ee9207fbd5c9a94eaff7ac97ec638da", 0x15}, {&(0x7f0000000100)="3c6066b668a82f20b9b939b7ea5a397452f9a282dadfd6e529bee0681e087fafdbf3175cd913ea817638e7a5b8e5a8c903e948b3d97aac56fa086edcd913", 0x3e}, {&(0x7f0000000480)="16321a96812365277d3602423017a966895a1b88be7c5c5124e77eea5de1a1fe459e544704ff6df38c362b23b0685f6b16ee21e9285e56dea6a03d5e7fe9ae1f64e6e29c5efc46a88277f4a2a90825f428518600024cb25ee6b67dd7d8322f3c6e176a9070d2ec57e2a63c01c36b4c99e765a7233e5e414a71e8616fde033af2aaa442f43de24412e7477c184c948582dd48b4603ffb6eb87e315f6452", 0x9d}, {&(0x7f0000000640)="40856bc5fc1a5cef95213b9faffef0bf9d307bad894f338a21bd1dd020572f1fcff7201b7b68c81afff1e563f545e820f97ec4eb11ae23f8a56713b85b138777c274", 0x42}, {&(0x7f00000006c0)="81818468d5fe2fe75c1f22ec41de25a7f4013d6c1d23cc57b7762c51e403f1f71e85e6767d068d469ef0a65d39865b613c3f54bd083dc1a08336eb9ea05c5873cfd2576f96e84ae7bb1a07263afaf7300c1ad4caaac4573dbf974c2551a4c9238d72fbcf36c18281a44b0d9b46666b67f2a9c745f324bfecf387dec0ec6dc54f33daced2f86915", 0x87}, {&(0x7f0000000780)="02df99b355efe096e047e44ad5a08d274274cd2a12879d30378df475bef4d94b4de36ac15414cf5dcd76747e81f374684c5e10f38f1ba5d99432516aa27d64e50b6a8e756b3ef393a9cc380e387c1506aca503e89abcfbb9ac1b02b215c7a3ef056f321c9d0d5449ef6d6de5c52d82fefc0842a9400b8c69f6d24a83b982016972a8cdd91493f9318e27f09a7296aaf2be6928de59e3780bb43072828eb0a9d0bae4167163c04e92b36fe5f04684547f7921e49a99ec12c9e56e7577c277798bdd6f60f09affdb4eaea93c9954c9b306c499b6012d12540920", 0xd9}, {&(0x7f0000000880)="40e2acfcf6a53f16293bed7dfd071f51ca3e305f5ab816abb2788002e9150fefc22a26021c0b30444a46894e0eb0371ff6e0e8fff8bba4dedf52a937e4964e3a708101c33e90a1dfe3183470c68e8e6b9a15fb525935", 0x56}, {&(0x7f0000000340)="cea737", 0x3}, {&(0x7f0000000900)="5a141ef6f576951e7171533844161ca7254691372020543d183ba7fd8cd5cf636696231bb4757ed871f83feb4d", 0x2d}], 0x9, &(0x7f0000001140)=ANY=[@ANYBLOB="98000000000000000600000007000000f24061ddc0e002912b347f542d4246cf92828b20f2f46ccc64658bc8b419e7543fb5e95344da8f138d7ebd11d51245a9e27d06585a066dc83f3f5230a05ed000ffd9b40d927e3cb75acd6fd7d5aa7a9967991b635f84fec0eddd14dc8a7ad28d125432d46921805dd3177e3bc83b26d228b0db9526d40655478d22790d3a6473230000000000000048000000000000001f010000048a00000edabd413dd3172c84caa93807a9d1a1a3ba5820661fcd0841c8a31affe1ded8d683b651b961f8ffc7bfc05b8bb6f383ad3c00000000000021f776e08d42d48703171c106142aae93ce6681ff9d8e9b0"], 0xe0, 0x880}, 0x9}, {{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000d80)="693a0f295af59f0742b6e16a1dfd315ec0fd934af776f83ffb4dbbfa571cb2effcec6c6cafaa4ae0f9bb429dc04c3f225272eb7217c70d63256775c384655d02b6f28f", 0x43}, {&(0x7f0000000e00)="079fb20148a2aa922ea2751b3c97ce01ffb6d02e4619fef2becd2a5491376d38dfc68cf58eeb18f24ee666a11556c019e441f167f7434dd66f32f6511be6c82c24c8b3350558a877a2aa435b6febeef4933760cd5f8be44536e02e476762520e84c3b1f0d1732de43c518f35799fe0ba85b910b029b60b1e57396887da69c5be73c96ee3dcac044871e5b1e91e20a3a2b0b34adaa4fd5687a8689a6ba07f0807c9a2b822d2f4cf67b3b6e30bea2b8dd6560fa2dbabc4b5659aa1df2f702b3ac9021328035d7cf159b51383bbea3cf93f", 0xd0}], 0x2, &(0x7f0000000f40)}, 0x7}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000f80)="4ba2fa2f96ee20e34db4b5fcfb9141a6245103fee5bb61fa7f802d622c223b86e3b201a533a77921bacff880682ba9eea3bd98e42696a777dec01b0481daba31583ff44791eef04e9b56", 0x4a}, {&(0x7f0000001000)="66cab72a609bd3ce03e1416b0cc48aea8ed1b3e4f590d8084bb58cdf2dc54017d10fb7311e78f460a31de0784b28", 0x2e}], 0x2, 0x0, 0x0, 0x40}, 0x401}], 0x3, 0x40800)
request_key(&(0x7f0000000940)="646e735f7265736f6c7665720005083f7605beb89ebb55f56950196fd8b8a6ebddf637ee27ef0fabbbad7523dacb0ab4baaf14787b652566f6eaf50a9d4cff3e30f2d07fd0118cf06573e05f283ef26ec0cc75cf93fe4c95c7185cb70df302c4c08871883fc063c014d46b8b27fd88a01e760bee664a475d69d12e2fc7e3dc680e3bb87b71d301fbf92cadf5537bc8774141ee7d7152d16c9ee5ef389b527a9b31679b1560e4680fcfd95743ed5305a984645fb4371e5e363f7df35cb72f6d9c953cd2ea3167c037567f7f99399e92ba02db513f40a4d44e072bf5ea9495287934a503a032610a0235c3530cfc99e27a1e10e28ed49beb223bbe910fd417a48e64dbdf97edb9363e6b5853e1323d6f78d0fb80969de2f5fec97acbb11c1ae97f54b74e3ef9d50e1fbc43cc27e537d18452001232814ac3970ee2938175a91f4e0ca28b803a350dbea3b68d6a71bc65b011a81834b809f86919e4499a53ff8a35993b333b9b2761a44bb4a888a90c078d0b923e28cdbf76aa3fb68394de930dddf27c48926ab9c66951b70ebd4063b510ae453059ff71853bcf5942b5140a111d4a2afbaf612c6415aceb9578cb0d1decc8001f6dfc9d6829dbed2a8dbbc4bc939196131bb3fb451d52778143fb3c2f4d17df3c295117e13889037aff061ff283cac330aa03e7d189f01bfd03e68532d5594ef0e4bf1d584c7eacfd53a7ae8ccecc1901c89f4db4a3f1925610f22dac4570169b7f9f4cbf3fa1376f0ce4ab31605a16aff95c1bda1b96b9ded911a38594c3d9b42e7712ac377f377cd30eda00efd15d718e20dba3e76c4850966353c04a178e3b857719f9d81dc0ef8776c46c47d38aad73498289bc0240", &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x3, 0x29138c2e}, &(0x7f0000000580)="af2019dcc2380b4623dc8c7a581973a96d57452035fca47b18e7992f4c82e608a92c436783ee4e3264245238b946a4a162645e5c3b06802f185625d49ae13974d13940d0c01a5029b35aec2234860f6525f00000000000000000608995c32ee95c6d6fa9fed4c4b51f07af73e55b92099c2e0cca0e0dda0670566bf42478644a905471e3b967c37550c5abe1b1d53c00bd558d1aff0793c19bbbc870f2c8e0fc", 0x0)

21:40:34 executing program 2:
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000)="295ee1311f16")
r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000580)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000280)=0xffffff53)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
memfd_create(&(0x7f0000000200)='tmpfs\x00', 0x2)
socket$inet_tcp(0x2, 0x1, 0x0)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
symlink(&(0x7f00000000c0)='./control\x00', &(0x7f0000000100)='./file0/file0\x00')
r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x0, 0x0)
setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000b00)=ANY=[@ANYBLOB="feffffff0000000002004e227f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000900000002004e22ac14141900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e22ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f2ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e22e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000047d60000000000000000000000000000000000000000000000000000000002004e227f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23ac14140c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008b645ea8f16b714f865924063a7ad8bc820b09ccbcbace074abf2e6a7b7aa81cb0451632c7e26728c51e225b7145e9d2623c65771952f1f04e4a32a33cb1a35c65abccd0435dc70b3c60b1fd77871cd68d5a7e0967a481ea4005171966c856324c63deae423fdbd0c869a78b6df76ff4482ab8ca8c6eda68c49132853a58f98d1b9fc4ebcab64b1f27df166a25f1f0714039e4f760f9b3e5fa1f25ab604d97f8c2775cf6451d0d"], 0x1)
ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000480)=""/184)
mount(&(0x7f00000003c0)='./control\x00', &(0x7f0000000400)='./control\x00', &(0x7f0000000440)='tmpfs\x00', 0x0, 0x0)
r4 = getpgid(0x0)
fcntl$setownex(r3, 0xf, &(0x7f0000000240)={0x0, r4})
fcntl$setstatus(r1, 0x4, 0x2000)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6}]}, 0x10)
syz_open_dev$usbmon(&(0x7f0000000540)='/dev/usbmon#\x00', 0x1, 0x10000)
r5 = add_key(&(0x7f00000002c0)='dns_resolver\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000340)="8f5a02f81ac127d3ffef0ca8c1912fdf8eb5685e01fcbd3f93b01e0396459fa081fc19d7fb2ce50408566614677b1e08910ca6a8666e40d9181809cfe68ab66b4425fa", 0x43, 0xffffffffffffffff)
keyctl$assume_authority(0x10, r5)
sendmmsg(r1, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002240), 0x1ba, &(0x7f00000022c0)}}, {{0x0, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002700)}}], 0x75a, 0x0)

21:40:34 executing program 0:
r0 = gettid()
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x101000, 0x0)
fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000040))
ioprio_get$pid(0x2, r0)

21:40:34 executing program 0:
syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[])
r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fdatasync(r0)
write$P9_RAUTH(r1, &(0x7f0000000200)={0x14, 0x67, 0x0, {0x0, 0x0, 0x6}}, 0x14)
dup2(r1, r0)
sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe)
pread64(0xffffffffffffffff, &(0x7f0000000240)=""/53, 0x35, 0x0)
write$P9_RXATTRCREATE(r0, &(0x7f0000000280)={0x7, 0x21, 0x2}, 0x7)
sendfile(r1, r0, &(0x7f0000001340), 0x100000001)

[  129.466671] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[  129.473734] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock
[  129.546238] hrtimer: interrupt took 35783 ns
[  129.594309] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[  129.634531] F2FS-fs (loop7): Can't find valid F2FS filesystem in 2th superblock
[  129.678886] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[  129.710750] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock
[  129.739052] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[  129.769736] F2FS-fs (loop7): Can't find valid F2FS filesystem in 2th superblock
[  129.853384] F2FS-fs (loop7): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[  129.875451] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock
21:40:35 executing program 7:
mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0)
mknodat(r0, &(0x7f00000002c0)="2e2f66692e65318c", 0x0, 0x0)
r1 = fanotify_init(0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000100)={<r2=>0x0, <r3=>0x0})
futimesat(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={{r2, r3/1000+10000}})
fanotify_mark(r1, 0x11, 0x40000001, r0, &(0x7f0000000240)="2e2f66692e65318c00")
symlinkat(&(0x7f0000000000)="2e2f66692e65318c00", r0, &(0x7f0000000040)='./file0\x00')

21:40:35 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000001, 0xffffffffffffffff)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
mkdir(&(0x7f0000000180)='./file0\x00', 0x0)
mount(&(0x7f0000000080)='./file1\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000040)='ramfs\x00', 0x0, &(0x7f000000a000))
chdir(&(0x7f0000000000)='./file0\x00')
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, r0, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000))
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r2 = creat(&(0x7f0000000180)='./bus\x00', 0x0)
write$eventfd(r2, &(0x7f0000000080), 0xfffffe5e)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x32, 0xffffffffffffffff, 0x0)
fstat(r0, &(0x7f0000000100))
munmap(&(0x7f0000077000/0x2000)=nil, 0x2000)
ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f00000000c0)="2f30ced7749a")
dup2(r2, r1)

21:40:35 executing program 4:
stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0))
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x60, &(0x7f0000000040)={0x0, @dev={0xac, 0x14, 0x14, 0x2}, 0x4e22, 0x0, 'dh\x00', 0x0, 0x200000, 0x4}, 0x2c)

21:40:35 executing program 6:
r0 = inotify_init1(0x0)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, <r1=>0x0})
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ptrace(0x4207, r1)
r2 = socket(0xa, 0x1, 0x0)
r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x220040, 0x0)
write$selinux_access(r3, &(0x7f0000000440)={'system_u:object_r:tmpfs_t:s0', 0x20, '/usr/sbin/cupsd', 0x20, 0x4}, 0x42)
get_robust_list(0x0, &(0x7f0000000780)=&(0x7f0000000740)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x0, &(0x7f0000000700)={&(0x7f0000000280)}}, &(0x7f00000007c0)=0x18)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x5, 0x100)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00000003c0))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000580))
sync()
ioctl(r2, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f")
ptrace$setregset(0x4205, r1, 0x2, &(0x7f0000000100)={&(0x7f0000000040)="b8c3cd270e4307a0c8c00ac5004265bb2a66769b65b8a4b8983aa72f779eec53150ff1cb72afb1357a47264e595bdf189c893e4eba68809753cec17499d221eff86806ebc8d6600e9e3bd51cf77d7e2f37faaf3d4c741453", 0x58})
getsockopt$IP_VS_SO_GET_TIMEOUT(r2, 0x0, 0x486, &(0x7f00000001c0), &(0x7f00000002c0)=0xc)
r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0)
ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f00000004c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r2, &(0x7f0000000340)={0x2004})

21:40:35 executing program 7:
r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x2)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$KIOCSOUND(r1, 0x4b2f, 0x65cecd3e)
fcntl$getownex(r0, 0x10, &(0x7f0000000000))
write$P9_RXATTRCREATE(r1, &(0x7f0000000080)={0x7, 0x21, 0x2}, 0x7)
r2 = dup(r0)
getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f00000000c0)={@ipv4={[], [], @remote}, 0x8, 0x2, 0x2, 0x7, 0xffff, 0x6, 0x80000000}, &(0x7f0000000100)=0x20)
write$sndseq(r0, &(0x7f0000000000), 0x181)

[  130.259007] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000ad1)
[  130.271079] FAT-fs (loop0): Filesystem has been set read-only
[  130.286264] FAT-fs (loop0): error, fat_free_clusters: deleting FAT entry beyond EOF
[  130.300720] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000ad1)
21:40:35 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000fb6000)=""/28, 0x3f0)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf})
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f00000002c0)={0xffffff7f, 0x0, 'client0\x00', 0x0, "e1b460e3215c7c84", "82bc520a99453fb1bee724d5aaf19a46e9229731c3603cd24bda888240b9eca4"})
r1 = gettid()
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000))
tkill(r1, 0x1000000000014)

21:40:35 executing program 7:
r0 = epoll_create1(0xfffffffffffffffe)
r1 = epoll_create1(0x0)
r2 = socket(0x1, 0x1, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000140))
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000100))

21:40:35 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580)='/dev/zero\x00', 0x8000, 0x0)
linkat(r1, &(0x7f0000000540)='./file0\x00', r2, &(0x7f00000008c0)='./file0\x00', 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/loop-control\x00', 0x40, 0x0)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00')
ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000100))
r5 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r5)
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20400}, 0xc, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00042bbd7000fcdbdf250f00000014000200080002004e200000080002000000000000000800060003000000080005000104000008000400faffffff000000000000e33f97e2380000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0xc000}, 0x40)
sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0)
ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x2, &(0x7f0000000340)=[{0x0, 0x1008001}, {0xfffffffffffffffd, 0x8ae}]})
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0)
r6 = request_key(&(0x7f0000000640)='syzkaller\x00', &(0x7f0000000680)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000006c0)='\x00', 0xfffffffffffffff9)
keyctl$set_timeout(0xf, 0x0, 0x0)
ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000600))
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=<r7=>0x0)
keyctl$link(0x8, r6, r6)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00')
mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='pstore\x00', 0x0, 0x0)
write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000180)={0x30, 0x5, 0x0, {0x0, 0x3, 0x9, 0x4}}, 0x30)
umount2(&(0x7f00000002c0)='./file0\x00', 0x0)
ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f00000003c0)=""/12)
setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000400)=0x3, 0x4)
perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x3, 0x7, 0x100000001, 0x8, 0x0, 0x2, 0x800, 0x0, 0xfffffffffffffffa, 0xa3, 0x0, 0x20, 0x0, 0x0, 0x2, 0x5, 0x4355, 0x0, 0x800, 0x0, 0x0, 0x5, 0xff, 0x1, 0x400, 0x2, 0xfffffffffffffff9, 0x8001, 0x4, 0x0, 0x8, 0x2, 0x3, 0xe3f0, 0x8000, 0x6, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000040), 0x2}, 0x0, 0x0, 0x1f, 0x0, 0xff, 0x6, 0x7}, r7, 0x0, r0, 0x8)
accept4$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x0, @rand_addr}, &(0x7f0000000480)=0x10, 0x800)

21:40:35 executing program 5:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
listen(r0, 0xfffffffffffffffd)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f00001dcf48)=ANY=[@ANYBLOB="02032000100000000000000000000000010014000000000005000600000000000a0000000000000000000000000000000000000000000000000000000000000001001600000000000200010000000000000000000000000005000500000000000a00000000000000fe8800000000000000000000000000ff0000000000000000"], 0x80}}, 0x0)

21:40:35 executing program 2:
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000)="295ee1311f16")
r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000580)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000280)=0xffffff53)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
memfd_create(&(0x7f0000000200)='tmpfs\x00', 0x2)
socket$inet_tcp(0x2, 0x1, 0x0)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
symlink(&(0x7f00000000c0)='./control\x00', &(0x7f0000000100)='./file0/file0\x00')
r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x0, 0x0)
setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000b00)=ANY=[@ANYBLOB="feffffff0000000002004e227f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000900000002004e22ac14141900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e22ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f2ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e22e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000047d60000000000000000000000000000000000000000000000000000000002004e227f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e23ac14140c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008b645ea8f16b714f865924063a7ad8bc820b09ccbcbace074abf2e6a7b7aa81cb0451632c7e26728c51e225b7145e9d2623c65771952f1f04e4a32a33cb1a35c65abccd0435dc70b3c60b1fd77871cd68d5a7e0967a481ea4005171966c856324c63deae423fdbd0c869a78b6df76ff4482ab8ca8c6eda68c49132853a58f98d1b9fc4ebcab64b1f27df166a25f1f0714039e4f760f9b3e5fa1f25ab604d97f8c2775cf6451d0d"], 0x1)
ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, &(0x7f0000000480)=""/184)
mount(&(0x7f00000003c0)='./control\x00', &(0x7f0000000400)='./control\x00', &(0x7f0000000440)='tmpfs\x00', 0x0, 0x0)
r4 = getpgid(0x0)
fcntl$setownex(r3, 0xf, &(0x7f0000000240)={0x0, r4})
fcntl$setstatus(r1, 0x4, 0x2000)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6}]}, 0x10)
syz_open_dev$usbmon(&(0x7f0000000540)='/dev/usbmon#\x00', 0x1, 0x10000)
r5 = add_key(&(0x7f00000002c0)='dns_resolver\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000340)="8f5a02f81ac127d3ffef0ca8c1912fdf8eb5685e01fcbd3f93b01e0396459fa081fc19d7fb2ce50408566614677b1e08910ca6a8666e40d9181809cfe68ab66b4425fa", 0x43, 0xffffffffffffffff)
keyctl$assume_authority(0x10, r5)
sendmmsg(r1, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002240), 0x1ba, &(0x7f00000022c0)}}, {{0x0, 0x0, &(0x7f00000026c0), 0x0, &(0x7f0000002700)}}], 0x75a, 0x0)

[  130.347429] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000ff0)
[  130.354894] FAT-fs (loop0): error, invalid access to FAT (entry 0x00000202)
21:40:35 executing program 0:
syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[])
r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fdatasync(r0)
write$P9_RAUTH(r1, &(0x7f0000000200)={0x14, 0x67, 0x0, {0x0, 0x0, 0x6}}, 0x14)
dup2(r1, r0)
sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe)
pread64(0xffffffffffffffff, &(0x7f0000000240)=""/53, 0x35, 0x0)
write$P9_RXATTRCREATE(r0, &(0x7f0000000280)={0x7, 0x21, 0x2}, 0x7)
sendfile(r1, r0, &(0x7f0000001340), 0x100000001)

21:40:35 executing program 7:
syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[])
r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fdatasync(r0)
write$P9_RAUTH(r1, &(0x7f0000000200)={0x14, 0x67, 0x0, {0x0, 0x0, 0x6}}, 0x14)
dup2(r1, r0)
sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe)
pread64(0xffffffffffffffff, &(0x7f0000000240)=""/53, 0x35, 0x0)
write$P9_RXATTRCREATE(r0, &(0x7f0000000280)={0x7, 0x21, 0x2}, 0x7)
sendfile(r1, r0, &(0x7f0000001340), 0x100000001)

21:40:35 executing program 6:
r0 = inotify_init1(0x0)
fcntl$setown(r0, 0x8, 0xffffffffffffffff)
fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, <r1=>0x0})
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ptrace(0x4207, r1)
r2 = socket(0xa, 0x1, 0x0)
r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x220040, 0x0)
write$selinux_access(r3, &(0x7f0000000440)={'system_u:object_r:tmpfs_t:s0', 0x20, '/usr/sbin/cupsd', 0x20, 0x4}, 0x42)
get_robust_list(0x0, &(0x7f0000000780)=&(0x7f0000000740)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x0, &(0x7f0000000700)={&(0x7f0000000280)}}, &(0x7f00000007c0)=0x18)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x5, 0x100)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00000003c0))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000580))
sync()
ioctl(r2, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f")
ptrace$setregset(0x4205, r1, 0x2, &(0x7f0000000100)={&(0x7f0000000040)="b8c3cd270e4307a0c8c00ac5004265bb2a66769b65b8a4b8983aa72f779eec53150ff1cb72afb1357a47264e595bdf189c893e4eba68809753cec17499d221eff86806ebc8d6600e9e3bd51cf77d7e2f37faaf3d4c741453", 0x58})
getsockopt$IP_VS_SO_GET_TIMEOUT(r2, 0x0, 0x486, &(0x7f00000001c0), &(0x7f00000002c0)=0xc)
r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0)
ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f00000004c0)={&(0x7f0000ffe000/0x2000)=nil, 0x2000})
epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r2, &(0x7f0000000340)={0x2004})

21:40:36 executing program 5:
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x1, 0x31e)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = socket$key(0xf, 0x3, 0x2)
perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
accept4(r1, &(0x7f0000000200)=@nfc_llcp, &(0x7f0000000280)=0x80, 0x0)

21:40:36 executing program 6:
sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x5)
syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[])
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c)
accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000480), 0x0)
syz_open_dev$sndtimer(&(0x7f0000002840)='/dev/snd/timer\x00', 0x0, 0x200000)
r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
eventfd2(0x7470, 0x801)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002900)='autogroup\x00')
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
openat$keychord(0xffffffffffffff9c, &(0x7f0000002940)='/dev/keychord\x00', 0x0, 0x0)
openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002980)='cgroup.subtree_control\x00', 0x2, 0x0)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00000029c0))
ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r0, 0xc0305302, &(0x7f0000000300)={0x40, 0x59b00000000, 0xbd, 0x0, 0x1, 0x2})
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000002a00))
getgid()
getpgrp(0xffffffffffffffff)
getgroups(0x7, &(0x7f0000002c00)=[0xffffffffffffffff, 0xee00, 0xee01, 0xee00, 0x0, 0x0, 0xee01])
ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000200))
stat(&(0x7f0000002d40)='./file1\x00', &(0x7f0000002d80))
r2 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x40)
ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340))
r3 = accept$unix(r0, &(0x7f0000000280), &(0x7f0000000140)=0x6e)
write$binfmt_script(r3, &(0x7f0000000500)={'#! ', './file0/file1', [{0x20, '-'}, {0x20, 'team\x00'}, {}], 0xa, "394e4a7a6fd4bf862986ca0559710a26fa98d57f70e1a81ab75581c594de819f573cbf5b84b9b3a1bc45f22111ead7280186df8427130801f08d8709704ab2fc9b8f7ef666aa51b92300f8c557f862592281ae01a2c09d3bae6e69aa6297f2f44d5bbcc21684e35ab1ddc0638c9c655f152f5ddfe74664e498850c09a445af0e35c18f1442b0a6e2a3eabd25d29805a07e8014cc46677d1bfb93c7cbb51857347e72ba95e366f109003033a2f67e6886cf05eec8d7cdddb1634363193333072835e3176ff3985ebb771c9c8abb7859057108ecaff82cd46d4efd3a843c014f8873acebf398838253dd963989fb1877b4"}, 0x10a)
ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000240)={0x9, 0x3, 0x400, 0x100000000, 0x0, 0x3})
write$binfmt_elf64(r2, &(0x7f0000000180)=ANY=[], 0xfffffd97)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x0)

21:40:36 executing program 5:
r0 = syz_open_dev$sg(&(0x7f0000000180)='/dev/sg#\x00', 0xfffffffffffffffe, 0x0)
ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000000)=0x5181829a)
r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0)
write$P9_RWALK(r1, &(0x7f00000000c0)={0x8b, 0x6f, 0x2, {0xa, [{0x80, 0x0, 0x4}, {0x80, 0x4, 0x2}, {0x0, 0x2, 0x1}, {0x40, 0x2}, {0x8, 0x0, 0x3}, {0x4, 0x4, 0x8}, {0x88, 0x4, 0x3}, {0x1, 0x3, 0x1}, {0x0, 0x0, 0x7}, {0x2, 0x2, 0x4}]}}, 0x8b)
ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000480)={0xfffffffffffffebd})

[  130.717764] sched: DL replenish lagged too much
21:40:36 executing program 1:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580)='/dev/zero\x00', 0x8000, 0x0)
linkat(r1, &(0x7f0000000540)='./file0\x00', r2, &(0x7f00000008c0)='./file0\x00', 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/loop-control\x00', 0x40, 0x0)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00')
ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000100))
r5 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r5)
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20400}, 0xc, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00042bbd7000fcdbdf250f00000014000200080002004e200000080002000000000000000800060003000000080005000104000008000400faffffff000000000000e33f97e2380000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0xc000}, 0x40)
sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0)
ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x2, &(0x7f0000000340)=[{0x0, 0x1008001}, {0xfffffffffffffffd, 0x8ae}]})
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0)
r6 = request_key(&(0x7f0000000640)='syzkaller\x00', &(0x7f0000000680)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000006c0)='\x00', 0xfffffffffffffff9)
keyctl$set_timeout(0xf, 0x0, 0x0)
ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000600))
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=<r7=>0x0)
keyctl$link(0x8, r6, r6)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00')
mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='pstore\x00', 0x0, 0x0)
write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000180)={0x30, 0x5, 0x0, {0x0, 0x3, 0x9, 0x4}}, 0x30)
umount2(&(0x7f00000002c0)='./file0\x00', 0x0)
ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f00000003c0)=""/12)
setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000400)=0x3, 0x4)
perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x3, 0x7, 0x100000001, 0x8, 0x0, 0x2, 0x800, 0x0, 0xfffffffffffffffa, 0xa3, 0x0, 0x20, 0x0, 0x0, 0x2, 0x5, 0x4355, 0x0, 0x800, 0x0, 0x0, 0x5, 0xff, 0x1, 0x400, 0x2, 0xfffffffffffffff9, 0x8001, 0x4, 0x0, 0x8, 0x2, 0x3, 0xe3f0, 0x8000, 0x6, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000040), 0x2}, 0x0, 0x0, 0x1f, 0x0, 0xff, 0x6, 0x7}, r7, 0x0, r0, 0x8)
accept4$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x0, @rand_addr}, &(0x7f0000000480)=0x10, 0x800)

21:40:36 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580)='/dev/zero\x00', 0x8000, 0x0)
linkat(r1, &(0x7f0000000540)='./file0\x00', r2, &(0x7f00000008c0)='./file0\x00', 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/loop-control\x00', 0x40, 0x0)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00')
ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000100))
r5 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r5)
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20400}, 0xc, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00042bbd7000fcdbdf250f00000014000200080002004e200000080002000000000000000800060003000000080005000104000008000400faffffff000000000000e33f97e2380000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0xc000}, 0x40)
sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0)
ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x2, &(0x7f0000000340)=[{0x0, 0x1008001}, {0xfffffffffffffffd, 0x8ae}]})
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0)
r6 = request_key(&(0x7f0000000640)='syzkaller\x00', &(0x7f0000000680)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000006c0)='\x00', 0xfffffffffffffff9)
keyctl$set_timeout(0xf, 0x0, 0x0)
ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000600))
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=<r7=>0x0)
keyctl$link(0x8, r6, r6)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00')
mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='pstore\x00', 0x0, 0x0)
write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000180)={0x30, 0x5, 0x0, {0x0, 0x3, 0x9, 0x4}}, 0x30)
umount2(&(0x7f00000002c0)='./file0\x00', 0x0)
ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f00000003c0)=""/12)
setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000400)=0x3, 0x4)
perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x3, 0x7, 0x100000001, 0x8, 0x0, 0x2, 0x800, 0x0, 0xfffffffffffffffa, 0xa3, 0x0, 0x20, 0x0, 0x0, 0x2, 0x5, 0x4355, 0x0, 0x800, 0x0, 0x0, 0x5, 0xff, 0x1, 0x400, 0x2, 0xfffffffffffffff9, 0x8001, 0x4, 0x0, 0x8, 0x2, 0x3, 0xe3f0, 0x8000, 0x6, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000040), 0x2}, 0x0, 0x0, 0x1f, 0x0, 0xff, 0x6, 0x7}, r7, 0x0, r0, 0x8)
accept4$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x0, @rand_addr}, &(0x7f0000000480)=0x10, 0x800)

21:40:36 executing program 4:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='proc\x00', 0x0, &(0x7f00000001c0))
r1 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0)
getdents(r1, &(0x7f0000000100)=""/2, 0x1a1)
fcntl$notify(r1, 0x402, 0x1)
clone(0x4000000, &(0x7f0000000240)="b0df42fd", &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)="96449c28e23e5508394aaedeaf81f759057918086c554b04c2f79673cbc9e0f6de16d5bb1826bf7428c97383f9f8bbdb250b8a161ee689933189d1a22e6f281e5af9e41de9ed985d641d370399c94963702159d3ebb3713f13fd6e5a8c2a5ff32582e089f0982cb884e7df07bc0a64493df63adb7f046ea0bb2a9ff8d70a015c5733667e07da230018fac48ded3acdabd16f245fde80dedf24cff54be3432cc450fc5299f2025fddb06dbe5cc58b")
exit(0x0)
clock_gettime(0x0, &(0x7f0000000180)={<r2=>0x0, <r3=>0x0})
futimesat(r1, &(0x7f0000000140)='./file0\x00', &(0x7f0000000200)={{r2, r3/1000+10000}, {0x77359400}})
getdents64(r1, &(0x7f00000001c0)=""/57, 0xffffffffffffff04)

21:40:36 executing program 2:
r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x0, 0x0)
syz_genetlink_get_family_id$fou(&(0x7f0000000600)='fou\x00')
dup(0xffffffffffffffff)
sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000480), 0xc, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[]}}, 0x0)
r2 = perf_event_open(&(0x7f0000000180)={0x0, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000100))
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000240)=<r3=>0x0)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x800009, 0x4, 0x0, 0x0, r3})
sched_getscheduler(r3)
ioctl$BLKTRACESTART(r0, 0x1274, 0x0)
capset(&(0x7f00000001c0), &(0x7f0000000200)={0x10001, 0x9, 0x0, 0x9, 0xffffffffffffffff})
lookup_dcookie(0x20e, &(0x7f00000004c0)=""/171, 0xab)
stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280))
r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000002880)='/dev/hwrng\x00', 0x800, 0x0)
splice(r0, &(0x7f0000000380), r2, &(0x7f00000003c0), 0x9d, 0x8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00')
syz_genetlink_get_family_id$ipvs(&(0x7f0000002900)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f0000002a00)={&(0x7f00000028c0)={0x10, 0x0, 0x0, 0xe609a32e59765ff8}, 0xc, &(0x7f00000029c0)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="ad80610165698baf8329677170479770ba0d2e029cd75ea8ef63bd4630f2e9d781dcb58e6af4bb9f28c5a6bf0317ba288f7d32a788d50339dd7ce4b8ac8fe150423c5fef88a564386c820b90a899c4ac43e4078c5f4faca34a6e00cf329e4b85ea47fbc7e14f3461bcd98c4924d229b3cedc78a5ebb0987188194b6603e29eefb395bd0bcef685a1940e509c8421948e55b4fa6d647e2f9c634849197a130a889e12fd792c379804b64b0a4cff67b4f653d827d30563fafd0ee98c7fe3adbbf7a21699b3739e9adfda3f6196190423d96cd940c4a37ac17c4238323fcb67baa53574672cf6ce4cc3ccbab7fee336b7792c23cbce1c8c7c3190149389452c6e8886ed96370c4ce580cd013ed6f5314888b6d4bc9fea1ad22ce7fafeb56b31c1f55f3339232b69f77b5140248cca4d0ce1d82e605bba20436139dda605c3da4bdb58d712234511b0afc35730379578dd5a0b2171f92789d7150beb4d21b112cdac17b8b30acccd7b17814b237dd493fff94b5c60ad5c15b4774493900ae97d137bc118addbf2d3ad84b140aedc7993e59dec70d04e80ac2eeac28d0400e8418911cf937d55470ff6310006ce68a1e1a593cb431648de6f5c07249c927a27946693475e49fa706ad7735821c039c3644989f7820d35044312895a3a02d787bf2a4eba3852dd0a0769a9398110da24345797c0d3bdd18fdec58f0f54afb880165ee3f3eeaedbd46d"], 0x1}, 0x1, 0x0, 0x0, 0x40}, 0x80)
r5 = creat(&(0x7f0000000840)='./file0\x00', 0x100)
fsetxattr(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="62743000123201bb9b49f7717e0bd3c7ecf22888207f751c9a8073f1fc43f7b1445f24b528ce90419385bb763799611fb900000000000000000000000000000000"], &(0x7f0000000640)='lo8vboxnet0\x00', 0xc, 0x1)
openat$null(0xffffffffffffff9c, &(0x7f0000000580)='/dev/null\x00', 0x88100, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r4, 0x10e, 0x8, &(0x7f00000006c0)=0xffffffff7fffffff, 0x4)
syz_open_procfs(r3, &(0x7f00000005c0)='net/sctp\x00')
renameat2(r1, &(0x7f0000000780)='./file0\x00', r5, &(0x7f00000007c0)='./file0\x00', 0x7)
ioctl$BLKTRACESTOP(r0, 0x1275, 0x0)
ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0)

21:40:36 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000fb6000)=""/28, 0x3f0)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf})
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f00000002c0)={0xffffff7f, 0x0, 'client0\x00', 0x0, "e1b460e3215c7c84", "82bc520a99453fb1bee724d5aaf19a46e9229731c3603cd24bda888240b9eca4"})
r1 = gettid()
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000))
tkill(r1, 0x1000000000014)

21:40:36 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580)='/dev/zero\x00', 0x8000, 0x0)
linkat(r1, &(0x7f0000000540)='./file0\x00', r2, &(0x7f00000008c0)='./file0\x00', 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/loop-control\x00', 0x40, 0x0)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00')
ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000100))
r5 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r5)
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20400}, 0xc, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00042bbd7000fcdbdf250f00000014000200080002004e200000080002000000000000000800060003000000080005000104000008000400faffffff000000000000e33f97e2380000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0xc000}, 0x40)
sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0)
ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x2, &(0x7f0000000340)=[{0x0, 0x1008001}, {0xfffffffffffffffd, 0x8ae}]})
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0)
r6 = request_key(&(0x7f0000000640)='syzkaller\x00', &(0x7f0000000680)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000006c0)='\x00', 0xfffffffffffffff9)
keyctl$set_timeout(0xf, 0x0, 0x0)
ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000600))
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=<r7=>0x0)
keyctl$link(0x8, r6, r6)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00')
mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='pstore\x00', 0x0, 0x0)
write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000180)={0x30, 0x5, 0x0, {0x0, 0x3, 0x9, 0x4}}, 0x30)
umount2(&(0x7f00000002c0)='./file0\x00', 0x0)
ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f00000003c0)=""/12)
setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000400)=0x3, 0x4)
perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x3, 0x7, 0x100000001, 0x8, 0x0, 0x2, 0x800, 0x0, 0xfffffffffffffffa, 0xa3, 0x0, 0x20, 0x0, 0x0, 0x2, 0x5, 0x4355, 0x0, 0x800, 0x0, 0x0, 0x5, 0xff, 0x1, 0x400, 0x2, 0xfffffffffffffff9, 0x8001, 0x4, 0x0, 0x8, 0x2, 0x3, 0xe3f0, 0x8000, 0x6, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000040), 0x2}, 0x0, 0x0, 0x1f, 0x0, 0xff, 0x6, 0x7}, r7, 0x0, r0, 0x8)
accept4$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x0, @rand_addr}, &(0x7f0000000480)=0x10, 0x800)

21:40:36 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
capset(&(0x7f00001e8ff8)={0x19980330}, &(0x7f0000032fe8))
ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000040)={'irlan0\x00', {0x2, 0x0, @broadcast}})
setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000000)="a9631c0354636beff4b964d8f69281624eaf8f28fd85faba65b7455690c13ab9183e8dc09f25770e48d88132502a175d8cae1cbcf394f7a6b409f944f7cea0", 0x3f)

21:40:36 executing program 7:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = accept4$inet6(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000100)=0x1c, 0x80000)
ioctl$sock_SIOCDELDLCI(r2, 0x8981, &(0x7f0000000140)={'veth0_to_bridge\x00', 0x6})
r3 = fcntl$dupfd(r2, 0x0, r0)
ioctl$IOC_PR_REGISTER(r3, 0x401870c8, &(0x7f0000000180)={0xfffffffffffffffa, 0x1, 0x1})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r4 = socket$inet(0x2, 0x2, 0x0)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0x80, 0x0)
getsockopt$inet_int(r4, 0x0, 0xf, &(0x7f00006ed000), &(0x7f0000000000)=0x4)
r5 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0)
socket$inet(0x2, 0x7, 0x40)
ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f0000000080)={'sit0\x00', @broadcast})

21:40:36 executing program 0:
creat(&(0x7f0000000100)='./file0\x00', 0x0)
mount(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='./file0\x00', &(0x7f0000000180)='overlay\x00', 0x0, 0x0)
r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000001c0)="2e1d479f6b80882cccf17005459196a87d36138111e7fc13f1051e1ee41f5fa26c081afd9f2fe88667b397dad468c45c750a65f6e48220bada0be355afd07848c6745f6a60c510c15936c9c3d265b917fdb338ec694c89e1fbbe4d6342d84e7b50b6ec878c3bac48f373c91d63b7239710461daffc9d8308cd10c90d", 0x7c, 0xfffffffffffffffe)
r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0x0)
keyctl$negate(0xd, r0, 0x4, r1)

21:40:36 executing program 5:
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000580)='/dev/zero\x00', 0x8000, 0x0)
linkat(r1, &(0x7f0000000540)='./file0\x00', r2, &(0x7f00000008c0)='./file0\x00', 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000840)='/dev/loop-control\x00', 0x40, 0x0)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00')
ioctl$SG_GET_RESERVED_SIZE(r1, 0x2272, &(0x7f0000000100))
r5 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r5)
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20400}, 0xc, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00042bbd7000fcdbdf250f00000014000200080002004e200000080002000000000000000800060003000000080005000104000008000400faffffff000000000000e33f97e2380000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0xc000}, 0x40)
sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0)
ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x2, &(0x7f0000000340)=[{0x0, 0x1008001}, {0xfffffffffffffffd, 0x8ae}]})
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x0)
r6 = request_key(&(0x7f0000000640)='syzkaller\x00', &(0x7f0000000680)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000006c0)='\x00', 0xfffffffffffffff9)
keyctl$set_timeout(0xf, 0x0, 0x0)
ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000600))
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=<r7=>0x0)
keyctl$link(0x8, r6, r6)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000500)='IPVS\x00')
mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='pstore\x00', 0x0, 0x0)
write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000180)={0x30, 0x5, 0x0, {0x0, 0x3, 0x9, 0x4}}, 0x30)
umount2(&(0x7f00000002c0)='./file0\x00', 0x0)
ioctl$EVIOCGSND(0xffffffffffffffff, 0x8040451a, &(0x7f00000003c0)=""/12)
setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000400)=0x3, 0x4)
perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x3, 0x7, 0x100000001, 0x8, 0x0, 0x2, 0x800, 0x0, 0xfffffffffffffffa, 0xa3, 0x0, 0x20, 0x0, 0x0, 0x2, 0x5, 0x4355, 0x0, 0x800, 0x0, 0x0, 0x5, 0xff, 0x1, 0x400, 0x2, 0xfffffffffffffff9, 0x8001, 0x4, 0x0, 0x8, 0x2, 0x3, 0xe3f0, 0x8000, 0x6, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000040), 0x2}, 0x0, 0x0, 0x1f, 0x0, 0xff, 0x6, 0x7}, r7, 0x0, r0, 0x8)
accept4$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x0, @rand_addr}, &(0x7f0000000480)=0x10, 0x800)

[  131.309165] capability: warning: `syz-executor1' uses 32-bit capabilities (legacy support in use)
21:40:36 executing program 1:
r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x0, 0x1, 0x0, 0x4, 0xf722, 0x100000, 0x67}, 0x20)
fcntl$setstatus(r0, 0x4, 0x6100)
ftruncate(r0, 0x208200)
r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0)
r2 = socket$inet6(0xa, 0x80003, 0xfc)
connect$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2, 0x20000000000004}, 0x1c)
sendmmsg(r2, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000001180), 0x240, &(0x7f00000011c0)}}], 0x249, 0x0)
r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
sendfile(r0, r3, &(0x7f0000d83ff8), 0x8000fffffffe)

21:40:36 executing program 5:
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='pids.events\x00', 0x0, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x17, &(0x7f0000000080)=0x401, 0x4)
fcntl$addseals(0xffffffffffffffff, 0x409, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0)
set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18)
ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f00000011c0)={'ip_vti0\x00', 0x2})
socket$inet_udp(0x2, 0x2, 0x0)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000001200)=0x78, 0x4)
getsockopt$inet_tcp_int(r2, 0x6, 0x0, &(0x7f0000001340), &(0x7f00000013c0)=0x4)
bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10)
ioctl$TIOCGPTPEER(r0, 0x5441, 0x0)
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000001380)={0xff, 0x0, 0x1f, 0x9})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f00000010c0)=0xfd70, 0x4)
socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)={<r3=>0xffffffffffffffff})
syz_open_dev$ndb(&(0x7f0000000100)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x1b, &(0x7f00000001c0)=0x4, 0x4)
sendto$inet(r2, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000001100)={0x0, {{0x2, 0x4e24, @multicast1}}}, 0x88)
sendto$inet(r2, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140), &(0x7f0000000180))
r4 = syz_genetlink_get_family_id$fou(&(0x7f0000001240)='fou\x00')
getsockopt$IP6T_SO_GET_REVISION_TARGET(r3, 0x29, 0x45, &(0x7f00000002c0)={'ah\x00'}, &(0x7f0000000300)=0x1e)
sendmsg$FOU_CMD_GET(r1, &(0x7f0000001480)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x81000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001280)={0x30, r4, 0x0, 0x70bd2d, 0x25dfdbfb, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040840}, 0x40000)
bind(r2, &(0x7f0000000340)=@ipx={0x4, 0x4, 0x7a, "33a28702ed13", 0x8000}, 0x80)
openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0xc00, 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)

21:40:37 executing program 7:
syz_open_procfs(0x0, &(0x7f0000000140)='stat\x00')
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x1, 0x0)
ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000040))
sendfile(r0, r0, &(0x7f0000000000), 0x200)

[  131.526672] overlayfs: missing 'lowerdir'
21:40:37 executing program 7:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000182000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020f0000a6010000000000000000000008001200000083a287eeb4000000000006000000000000000000000000000000e00000010000000000000000000000000000000000000000000000000000000000000b00faff0000070000000000000003000500000000001c61d502000000ac14ffbb000000000000000001001800005cff19fb7bc7a21da1fc2943a0cf8c6b3b5e4756eeef20bbb6bd620325a0b7adfd54db5bcb93fb660f7814ba39bb68ef50f25ff24aa2eda7860dc49d98dce1ce4ec1258f1d1cf27cd2181b3513a6522849584634d1af276fa63ad37235b56417ebf1e1cf7a2267b4450dafece168b99f9a729d11919dd2d7ce5be3d74c21ea"], 0x88}}, 0x8080)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x800, 0x0)
symlinkat(&(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00')

[  131.577270] overlayfs: missing 'lowerdir'
21:40:37 executing program 6:
sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x5)
syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[])
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c)
accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000480), 0x0)
syz_open_dev$sndtimer(&(0x7f0000002840)='/dev/snd/timer\x00', 0x0, 0x200000)
r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
eventfd2(0x7470, 0x801)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002900)='autogroup\x00')
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
openat$keychord(0xffffffffffffff9c, &(0x7f0000002940)='/dev/keychord\x00', 0x0, 0x0)
openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002980)='cgroup.subtree_control\x00', 0x2, 0x0)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00000029c0))
ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r0, 0xc0305302, &(0x7f0000000300)={0x40, 0x59b00000000, 0xbd, 0x0, 0x1, 0x2})
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000002a00))
getgid()
getpgrp(0xffffffffffffffff)
getgroups(0x7, &(0x7f0000002c00)=[0xffffffffffffffff, 0xee00, 0xee01, 0xee00, 0x0, 0x0, 0xee01])
ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000200))
stat(&(0x7f0000002d40)='./file1\x00', &(0x7f0000002d80))
r2 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x40)
ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000340))
r3 = accept$unix(r0, &(0x7f0000000280), &(0x7f0000000140)=0x6e)
write$binfmt_script(r3, &(0x7f0000000500)={'#! ', './file0/file1', [{0x20, '-'}, {0x20, 'team\x00'}, {}], 0xa, "394e4a7a6fd4bf862986ca0559710a26fa98d57f70e1a81ab75581c594de819f573cbf5b84b9b3a1bc45f22111ead7280186df8427130801f08d8709704ab2fc9b8f7ef666aa51b92300f8c557f862592281ae01a2c09d3bae6e69aa6297f2f44d5bbcc21684e35ab1ddc0638c9c655f152f5ddfe74664e498850c09a445af0e35c18f1442b0a6e2a3eabd25d29805a07e8014cc46677d1bfb93c7cbb51857347e72ba95e366f109003033a2f67e6886cf05eec8d7cdddb1634363193333072835e3176ff3985ebb771c9c8abb7859057108ecaff82cd46d4efd3a843c014f8873acebf398838253dd963989fb1877b4"}, 0x10a)
ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000240)={0x9, 0x3, 0x400, 0x100000000, 0x0, 0x3})
write$binfmt_elf64(r2, &(0x7f0000000180)=ANY=[], 0xfffffd97)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x0)

21:40:37 executing program 0:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
ftruncate(0xffffffffffffffff, 0x0)
r2 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0)
mknod(&(0x7f0000000300)='./bus\x00', 0xfc9f73fa8eff0a1, 0x0)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10)
sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000340)={'security\x00', 0x2f, "e5399ef12573c5aa8e3056a61a3762721b096bf7c7e4bf40fc004c60ea40e1f35cd1273def5d63e1cf4245e74018a5"}, &(0x7f00000003c0)=0x53)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af)
ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000280))
r3 = socket$inet6(0xa, 0x1000000000002, 0x0)
setpriority(0x0, 0x0, 0xffe)
unshare(0x8000000)
r4 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x5})
mq_timedreceive(r4, &(0x7f0000000000)=""/24, 0x18, 0x0, 0x0)
mq_timedsend(r4, &(0x7f0000000100), 0x0, 0x0, 0x0)
ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000500))
getsockname(0xffffffffffffffff, &(0x7f0000000600)=@nfc, &(0x7f0000000680)=0x80)
write$binfmt_elf64(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7f45664600000000000000000000000000000000000000000000071ef4b8000040000000000000000000000000000000000000000000380000000000000000000000000000000000000000000000000000a51aaa9dee848e6d000000000000000000000000000000b6060000000000000300000000000000d0170000000000000000000000040000000000000000000000000000000000000000000000000000c67e9b79000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000fcff0000000000000000000000000000000000000000000000000000000000000000000000000000000000e94c82c48db881c78fd03a86b5bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x2af)
recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f00000002c0)=""/20, 0x14}, 0x100)
getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000400)=""/228, &(0x7f0000000540)=0xe4)
write$binfmt_elf64(r0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="7f454c460006610401000000000000000200030002000000120200000000000040000000000000000c02000000000000a6d10000030038000200ffffffff468051e57464030000000300000000f9ffffffffffffffff7f0000000000000600000000000000000800000000000005000000020000006f000000000000000000000000000000ea2b000000000000080000000000000003000000000000000800000000000000f8d1cf6bc8252c025b5f92a84bb4d5efd7201c0b3858f135eeae2dc7f0e87b4cb7c2ebe8e1bf26d90204e8796ae2234ab4507f89e0a927c56e06ac8486242f23306477b3ced713d9ccd7a0f1572c2cfeceaf21bfb67974157e7a4e10510b1d74ca0f796a92f62c8102c33ef139e0cf2ccd4388e8404194afc7dcb3c0580904a76736e493f5c3e2f26e041f6b30857e8c9b55fe64259328116a71513c065b05319d42f98f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c4459464273ba1e6b682472d8d753ed70000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1d5)
sendto$inet(0xffffffffffffffff, &(0x7f0000000580)="cc649bcf1524328e07f973a7f3f1244b", 0x10, 0x0, &(0x7f0000000200)={0x2, 0x0, @multicast1}, 0x10)
write$binfmt_elf64(r0, &(0x7f00000017c0)=ANY=[@ANYBLOB="7f454c4600250000050000000000000003003e00060000002c010000000000004000000000000000e1000000000000000500000087003800020002000700ea000200007001000000ea0a000000000000f7ffefffffffffff00000000ffffffff00000000000000000100000001000000010000000000000001000070040000000500000000000000000000000000000005000000000000000100000001000000ff0f00000000000000fcfffffffffffff423273d395b5dfe49a633eb0eb0263328129db30c89d614ca312379424593d1149401363a977a2b10bc8394762bab422771360aa38dc889b26829f721e3098b0f80c2f4ee55bcf0df04911af0a6a16e0ab5b5bb1e2227df0cb7b403be567ea3b9adef738dd4b7efbd9e56dfc0dc488a064d4ad246d477bc8fedb6c1fbcdb1469e544a6ac9afa9987b94c8d1209a41a79416931a8f43bd761418a2c47221a2a4d6bee2592cd6eab8fa3ac582965b48d68fb1dde708c9901874b0f1628c0adf0dc15872d102a327e9f073a52942892de4cc87c25e76cde841dd1e09db3f59955450018b682981af9bf3133a11fbf7915b41105bd663e6f7116777b3cb43f260d25a06d22119ca7674f7d9eeb496cccae5ea73758600072b6f0c2a040000002001cb9377fbc132be60c8b0bf6ac0a892b355685d62cb7077a1e889c359d7bfc544111c6ca232e6c6593a0b8f085567b065536d649fea6d4e202254fc1a0dedba780af208b0457ed33958cfd97c0155f59b06d997423bb3b6f3d5e01c8b74030434cacb0e50dcc661aff03a72021b6011f6ff05f6070f0bcb7d75cbf1668562cd6599dcf1eac792c47370ac83b2730215d9955f6fa81f59d3209fbaf52f41f8c413432d976fe6eb3ae98661de6250e09bcf7b82d0492b349ca022abade27ee2d41aa83ba7d2ed5193dda7e9c78769b1430e5a171e12e0fa1d057e1aef4b856ab0f2dabc8b207f09d78e1f83461ccac0b2558732ea70d369973971d2c6d94081f33308b1e4b27a2ce6f45838809407045aa63b6219d82564c7323f73bfc2260fd95e5e8eeca550b29adcca477de69469764858d7aa3ab8afd99e883c43dacae12ac88e7fea5a99df90755e5caf59185794ed6419a22fe36d9070ed6558b090cb871914491e2a135047b729107896b784bf3a50b7e52190176198b993c83b8bcec93aed20e900921e8c8e716321ad5664665e7f89839258d1477a2e8fceaa9280b9c9dc53b5ed4bd907c3942d8fac1eff961bf3040ae0faed3985bccc355506dfcd52907750828fc988e60aec5b577af9769cebc8d6e87a826826f8362c84fe7ec9e6d3cc39c1b6b6b9005eaaf0d9037fa576757018d3f60fbab576284cd7343e70a4b8143dc67e94c1090b7376eec330f5995c4b3a119646b4a953cf0669d6e52264827bbbae2c7565529a68f46f5e1a23137059867d0192caf6b22e2d74f8fbe12a139bc90a0d12b6acc0a106ba4fc2baf87c254bb540835206fc5f63dbc82581cec68813c331af00086cae971610587c4683d5f1b0dd68b8a419f581f0387cc9d1a435e329a0595d73a4489b1ea23c331ca752bfd46de13faee26e7e2e9b11dd7151883ac8112c0ba049070bcf00881cc0a37395f1a102cddda4b0b903b0233461e70254e6a75b9c29c02fce51b630d5cd58867e5f8e5b47fdb2fb53e0b9485f1079ddb39d7b3ef5d8d37be9a08714575e454274581a8ad758ba53da32d2c893e8a40de0febf31f84016558a9db7c53dec27895d69fa1a34e4b5b856f4d0974a9dd4031e28632a245b921a576f1a19f47d7ba08e9ca94a7ae46c89b379d90e0dfdcffb790586d920ea79f94af735aa51695dfe0c9c73a44b277e877b473b43f5c3a960d7c5e22678ab3f7cf46bdf23cbbd31df613827f8e23f7b2c71be25eab7dbd56f7b426b784583ec97db1659afc521a84e709cd879f8e5afe72366ffcd05c29b92ad591e35a19df805a2b89b9b87a13109c19ea941e9b9f6ee1c47708870abfda2debce7eae0f356bc70c257077f6bc3ed4186117e1ae9b861d3a9a94520a6df99fd700c6fc3b82467a1257c2040dd34b2fb30c032224e6b864900f93168e387edaeeedaebf8b7b40d4caaa97c85229e63770ced3382013fd11010d0ee46333666aaec98aacc511c92be9e55eee400c74ab4614552624ad88f5d63b6f87e85826ee7cf6f15418f9712c6d07f36a54f097d9bc48b3035ae569af4753e7831dc520fe4726d0c96d0cb7b45e5ca5002884d38ed8e8ead8d4a7da76f9bcfd848fd27345bec7dd4356ef7b11a0cd3113bd9d9bd72597daf8e25b987b6a17329b9c581e7e647eddd060553fd6e9194bc07ffc5ca9eb6e9ce36aa545ac0f6e242e381282522481668f05909a69db9c8f417ce2406fb727c11fa8ed3ec6f097fed51414f3286075c414753979f58a70d97539c1215ad15f4f2bdc9cb27e00245bb2291f767d4c581387a63022c727026043c0180a848edd1c3fffff21c3fe0b11c65caca8941959536882277e3dc9e61da52527a24e2d79a497a80b33b24f1ca184d56ad13194867d7a0a424977b5f256a4643460a03007ccf2abb042c6a8f357e8c67298f4ee68fa10d82aeec9c63884f43927692db04bfa6651a630ff1e945d5c2ceb1552d0cd69830f257e5d2b500e4447f03edc78938d82871b7075be875dee546cd23ae617356f51fe8f1fb11417e63a436d7ca0ecd22fab3719ab5b4a4fa0ac2b6a44002fdddb61f7d6fe2beac291455b144cff1da4cb487c430a42cd6dee2b0752536175bdeb3abf2a393823dddf4567d7a6ac785662eb272ea9ea223e0d63a2d027fc3bfa6da9c1537a5c207c9f2495bdc5ee28be938ad3dbdadee778875ba641ceb20f3fb23d57269a4e40e0baea56d0b4247f12ebb7cf6ee0e64b0d521c8636ca845287f752adfde004e37bee0451540bcabf455b432330cc5bdf77f66b07bf5423a80409e1e95424e2d63c09e621354d87d29d28758c290f29746e00e72e1f6ee9fc93841a7a4ec7420c1d78c09f9355b41c5b6a2e94d84218428a4e4e40bcab84f0cdc9a230101146a11e1f36367b4b5f21e76b5e58c31aec27a47e7ce6c22d29c553f03d0515199b541750e92718c53542cb8c0e4202c89b5bc2a4e3cd4fd1e33ba846b2d2d1c94d2e73327b1d327fe80ff1113634e2e94769b97a1088c2f00001fd26ffbf3b4b82036e960a01efd1eecb0e4cff79c5943cb7f3390757f2ebaa20ac131cddf19065dad03237cca7406b5c30228494fe25d9d26631795f3b0a16ac6c8c27e37a75bce127c582beed29fe6137efe5ac28a2a89597db794c570055e318e92f17f36e3fcbc68c8233d2f0c433f9e11b2819ade8026682c9c966d13605ba9cfa66d91f8203260ed06d8c53912b2c25be01165ebda24e3b70c4fa4a99c56470ee400000092272d6ba4a0906d5b8df7039b82bf83378b78ce124aca8b7944fffdd65bfca51e33614282fb1738dd43c6b95f2bc5e9b24605ff3fb5a06ece40c2c4a86b93acdde534777d47c5196e7ef7d65ff45606324b402aa6b81afa463f63f96bc442cd25a033b7b6feed08de0f00bccb16c439813c6c4b1d1733bb55a6245a9180ec71a7f31631613c60af161f5ef64493b859a6c4baa9e3811250984db538169178a4f4cb4141f74e366a28b4fdeef59bb22f6f525c493912a044bd99a3b4b86b2834a4f837d58d4292a22a730b6a2e5ec7bf358c2016326fff4889d5d5e1beec898a3a88d0f4a450d89a51d46190755bd42c1e53d4a1f80010da651d6c500a066afa9c98755acf643ff381af66742c6e091746c77e0f14f2583d6d70339ed50e9da34a0aa8820359872132179f087f16cdaf3636688927e39a857a99f911d08406b6addefa9f895f3b29812234eaf4d5a93b9363fa02a4ee9fe8676811004fabc8121f7639e9f92c0d7f796a6355e984d7a85aadc6220847666f8f52c4571516eb1a9fc487e918956411823e1edef555a61ba7d45931457b221bdcc8aaad58e8007497a8846278e0aed68926d3ea9fd96a89ccc89627c86da315c3eb5445bf799df613befe958390660f6c9f7ac02e3187100f18ea3bfacf9662601fc9868329b3524cb8c07850726355bd748f7c51b32e6c4341676cef6af55351e599d196d38d63bf0cd20b85f4bc79a2895b9c5c4d46090b4e1a10394f8ba7201d45d3878dc9b3e7ec3510073424b92a7448f9d8d9c15fff2a1c0e6dde7e6ad83f6243b21c6c14bd1b36e834b9cdc2b09022c0ddad8b5cdedb4a9e401acd96b77825cf6cb459e0c70b310c4d6f7a192c6766e75b4b50e64680b8bbe41065eac33f24c280ae6d89ef5fad05d8a9b635b052176cc3a9c2c9ffd43c0530deafd29079147dd34b5cd866e7feffe95f76695a40c216729ab52614000000000000000000d15fb7a1e1e415271a355e2920683606f9fc1e55e2bf1b5047b16c3c90280c51294756e33654a32aef0ba77bda88c545e20a6145a68d7dbf3e4ba0010fa7eeea87afa4d77297876614aebdc199a9da4b420083d16c28264dd3de22cd5add535914d9150c0efbeac1e113bd0942355438090f2b37d240238fe5a8f84e5456607e96a94254e12177ddc4399ec8dc6d26ec72e06f76c2b87ad2c42a"], 0xccf)
ioctl$LOOP_CHANGE_FD(r3, 0x4c06, r1)

21:40:37 executing program 7:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x20000, 0x0)
openat$cgroup_ro(r0, &(0x7f0000000080)='cpu.stat\x00', 0x0, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x4)
ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4), 0xffffffffffffffc3, 0x0, &(0x7f00000000c0)="9d5f6bb0e0de685882c97ffd5c2ffc2ce3c3a04f16fc58"})

21:40:37 executing program 2:
r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x0, 0x0)
syz_genetlink_get_family_id$fou(&(0x7f0000000600)='fou\x00')
dup(0xffffffffffffffff)
sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000480), 0xc, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[]}}, 0x0)
r2 = perf_event_open(&(0x7f0000000180)={0x0, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000100))
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000240)=<r3=>0x0)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x800009, 0x4, 0x0, 0x0, r3})
sched_getscheduler(r3)
ioctl$BLKTRACESTART(r0, 0x1274, 0x0)
capset(&(0x7f00000001c0), &(0x7f0000000200)={0x10001, 0x9, 0x0, 0x9, 0xffffffffffffffff})
lookup_dcookie(0x20e, &(0x7f00000004c0)=""/171, 0xab)
stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280))
r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000002880)='/dev/hwrng\x00', 0x800, 0x0)
splice(r0, &(0x7f0000000380), r2, &(0x7f00000003c0), 0x9d, 0x8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00')
syz_genetlink_get_family_id$ipvs(&(0x7f0000002900)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f0000002a00)={&(0x7f00000028c0)={0x10, 0x0, 0x0, 0xe609a32e59765ff8}, 0xc, &(0x7f00000029c0)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="ad80610165698baf8329677170479770ba0d2e029cd75ea8ef63bd4630f2e9d781dcb58e6af4bb9f28c5a6bf0317ba288f7d32a788d50339dd7ce4b8ac8fe150423c5fef88a564386c820b90a899c4ac43e4078c5f4faca34a6e00cf329e4b85ea47fbc7e14f3461bcd98c4924d229b3cedc78a5ebb0987188194b6603e29eefb395bd0bcef685a1940e509c8421948e55b4fa6d647e2f9c634849197a130a889e12fd792c379804b64b0a4cff67b4f653d827d30563fafd0ee98c7fe3adbbf7a21699b3739e9adfda3f6196190423d96cd940c4a37ac17c4238323fcb67baa53574672cf6ce4cc3ccbab7fee336b7792c23cbce1c8c7c3190149389452c6e8886ed96370c4ce580cd013ed6f5314888b6d4bc9fea1ad22ce7fafeb56b31c1f55f3339232b69f77b5140248cca4d0ce1d82e605bba20436139dda605c3da4bdb58d712234511b0afc35730379578dd5a0b2171f92789d7150beb4d21b112cdac17b8b30acccd7b17814b237dd493fff94b5c60ad5c15b4774493900ae97d137bc118addbf2d3ad84b140aedc7993e59dec70d04e80ac2eeac28d0400e8418911cf937d55470ff6310006ce68a1e1a593cb431648de6f5c07249c927a27946693475e49fa706ad7735821c039c3644989f7820d35044312895a3a02d787bf2a4eba3852dd0a0769a9398110da24345797c0d3bdd18fdec58f0f54afb880165ee3f3eeaedbd46d"], 0x1}, 0x1, 0x0, 0x0, 0x40}, 0x80)
r5 = creat(&(0x7f0000000840)='./file0\x00', 0x100)
fsetxattr(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="62743000123201bb9b49f7717e0bd3c7ecf22888207f751c9a8073f1fc43f7b1445f24b528ce90419385bb763799611fb900000000000000000000000000000000"], &(0x7f0000000640)='lo8vboxnet0\x00', 0xc, 0x1)
openat$null(0xffffffffffffff9c, &(0x7f0000000580)='/dev/null\x00', 0x88100, 0x0)
setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r4, 0x10e, 0x8, &(0x7f00000006c0)=0xffffffff7fffffff, 0x4)
syz_open_procfs(r3, &(0x7f00000005c0)='net/sctp\x00')
renameat2(r1, &(0x7f0000000780)='./file0\x00', r5, &(0x7f00000007c0)='./file0\x00', 0x7)
ioctl$BLKTRACESTOP(r0, 0x1275, 0x0)
ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0)

21:40:37 executing program 4:
r0 = memfd_create(&(0x7f0000000800)='@\x00', 0x2)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff)
setreuid(0x0, 0x0)
ftruncate(r0, 0x1000000)
read(r0, &(0x7f0000000000)=""/48, 0xfffffe18)

21:40:37 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b97000)={0x1, &(0x7f000048fff0)=[{0x6}]}, 0x10)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$TCSBRK(r1, 0x5409, 0x4)
getsockopt$sock_buf(r0, 0x1, 0x1a, &(0x7f0000000000)=""/1, &(0x7f0000561ffc)=0x1)

21:40:37 executing program 2:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = socket(0xa, 0x1, 0x0)
ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000003800000000010084200000001"])
ioctl(r1, 0x8916, &(0x7f0000000000))
ioctl(r1, 0x8936, &(0x7f0000000000))
r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
ftruncate(r2, 0x2008200)
r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
sendfile(r2, r3, &(0x7f0000d83ff8), 0x8000fffffffe)
r4 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0)
fallocate(r4, 0x8, 0x0, 0x10000)
write$eventfd(r2, &(0x7f0000000080), 0x8)

21:40:37 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000fb6000)=""/28, 0x3f0)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf})
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f00000002c0)={0xffffff7f, 0x0, 'client0\x00', 0x0, "e1b460e3215c7c84", "82bc520a99453fb1bee724d5aaf19a46e9229731c3603cd24bda888240b9eca4"})
r1 = gettid()
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000))
tkill(r1, 0x1000000000014)

[  132.144388] IPVS: length: 228 != 24
21:40:37 executing program 7:
r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xfffffffffffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, 0xffffffffffffffff)
mmap(&(0x7f00001bf000/0x1000)=nil, 0x1000, 0x0, 0x4011, r1, 0x0)
r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
ioctl$UI_GET_VERSION(r2, 0x8004552d, &(0x7f0000000100))
write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0xfffffc47)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r3, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7e}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x20004080)

21:40:37 executing program 1:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000040)='veth0_to_bridge\x00')
r1 = dup(r0)
write(r1, &(0x7f0000000000)="2400000058001f00ff07f4f9002304000a04f51108000100020100020800028001000000", 0x24)

21:40:37 executing program 6:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x10, 0x3, 0xc)
r1 = creat(&(0x7f0000000080)='./file0\x00', 0x4)
ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f00000000c0)=r0)
sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="24000000010207031dfffd946fa2830020200a0009000200001d85680c1baba20400ff7e", 0x24}], 0x1}, 0x0)
creat(&(0x7f0000000040)='./file0\x00', 0x82)

21:40:37 executing program 1:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000040)='veth0_to_bridge\x00')
r1 = dup(r0)
write(r1, &(0x7f0000000000)="2400000058001f00ff07f4f9002304000a04f51108000100020100020800028001000000", 0x24)

[  132.488481] attempt to access beyond end of device
[  132.493446] loop6: rw=536870912, want=130, limit=112
[  132.515339] Buffer I/O error on dev loop6, logical block 129, lost async page write
21:40:38 executing program 1:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x10000, 0x14)
ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000040))
ioctl$sock_netdev_private(r0, 0x89fc, &(0x7f00000000c0)="98e051a5fa55e594722db5490bb45ef664d00d03bd18ba65b93a5a21ac1048d0d65b91a3fe8d8d916e689b9443991b9d6201e712681f5b167954f450924c4c261bac8980eae14bcff3453443f64c88127fbfe3610da623f548e9d046e11e041ab4133a185ccf809d7a8401dd1125d346714c492d005c774f1cb62dbee97df542a4260636019246580a87ef886af0a7234791fb3566dcc6ae1f2c5bc1dbb707eae0295ecd23ebc042e8b4b34972b45b")
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0xc, &(0x7f0000000080)=0x5, 0x4)

[  132.549643] attempt to access beyond end of device
[  132.563312] loop6: rw=536870912, want=131, limit=112
[  132.577375] Buffer I/O error on dev loop6, logical block 130, lost async page write
21:40:38 executing program 5:
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='pids.events\x00', 0x0, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x17, &(0x7f0000000080)=0x401, 0x4)
fcntl$addseals(0xffffffffffffffff, 0x409, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0)
set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18)
ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f00000011c0)={'ip_vti0\x00', 0x2})
socket$inet_udp(0x2, 0x2, 0x0)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000001200)=0x78, 0x4)
getsockopt$inet_tcp_int(r2, 0x6, 0x0, &(0x7f0000001340), &(0x7f00000013c0)=0x4)
bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10)
ioctl$TIOCGPTPEER(r0, 0x5441, 0x0)
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000001380)={0xff, 0x0, 0x1f, 0x9})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f00000010c0)=0xfd70, 0x4)
socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)={<r3=>0xffffffffffffffff})
syz_open_dev$ndb(&(0x7f0000000100)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x1b, &(0x7f00000001c0)=0x4, 0x4)
sendto$inet(r2, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000001100)={0x0, {{0x2, 0x4e24, @multicast1}}}, 0x88)
sendto$inet(r2, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140), &(0x7f0000000180))
r4 = syz_genetlink_get_family_id$fou(&(0x7f0000001240)='fou\x00')
getsockopt$IP6T_SO_GET_REVISION_TARGET(r3, 0x29, 0x45, &(0x7f00000002c0)={'ah\x00'}, &(0x7f0000000300)=0x1e)
sendmsg$FOU_CMD_GET(r1, &(0x7f0000001480)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x81000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001280)={0x30, r4, 0x0, 0x70bd2d, 0x25dfdbfb, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040840}, 0x40000)
bind(r2, &(0x7f0000000340)=@ipx={0x4, 0x4, 0x7a, "33a28702ed13", 0x8000}, 0x80)
openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0xc00, 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)

21:40:38 executing program 1:
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
r1 = openat$cgroup_ro(r0, &(0x7f0000000140)='pids.events\x00', 0x0, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x17, &(0x7f0000000080)=0x401, 0x4)
fcntl$addseals(0xffffffffffffffff, 0x409, 0x0)
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0)
set_robust_list(&(0x7f0000000280)={&(0x7f0000000180), 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, 0x18)
ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f00000011c0)={'ip_vti0\x00', 0x2})
socket$inet_udp(0x2, 0x2, 0x0)
r2 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000001200)=0x78, 0x4)
getsockopt$inet_tcp_int(r2, 0x6, 0x0, &(0x7f0000001340), &(0x7f00000013c0)=0x4)
bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10)
ioctl$TIOCGPTPEER(r0, 0x5441, 0x0)
ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000001380)={0xff, 0x0, 0x1f, 0x9})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f00000010c0)=0xfd70, 0x4)
socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)={<r3=>0xffffffffffffffff})
syz_open_dev$ndb(&(0x7f0000000100)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0)
setsockopt$inet_tcp_int(r2, 0x6, 0x1b, &(0x7f00000001c0)=0x4, 0x4)
sendto$inet(r2, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000001100)={0x0, {{0x2, 0x4e24, @multicast1}}}, 0x88)
sendto$inet(r2, &(0x7f0000000000), 0xff6c, 0x1, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140), &(0x7f0000000180))
r4 = syz_genetlink_get_family_id$fou(&(0x7f0000001240)='fou\x00')
getsockopt$IP6T_SO_GET_REVISION_TARGET(r3, 0x29, 0x45, &(0x7f00000002c0)={'ah\x00'}, &(0x7f0000000300)=0x1e)
sendmsg$FOU_CMD_GET(r1, &(0x7f0000001480)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x81000000}, 0xc, &(0x7f0000001300)={&(0x7f0000001280)={0x30, r4, 0x0, 0x70bd2d, 0x25dfdbfb, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_IPPROTO={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040840}, 0x40000)
bind(r2, &(0x7f0000000340)=@ipx={0x4, 0x4, 0x7a, "33a28702ed13", 0x8000}, 0x80)
openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0xc00, 0x0)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)

[  132.609220] attempt to access beyond end of device
[  132.622619] loop6: rw=536870912, want=132, limit=112
[  132.639943] Buffer I/O error on dev loop6, logical block 131, lost async page write
[  132.683895] attempt to access beyond end of device
21:40:38 executing program 4:
r0 = memfd_create(&(0x7f0000000800)='@\x00', 0x2)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff)
setreuid(0x0, 0x0)
ftruncate(r0, 0x1000000)
read(r0, &(0x7f0000000000)=""/48, 0xfffffe18)

[  132.712209] loop6: rw=536870912, want=133, limit=112
[  132.738539] Buffer I/O error on dev loop6, logical block 132, lost async page write
[  132.762250] attempt to access beyond end of device
[  132.782798] loop6: rw=536870912, want=142, limit=112
[  132.803462] Buffer I/O error on dev loop6, logical block 141, lost async page write
[  132.839181] attempt to access beyond end of device
[  132.859622] loop6: rw=536870912, want=143, limit=112
[  132.881208] Buffer I/O error on dev loop6, logical block 142, lost async page write
[  132.914070] attempt to access beyond end of device
21:40:38 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000fb6000)=""/28, 0x3f0)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf})
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f00000002c0)={0xffffff7f, 0x0, 'client0\x00', 0x0, "e1b460e3215c7c84", "82bc520a99453fb1bee724d5aaf19a46e9229731c3603cd24bda888240b9eca4"})
gettid()
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000))

[  132.934510] loop6: rw=536870912, want=144, limit=112
[  132.947955] Buffer I/O error on dev loop6, logical block 143, lost async page write
[  133.004370] attempt to access beyond end of device
[  133.032663] loop6: rw=536870912, want=145, limit=112
[  133.054583] Buffer I/O error on dev loop6, logical block 144, lost async page write
[  133.090801] attempt to access beyond end of device
[  133.109631] loop6: rw=536870912, want=2193, limit=112
[  133.142645] attempt to access beyond end of device
[  133.153711] loop6: rw=536870912, want=4241, limit=112
[  133.174776] attempt to access beyond end of device
[  133.187002] loop6: rw=536870912, want=6289, limit=112
[  133.201158] attempt to access beyond end of device
[  133.213192] loop6: rw=536870912, want=8337, limit=112
[  133.220503] attempt to access beyond end of device
[  133.225554] loop6: rw=536870912, want=10385, limit=112
[  133.231920] attempt to access beyond end of device
[  133.237041] loop6: rw=536870912, want=10969, limit=112
[  133.242583] attempt to access beyond end of device
[  133.247660] loop6: rw=536870912, want=10998, limit=112
[  133.253075] Buffer I/O error on dev loop6, logical block 10997, lost async page write
[  133.261206] attempt to access beyond end of device
[  133.266263] loop6: rw=536870912, want=10999, limit=112
[  133.271684] Buffer I/O error on dev loop6, logical block 10998, lost async page write
[  133.280118] attempt to access beyond end of device
[  133.285184] loop6: rw=536870912, want=11000, limit=112
[  133.290620] attempt to access beyond end of device
[  133.295674] loop6: rw=536870912, want=11001, limit=112
[  133.301172] attempt to access beyond end of device
[  133.306240] loop6: rw=536870912, want=11022, limit=112
[  133.311666] attempt to access beyond end of device
[  133.316744] loop6: rw=536870912, want=11023, limit=112
[  133.322157] attempt to access beyond end of device
[  133.327241] loop6: rw=536870912, want=11024, limit=112
[  133.332652] attempt to access beyond end of device
[  133.337924] loop6: rw=536870912, want=11025, limit=112
[  133.343375] attempt to access beyond end of device
[  133.348453] loop6: rw=536870912, want=11074, limit=112
[  133.353870] attempt to access beyond end of device
[  133.358951] loop6: rw=536870912, want=11075, limit=112
[  133.364362] attempt to access beyond end of device
[  133.372915] loop6: rw=536870912, want=11076, limit=112
[  133.385414] attempt to access beyond end of device
[  133.395317] loop6: rw=536870912, want=11077, limit=112
[  133.407926] attempt to access beyond end of device
[  133.417801] loop6: rw=536870912, want=11086, limit=112
[  133.429162] attempt to access beyond end of device
[  133.439906] loop6: rw=536870912, want=11087, limit=112
[  133.451377] attempt to access beyond end of device
[  133.462171] loop6: rw=536870912, want=11088, limit=112
[  133.473447] attempt to access beyond end of device
[  133.500172] loop6: rw=536870912, want=11089, limit=112
[  133.521324] attempt to access beyond end of device
[  133.537102] loop6: rw=536870912, want=13137, limit=112
[  133.544305] attempt to access beyond end of device
[  133.554524] loop6: rw=536870912, want=15185, limit=112
[  133.562483] attempt to access beyond end of device
21:40:39 executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_int(r0, 0x29, 0x13, &(0x7f0000000040), &(0x7f0000000000)=0x3)

21:40:39 executing program 2:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = socket(0xa, 0x1, 0x0)
ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000003800000000010084200000001"])
ioctl(r1, 0x8916, &(0x7f0000000000))
ioctl(r1, 0x8936, &(0x7f0000000000))
r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0)
ftruncate(r2, 0x2008200)
r3 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
sendfile(r2, r3, &(0x7f0000d83ff8), 0x8000fffffffe)
r4 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0)
fallocate(r4, 0x8, 0x0, 0x10000)
write$eventfd(r2, &(0x7f0000000080), 0x8)

21:40:39 executing program 4:
r0 = memfd_create(&(0x7f0000000800)='@\x00', 0x2)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff)
setreuid(0x0, 0x0)
ftruncate(r0, 0x1000000)
read(r0, &(0x7f0000000000)=""/48, 0xfffffe18)

21:40:39 executing program 7:
r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xfffffffffffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, 0xffffffffffffffff)
mmap(&(0x7f00001bf000/0x1000)=nil, 0x1000, 0x0, 0x4011, r1, 0x0)
r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0)
ioctl$UI_GET_VERSION(r2, 0x8004552d, &(0x7f0000000100))
write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0xfffffc47)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, r3, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7e}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10}, 0x20004080)

21:40:39 executing program 1:
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, &(0x7f0000000280)}}], 0x3b0, 0x0, &(0x7f0000003280))
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
ioctl$TUNGETIFF(0xffffffffffffffff, 0x800454d2, &(0x7f0000000080))
r2 = fcntl$dupfd(r0, 0x0, r0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000000c0)={0x6, 0x8, 0x7fffffff, 'queue1\x00', 0x81})
r3 = syz_open_procfs(0x0, &(0x7f0000000040)='mounts\x00')
preadv(r3, &(0x7f00000017c0), 0x1d0, 0x0)
ftruncate(r0, 0x7fff)

21:40:39 executing program 5:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x400000, 0x0)
ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f00000001c0)=""/201)
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r2 = memfd_create(&(0x7f0000000040)='iso9660\x00', 0x1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x9)
syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000180)={[{@unhide='unhide'}]})
ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f00000002c0)={{0x7, 0x6}, {0x1, 0x10001}, 0x7, 0x6, 0x5})
r3 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c)
ioctl$VT_RELDISP(r3, 0x5605)

[  133.572229] loop6: rw=536870912, want=17233, limit=112
[  133.580046] attempt to access beyond end of device
[  133.584987] loop6: rw=536870912, want=19281, limit=112
[  133.591353] attempt to access beyond end of device
[  133.596284] loop6: rw=536870912, want=21329, limit=112
[  133.602805] attempt to access beyond end of device
[  133.607775] loop6: rw=536870912, want=23377, limit=112
[  133.615366] attempt to access beyond end of device
[  133.629798] loop6: rw=536870912, want=25425, limit=112
21:40:39 executing program 1:
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0))
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a})
ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)=0x81)

21:40:39 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = accept(r0, &(0x7f0000000000)=@nl=@proc, &(0x7f0000000100)=0x80)
setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000140)={0x1d, @loopback, 0x4e24, 0x2, 'dh\x00', 0x11, 0x6, 0x80000050}, 0x2c)
r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000240)='/dev/keychord\x00', 0x200040, 0x0)
ioctl$RTC_IRQP_READ(r3, 0x8008700b, &(0x7f0000000200))
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0x7)
ioctl$BLKIOMIN(r3, 0x1278, &(0x7f0000000280))
write$binfmt_elf64(r0, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78)
recvfrom$unix(r1, &(0x7f0000000080)=""/58, 0x78, 0x0, 0x0, 0x0)

[  133.654384] attempt to access beyond end of device
[  133.670657] ISOFS: Unable to identify CD-ROM format.
[  133.684355] loop6: rw=536870912, want=27473, limit=112
21:40:39 executing program 0:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'veth1\x00', <r1=>0x0})
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x20000, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="30ba6c93c9f67935405db7e07c315c8193cbcbf27933b12c707c439cddc0bda373573cc7109c3e45f39100ab12dfa4de782439ad1d2c279b5abe4cab8547c784877bd8aa7eb819ecde5e74241b7d404cfcf58cd729f707a7ec07100315a2462db7d320275d162a61ae77b1699b32653dbec04220b84ea02299f2aae3431b20404a8294a4ecfa52e18e8a89f11850f1fa5efac77559ccede73fb6d74660fcabfce2e53aae3d798face406d8a0f6cf4bc7b3f2fe3af3faf271180bf024342f939d9b4fec3c52bee7dc34428696aa49058dfbb5abece97ef70e9bd6ccf6f6684588e47a60c9a5225b4d7ebc279f", @ANYRES32=r1, @ANYRES32=r0], 0x3}}, 0x0)
ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=<r4=>0x0)
getsockopt$sock_int(r2, 0x1, 0xa, &(0x7f0000000200), &(0x7f0000000240)=0x4)
perf_event_open(&(0x7f0000000140)={0x5, 0x70, 0x2, 0x1, 0x8, 0xfffffffffffffffa, 0x0, 0xffffffff, 0x80, 0xf, 0x1ff, 0x7fff, 0x0, 0xa86, 0x400000, 0x80000000, 0x3f, 0xfffffffffffff001, 0x1, 0x5, 0x5, 0x95a, 0x8000, 0x80, 0x80000001, 0x9, 0xd40, 0x6, 0x2, 0xfffffffffffffffb, 0x3, 0x15, 0x3ff, 0x2, 0x1, 0xb610, 0x1, 0x100000000, 0x0, 0x5, 0x0, @perf_config_ext={0x0, 0xfffffffffffffffc}, 0x1, 0x7fcd, 0xffffffffffff0001, 0x0, 0x7, 0x1, 0x7fffffff}, r4, 0xe, 0xffffffffffffff9c, 0xb)
connect$l2tp(r2, &(0x7f0000000280)=@pppol2tpv3={0x18, 0x1, {0x0, r3, {0x2, 0x4e20, @remote}, 0x4, 0x4, 0x2, 0x1}}, 0x2e)

[  133.722552] attempt to access beyond end of device
[  133.742287] loop6: rw=536870912, want=29521, limit=112
[  133.773369] ISOFS: Unable to identify CD-ROM format.
[  133.807377] attempt to access beyond end of device
[  133.832936] loop6: rw=536870912, want=31569, limit=112
[  133.861874] attempt to access beyond end of device
[  133.880934] loop6: rw=536870912, want=32993, limit=112
21:40:39 executing program 6:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x20, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}}, 0x20}}, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f0000000000))
ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)})

21:40:39 executing program 5:
syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[])
r0 = creat(&(0x7f0000000280)='./file0\x00', 0x19c)
r1 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0)
fchdir(r1)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000001500)=<r2=>0x0)
ptrace$getregset(0x4204, r2, 0x1, &(0x7f0000001680)={&(0x7f0000001580)=""/194, 0xc2})
r3 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0)
ioctl$LOOP_SET_BLOCK_SIZE(0xffffffffffffffff, 0x4c09, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
recvfrom$inet(r1, &(0x7f0000000340)=""/4096, 0x1000, 0x10000, 0x0, 0x0)
write$P9_RAUTH(r3, &(0x7f0000000200)={0x14}, 0x14)
r4 = dup2(r3, 0xffffffffffffffff)
write$binfmt_aout(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="0000000000000000760000000000000000000000000000ef0600d000000000004e2311b580fb9e02bf40e2ce65d65659c2ee55eb581135e7a9ddda660a09"], 0x3e)
ioctl$sock_inet_tcp_SIOCOUTQNSD(r4, 0x894b, &(0x7f00000002c0))
ioctl$IOC_PR_PREEMPT(r0, 0x401870cb, &(0x7f0000001540)={0x400, 0x3a2, 0xd3, 0x7fd})
r5 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x0)
write$input_event(r3, &(0x7f00000014c0)={{}, 0x3, 0x8, 0x4}, 0x18)
ioctl$EVIOCSKEYCODE_V2(r5, 0x80284504, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x0, "4f019b55a1be58df7b55762023ad56d08f16133d2099807ad4d300"})
socket$nl_netfilter(0x10, 0x3, 0xc)
write$cgroup_type(r4, &(0x7f0000001400)='threaded\x00', 0xffffffffffffffe2)
accept(r4, &(0x7f0000001440)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x80)
sendfile(r3, r3, &(0x7f00000000c0), 0x8080fffffffe)
setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000240)={0x77359400}, 0x10)
ioctl$PIO_FONTX(r1, 0x4b6c, &(0x7f0000001340)="c2fe2b219e01a0eda0077fdb1a6b4f469643d9b01b6b702f1aa5f50e04657f9b109bd206dab2a6333addf9a35795b662d57cbe8a52835af9e58301a388bb5d6b1ec6eca6c866d5d9ea13f797293571e7d3b52894311e8515f78ae397cc69a130cff1e829ec62f6897866399b2a0fa8100985f8b13897e701f62e3462ee78e73eca4e9b24dae9e6e62033aa235ecc756db6")
inotify_init()
socket$inet6(0xa, 0x1000000000001, 0x5)

21:40:39 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000fb6000)=""/28, 0x3f0)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf})
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f00000002c0)={0xffffff7f, 0x0, 'client0\x00', 0x0, "e1b460e3215c7c84", "82bc520a99453fb1bee724d5aaf19a46e9229731c3603cd24bda888240b9eca4"})
gettid()
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040))
timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000))

21:40:39 executing program 1:
pipe2$9p(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}]}})
write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a)
write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}}, 0xa0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$P9_RWALK(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="160000006f0100010800000000000000000000000000"], 0x16)
write$P9_RGETATTR(r1, &(0x7f0000000540)={0xa0, 0x19, 0x1}, 0xa0)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access'}}]}})
listxattr(&(0x7f0000000400)='./file0/file0\x00', &(0x7f0000000440)=""/57, 0x39)

21:40:39 executing program 0:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
fcntl$getownex(r1, 0x10, &(0x7f0000000040))
sendmsg$netlink(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001dc0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000056f01975ea00fd7676800ebb36ee7f08be59cc2b19", @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00'], 0x18}, 0x0)

21:40:39 executing program 4:
r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = socket(0x10, 0x4000000000000002, 0x0)
ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000002c0)={"6c6f000000000000cdd7c268f17bd576", &(0x7f0000000480)=ANY=[@ANYBLOB="03000000c86171891adae410ba990cc5211f022e71b51c1006620f1b1998e89ec744015943c990e5e6fb283767a3665830ce0dba1d430c17d746dde35a4a557cae51aba72dada4ad2095c598e797ea34880450fbb04581b75dc270218975b2f5d74cec026ca652ad8cb1bf9a7a561bf15b38831b8616d1dcefb4c445667f384c3704b67a6e0ab5153a4d80a2512150f4145f8d0727c88bd847a8df6ed62764bbe8c56b8185cdd0de9c6314ea42bbb4830000000000000000000000000000000000000000fc4d950fb9ee5fb8cd0f9cbab75cfa1b9aefd74f8b305d854782f8b17df0ceb59e9a1a1cccf5ed1c05af6739948c1a1a23c9cc21e6657f3d34cff7166a6eabc30b0a8b9a5e6267f83c8ba4d28f23786e39e07d4ffda48edd86b6052bb7290e533d57f9c1d96fb38c749eada5b2ac8d814de3bc449d0e863e7bf237230cc8f9b7dad820c805833a66276245b44cdda04da463079f404f3ad83cf1f8ae9e648b4f788226da8d2777700ef05901b000a223679dbcfe4322c7dd7d7bc489275366d3bee3251461d969956f23c78edea6c08341b0ded39bf71410b64b415a06ef2bbd9ab4bc46ab6272b76daca1a932cab981"]})
setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000340), 0x4)
creat(&(0x7f0000000240)='./file0\x00', 0x0)
restart_syscall()
ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000140)={0x2, 0x0, [0x0, 0x0]})
perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000440)="776cd0c6d26f6d696d655f747970652d7472757374651d00e17f6c616eee74418a23a825a274727573746d647b5c7b47504c00", 0x0)
mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x4, 0x4011, r2, 0x0)
writev(r2, &(0x7f0000007000)=[{&(0x7f0000b23000)="82aaabfc6c5b1c7a6718badabd246d62c80270e00d637af19152d09e59a695e5ecb4b013dea5c5ab0458f38fca8bbf1404fe615f1e536e0f35664718", 0x3c}], 0x1)
symlink(&(0x7f0000004000)='./file0\x00', &(0x7f0000000180)='./control\x00')
rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)='./control\x00')
ioctl$RTC_PIE_ON(r2, 0x7005)
write$FUSE_WRITE(r2, &(0x7f0000000100)={0x18, 0x0, 0x2, {0x4}}, 0x18)

21:40:39 executing program 7:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000008100)='/dev/ppp\x00', 0x2000, 0x0)
ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f00000000c0)={'bcsh0\x00', {0x2, 0x4e22, @rand_addr=0x1}})
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f0000007e00))
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000007ec0)=0x80000000)
fsetxattr(r0, &(0x7f0000007f80)=ANY=[@ANYBLOB="73776c6e30407b766d6e65743170726f637365637572697479776c610000008a02dc9ec815c2eaeb1fd71048dbeb6cf779614b2b2ec9a30e6f0e68d0d0a45957b60e479573552b4df1dd0f893abb7d914f43e642dc960456edc1602b62b6581693733bc2193c5dce85bfc72319f66292857fdf56d0bab49747d336640e48313a012e8bc97c4ca2c2b10dea2b"], &(0x7f0000007f40)='/dev/ppp\x00', 0x9, 0x3)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
r2 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r2, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e)
recvmmsg(r2, &(0x7f0000007bc0)=[{{&(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000100)=""/164, 0xa4}], 0x1, &(0x7f0000000200)=""/52, 0x34, 0xfff}, 0x100000001}, {{&(0x7f0000000240)=@ethernet={0x0, @dev}, 0x80, &(0x7f0000001740)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/34, 0x22}, {&(0x7f0000001300)=""/236, 0xec}, {&(0x7f0000001400)=""/95, 0x5f}, {&(0x7f0000001480)=""/58, 0x3a}, {&(0x7f00000014c0)=""/197, 0xc5}, {&(0x7f00000015c0)=""/133, 0x85}, {&(0x7f0000001680)=""/138, 0x8a}], 0x8, &(0x7f00000017c0)=""/122, 0x7a, 0x3}, 0x7ff}, {{&(0x7f0000001840)=@pppoe={0x18, 0x0, {0x0, @random}}, 0x80, &(0x7f0000002a00)=[{&(0x7f00000018c0)=""/220, 0xdc}, {&(0x7f00000019c0)=""/20, 0x14}, {&(0x7f0000001a00)=""/4096, 0x1000}], 0x3, 0x0, 0x0, 0x3}}, {{&(0x7f0000002a40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000004e00)=[{&(0x7f0000002ac0)=""/104, 0x68}, {&(0x7f0000002b40)=""/4096, 0x1000}, {&(0x7f0000003b40)=""/239, 0xef}, {&(0x7f0000003c40)=""/233, 0xe9}, {&(0x7f0000003d40)=""/4096, 0x1000}, {&(0x7f0000004d40)=""/132, 0x84}], 0x6, &(0x7f0000004e80)=""/45, 0x2d, 0x7ff}, 0xc03}, {{&(0x7f0000004ec0)=@ax25, 0x80, &(0x7f0000007040)=[{&(0x7f0000004f40)=""/4096, 0x1000}, {&(0x7f0000005f40)=""/111, 0x6f}, {&(0x7f0000005fc0)=""/91, 0x5b}, {&(0x7f0000006040)=""/4096, 0x1000}], 0x4, &(0x7f0000007080)=""/134, 0x86, 0x6}, 0x3}, {{&(0x7f0000007140)=@xdp, 0x80, &(0x7f00000073c0)=[{&(0x7f00000071c0)=""/94, 0x5e}, {&(0x7f0000007240)=""/111, 0x6f}, {&(0x7f00000072c0)=""/198, 0xc6}], 0x3, 0x0, 0x0, 0x7fffffff}, 0x4}, {{&(0x7f0000007400)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000007a80)=[{&(0x7f0000007480)=""/180, 0xb4}, {&(0x7f0000007540)=""/100, 0x64}, {&(0x7f00000075c0)=""/98, 0x62}, {&(0x7f0000007640)=""/210, 0xd2}, {&(0x7f0000007740)=""/148, 0x94}, {&(0x7f0000007800)=""/158, 0x9e}, {&(0x7f00000078c0)=""/177, 0xb1}, {&(0x7f0000007980)=""/83, 0x53}, {&(0x7f0000007a00)=""/84, 0x54}], 0x9, &(0x7f0000007b40)=""/128, 0x80, 0x688}, 0x3}], 0x7, 0x10000, &(0x7f0000007d80))
close(r2)
close(r1)

21:40:39 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff)
recvfrom(r1, &(0x7f0000000180)=""/184, 0xfffffffffffffd84, 0x10100, 0x0, 0xfffffffffffffd51)

21:40:39 executing program 6:
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000800)={0x0, <r0=>0x0})
ptrace$poke(0x5, r0, &(0x7f0000000840), 0x1f)
r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = creat(&(0x7f0000000700)='./bus\x00', 0x100000000000000)
fcntl$setstatus(r2, 0x4, 0x6100)
ftruncate(r2, 0x8200)
lseek(r2, 0x0, 0x2)
write$binfmt_misc(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="3b5415a8df297eff722d7588f0b6ebdf7899969059717ecf96fd6845f85bc288f6c8fc25b3ab493df4f9d4bede8c7e0b6b3a111ec46bdb450af1b06eb23964960913fd095bd66f236d57ad7c9d1cf474fe4cceb7d994c5a0666f0112390d7f2a3d6ab6edd4b58642ed4e10c4f6e33bcf1513791382fd4c43c664264364d1aa93c0d0"], 0x82)
r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0)
setsockopt$inet6_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000140), 0x4)
getxattr(&(0x7f0000000680)='./bus\x00', &(0x7f00000006c0)=ANY=[@ANYBLOB="6f73322e473a6e6f64657662646501042d776c3c6e316c6f283b84596c459bedc2888077997575"], &(0x7f0000000740)=""/156, 0x9c)
ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000000c0))
setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0x7, &(0x7f0000000880)={0x9, 0x1, 0x4, 0x5}, 0x10)
r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0)
sendfile(r3, r4, &(0x7f0000000100), 0x401)
openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x410080, 0x82)
fstatfs(r1, &(0x7f00000008c0)=""/252)
fcntl$setstatus(r2, 0x4, 0x0)
sendfile(r2, r4, &(0x7f0000002780), 0x8000fffffffe)
ftruncate(r3, 0x0)

21:40:39 executing program 2:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = epoll_create1(0x0)
r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0)
getresuid(&(0x7f00000001c0)=<r3=>0x0, &(0x7f0000000200), &(0x7f0000000240))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, <r4=>0x0}, &(0x7f00000002c0)=0xc)
mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='fuse\x00', 0x2121080, &(0x7f0000000340)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@default_permissions='default_permissions'}]}})
r5 = epoll_create1(0x0)
fcntl$lock(r5, 0x7, &(0x7f0000000300)={0x1})
unshare(0x400)
fcntl$lock(r1, 0x7, &(0x7f0000000180))
r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
fchdir(r1)
ioctl$BLKTRACESTART(r6, 0x1274, 0x0)
fcntl$lock(r5, 0x7, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x7fffffffe})

21:40:39 executing program 4:
r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = socket(0x10, 0x4000000000000002, 0x0)
ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000002c0)={"6c6f000000000000cdd7c268f17bd576", &(0x7f0000000480)=ANY=[@ANYBLOB="03000000c86171891adae410ba990cc5211f022e71b51c1006620f1b1998e89ec744015943c990e5e6fb283767a3665830ce0dba1d430c17d746dde35a4a557cae51aba72dada4ad2095c598e797ea34880450fbb04581b75dc270218975b2f5d74cec026ca652ad8cb1bf9a7a561bf15b38831b8616d1dcefb4c445667f384c3704b67a6e0ab5153a4d80a2512150f4145f8d0727c88bd847a8df6ed62764bbe8c56b8185cdd0de9c6314ea42bbb4830000000000000000000000000000000000000000fc4d950fb9ee5fb8cd0f9cbab75cfa1b9aefd74f8b305d854782f8b17df0ceb59e9a1a1cccf5ed1c05af6739948c1a1a23c9cc21e6657f3d34cff7166a6eabc30b0a8b9a5e6267f83c8ba4d28f23786e39e07d4ffda48edd86b6052bb7290e533d57f9c1d96fb38c749eada5b2ac8d814de3bc449d0e863e7bf237230cc8f9b7dad820c805833a66276245b44cdda04da463079f404f3ad83cf1f8ae9e648b4f788226da8d2777700ef05901b000a223679dbcfe4322c7dd7d7bc489275366d3bee3251461d969956f23c78edea6c08341b0ded39bf71410b64b415a06ef2bbd9ab4bc46ab6272b76daca1a932cab981"]})
setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000340), 0x4)
creat(&(0x7f0000000240)='./file0\x00', 0x0)
restart_syscall()
ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000140)={0x2, 0x0, [0x0, 0x0]})
perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000440)="776cd0c6d26f6d696d655f747970652d7472757374651d00e17f6c616eee74418a23a825a274727573746d647b5c7b47504c00", 0x0)
mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x4, 0x4011, r2, 0x0)
writev(r2, &(0x7f0000007000)=[{&(0x7f0000b23000)="82aaabfc6c5b1c7a6718badabd246d62c80270e00d637af19152d09e59a695e5ecb4b013dea5c5ab0458f38fca8bbf1404fe615f1e536e0f35664718", 0x3c}], 0x1)
symlink(&(0x7f0000004000)='./file0\x00', &(0x7f0000000180)='./control\x00')
rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)='./control\x00')
ioctl$RTC_PIE_ON(r2, 0x7005)
write$FUSE_WRITE(r2, &(0x7f0000000100)={0x18, 0x0, 0x2, {0x4}}, 0x18)

21:40:39 executing program 1:
pipe2$9p(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}]}})
write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a)
write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}}, 0xa0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$P9_RWALK(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="160000006f0100010800000000000000000000000000"], 0x16)
write$P9_RGETATTR(r1, &(0x7f0000000540)={0xa0, 0x19, 0x1}, 0xa0)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access'}}]}})
listxattr(&(0x7f0000000400)='./file0/file0\x00', &(0x7f0000000440)=""/57, 0x39)

21:40:40 executing program 4:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = memfd_create(&(0x7f0000000100)='\x00', 0x2)
symlinkat(&(0x7f0000000040)='./file0\x00', r1, &(0x7f00000001c0)='./file0\x00')
sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x58, 0x10, 0x43307bd12b5744e9, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14}, @IFLA_MAP={0x24}]}, 0x58}}, 0x0)

[  134.626865] ==================================================================
[  134.634275] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100
[  134.641555] Read of size 4 at addr ffff8801cd0f0280 by task syz-executor7/7218
[  134.648910] 
[  134.650541] CPU: 0 PID: 7218 Comm: syz-executor7 Not tainted 4.9.124-g09eb2ba #31
[  134.658155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  134.667503]  ffff88019f99fa30 ffffffff81eb95e9 ffffea0007343c00 ffff8801cd0f0280
21:40:40 executing program 4:
socket$inet6(0xa, 0x80003, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040))
preadv(r0, &(0x7f0000000600)=[{&(0x7f0000000300)=""/99, 0x63}, {&(0x7f00000000c0)=""/62, 0x3e}, {&(0x7f0000000380)=""/27, 0x1b}, {&(0x7f00000003c0)=""/202, 0xca}, {&(0x7f00000004c0)=""/47, 0x2f}, {&(0x7f0000000500)=""/83, 0x53}, {&(0x7f0000000580)=""/87, 0x57}], 0x7, 0x0)
r1 = socket$inet(0x2, 0x4000000000000000, 0x6)
setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4)
r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/autofs\x00', 0x2, 0x0)
futimesat(r2, &(0x7f0000000100)='./file0\x00', &(0x7f0000000280)={{0x77359400}})
bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x1000000002f, &(0x7f0000000000), 0x4)
setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='yeah\x00', 0x5)
sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10)
recvmsg(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x0)
shutdown(r1, 0x1)

[  134.675566]  0000000000000000 ffff8801cd0f0280 0000000000000000 ffff88019f99fa68
[  134.683638]  ffffffff8156c35e ffff8801cd0f0280 0000000000000004 0000000000000000
[  134.691718] Call Trace:
[  134.694305]  [<ffffffff81eb95e9>] dump_stack+0xc1/0x128
[  134.699668]  [<ffffffff8156c35e>] print_address_description+0x6c/0x234
[  134.706334]  [<ffffffff8156c768>] kasan_report.cold.6+0x242/0x2fe
[  134.712565]  [<ffffffff836c3694>] ? l2tp_session_queue_purge+0xf4/0x100
[  134.719320]  [<ffffffff8153fad4>] __asan_report_load4_noabort+0x14/0x20
[  134.726075]  [<ffffffff836c3694>] l2tp_session_queue_purge+0xf4/0x100
[  134.732656]  [<ffffffff836cf2eb>] pppol2tp_release+0x1fb/0x2e0
[  134.738631]  [<ffffffff83018357>] __sock_release+0xd7/0x260
[  134.744340]  [<ffffffff830184e0>] ? __sock_release+0x260/0x260
[  134.750311]  [<ffffffff830184f9>] sock_close+0x19/0x20
[  134.755627]  [<ffffffff8157ca73>] __fput+0x263/0x700
[  134.760757]  [<ffffffff8157cf95>] ____fput+0x15/0x20
[  134.765961]  [<ffffffff8119a66c>] task_work_run+0x10c/0x180
[  134.771674]  [<ffffffff8116cd33>] get_signal+0x1133/0x1450
[  134.777304]  [<ffffffff81052637>] do_signal+0x87/0x19f0
[  134.782666]  [<ffffffff8157c7a2>] ? fput+0xd2/0x140
[  134.787717]  [<ffffffff8301eaaa>] ? SYSC_connect+0x22a/0x300
[  134.793621]  [<ffffffff810525b0>] ? setup_sigcontext+0x7d0/0x7d0
[  134.799764]  [<ffffffff83022adf>] ? SyS_recvmmsg+0xff/0x1c0
[  134.805472]  [<ffffffff8100554c>] ? exit_to_usermode_loop+0xac/0x120
[  134.811963]  [<ffffffff81005581>] exit_to_usermode_loop+0xe1/0x120
[  134.818632]  [<ffffffff810064d4>] do_syscall_64+0x364/0x490
21:40:40 executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x2}, 0x1c)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote}, 0x19)
r1 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000040)}}, &(0x7f0000000040))
sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[]}}, 0x0)
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x100008912, &(0x7f0000000100)="025cc80700145f8f764070")
ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000340)={0x0, 0x4, 0x3, 0x0, 0x0, [{r2, 0x0, 0x4}, {r2, 0x0, 0x3}, {r0, 0x0, 0x6}]})
r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x100, 0x0)
ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000180)={0x1, 0x20, 0x1, 0xffffffffffffff9c})
timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f00000001c0))
fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f00000003c0))
tkill(r1, 0x1000000000016)
ioctl$EVIOCGKEY(r3, 0x80404518, &(0x7f0000000240)=""/244)

[  134.824349]  [<ffffffff83a019d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
[  134.831270] 
[  134.832892] Allocated by task 7218:
[  134.836518]  save_stack_trace+0x16/0x20
[  134.840491]  save_stack+0x43/0xd0
[  134.843936]  kasan_kmalloc+0xc7/0xe0
[  134.847650]  __kmalloc+0x11d/0x300
[  134.851278]  l2tp_session_create+0x38/0x16f0
[  134.855685]  pppol2tp_connect+0x10d7/0x18f0
[  134.860004]  SYSC_connect+0x1b8/0x300
[  134.863796]  SyS_connect+0x24/0x30
[  134.867336]  do_syscall_64+0x1a6/0x490
[  134.871230]  entry_SYSCALL_64_after_swapgs+0x5d/0xdb
[  134.876320] 
[  134.877939] Freed by task 7251:
[  134.881222]  save_stack_trace+0x16/0x20
[  134.885192]  save_stack+0x43/0xd0
[  134.888650]  kasan_slab_free+0x72/0xc0
[  134.892540]  kfree+0xfb/0x310
[  134.895651]  l2tp_session_free+0x166/0x200
[  134.899883]  l2tp_tunnel_closeall+0x284/0x350
[  134.904373]  l2tp_udp_encap_destroy+0x87/0xe0
[  134.908862]  udpv6_destroy_sock+0xb1/0xd0
[  134.913008]  sk_common_release+0x6d/0x300
[  134.917153]  udp_lib_close+0x15/0x20
[  134.920863]  inet_release+0xff/0x1d0
[  134.924575]  inet6_release+0x50/0x70
[  134.928285]  __sock_release+0xd7/0x260
[  134.932168]  sock_close+0x19/0x20
[  134.935625]  __fput+0x263/0x700
[  134.938901]  ____fput+0x15/0x20
[  134.942176]  task_work_run+0x10c/0x180
[  134.946068]  exit_to_usermode_loop+0xfc/0x120
[  134.950560]  do_syscall_64+0x364/0x490
[  134.954444]  entry_SYSCALL_64_after_swapgs+0x5d/0xdb
[  134.959535] 
[  134.961159] The buggy address belongs to the object at ffff8801cd0f0280
[  134.961159]  which belongs to the cache kmalloc-512 of size 512
[  134.973825] The buggy address is located 0 bytes inside of
[  134.973825]  512-byte region [ffff8801cd0f0280, ffff8801cd0f0480)
[  134.985528] The buggy address belongs to the page:
[  134.990462] page:ffffea0007343c00 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
[  135.000788] flags: 0x8000000000004080(slab|head)
[  135.005533] page dumped because: kasan: bad access detected
[  135.011231] 
[  135.012852] Memory state around the buggy address:
[  135.017773]  ffff8801cd0f0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
21:40:40 executing program 1:
pipe2$9p(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000002c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}]}})
write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a)
write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}}, 0xa0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$P9_RWALK(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="160000006f0100010800000000000000000000000000"], 0x16)
write$P9_RGETATTR(r1, &(0x7f0000000540)={0xa0, 0x19, 0x1}, 0xa0)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access'}}]}})
listxattr(&(0x7f0000000400)='./file0/file0\x00', &(0x7f0000000440)=""/57, 0x39)

[  135.025126]  ffff8801cd0f0200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  135.032479] >ffff8801cd0f0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  135.039830]                    ^
[  135.043202]  ffff8801cd0f0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  135.050729]  ffff8801cd0f0380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  135.058080] ==================================================================
[  135.065430] Disabling lock debugging due to kernel taint
[  135.075018] Kernel panic - not syncing: panic_on_warn set ...
[  135.075018] 
[  135.081224] FAT-fs (loop5): error, invalid access to FAT (entry 0x00000ad1)
[  135.081240] FAT-fs (loop5): Filesystem has been set read-only
[  135.084788] FAT-fs (loop5): error, invalid access to FAT (entry 0x00000ad1)
[  135.089785] FAT-fs (loop5): error, invalid access to FAT (entry 0x00000ad1)
[  135.090405] FAT-fs (loop5): error, invalid access to FAT (entry 0x00000ad1)
[  135.116600] CPU: 0 PID: 7218 Comm: syz-executor7 Tainted: G    B           4.9.124-g09eb2ba #31
[  135.125426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  135.132033] FAT-fs (loop5): error, invalid access to FAT (entry 0x00000ad1)
[  135.132073] FAT-fs (loop5): error, invalid access to FAT (entry 0x00000ad1)
[  135.148944]  ffff88019f99f990 ffffffff81eb95e9 ffffffff843c828b 00000000ffffffff
[  135.157014]  0000000000000000 0000000000000000 0000000000000000 ffff88019f99fa50
[  135.165076]  ffffffff81423eb5 0000000041b58ab3 ffffffff843bb8e8 ffffffff81423cf6
[  135.173150] Call Trace:
21:40:40 executing program 3:
r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0)
read(r0, &(0x7f0000fb6000)=""/28, 0x3f0)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000001c0)={0xbf})
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f00000002c0)={0xffffff7f, 0x0, 'client0\x00', 0x0, "e1b460e3215c7c84", "82bc520a99453fb1bee724d5aaf19a46e9229731c3603cd24bda888240b9eca4"})
r1 = gettid()
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040))
tkill(r1, 0x1000000000014)

[  135.175737]  [<ffffffff81eb95e9>] dump_stack+0xc1/0x128
[  135.181096]  [<ffffffff81423eb5>] panic+0x1bf/0x3bc
[  135.186109]  [<ffffffff81423cf6>] ? add_taint.cold.6+0x16/0x16
[  135.192082]  [<ffffffff81003066>] ? ___preempt_schedule+0x16/0x18
[  135.198310]  [<ffffffff8156c27b>] kasan_end_report+0x47/0x4f
[  135.204104]  [<ffffffff8156c59c>] kasan_report.cold.6+0x76/0x2fe
[  135.210252]  [<ffffffff836c3694>] ? l2tp_session_queue_purge+0xf4/0x100
[  135.217006]  [<ffffffff8153fad4>] __asan_report_load4_noabort+0x14/0x20
[  135.223760]  [<ffffffff836c3694>] l2tp_session_queue_purge+0xf4/0x100
[  135.230337]  [<ffffffff836cf2eb>] pppol2tp_release+0x1fb/0x2e0
[  135.236301]  [<ffffffff83018357>] __sock_release+0xd7/0x260
[  135.242006]  [<ffffffff830184e0>] ? __sock_release+0x260/0x260
[  135.247967]  [<ffffffff830184f9>] sock_close+0x19/0x20
[  135.253221]  [<ffffffff8157ca73>] __fput+0x263/0x700
[  135.258310]  [<ffffffff8157cf95>] ____fput+0x15/0x20
[  135.263417]  [<ffffffff8119a66c>] task_work_run+0x10c/0x180
[  135.269128]  [<ffffffff8116cd33>] get_signal+0x1133/0x1450
[  135.275283]  [<ffffffff81052637>] do_signal+0x87/0x19f0
[  135.280643]  [<ffffffff8157c7a2>] ? fput+0xd2/0x140
[  135.285660]  [<ffffffff8301eaaa>] ? SYSC_connect+0x22a/0x300
[  135.291456]  [<ffffffff810525b0>] ? setup_sigcontext+0x7d0/0x7d0
[  135.297617]  [<ffffffff83022adf>] ? SyS_recvmmsg+0xff/0x1c0
[  135.303359]  [<ffffffff8100554c>] ? exit_to_usermode_loop+0xac/0x120
[  135.309847]  [<ffffffff81005581>] exit_to_usermode_loop+0xe1/0x120
[  135.316154]  [<ffffffff810064d4>] do_syscall_64+0x364/0x490
[  135.321851]  [<ffffffff83a019d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
[  135.329044] Dumping ftrace buffer:
[  135.332564]    (ftrace buffer empty)
[  135.336257] Kernel Offset: disabled
[  135.339860] Rebooting in 86400 seconds..