USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000400)={0xffffffffffffffff}, 0x117, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f00000004c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000380), 0x0, {0xa, 0x4e20, 0x800, @remote, 0x6}, r7}}, 0x38) ioctl$TCXONC(r6, 0x540a, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc058534f, &(0x7f0000000300)={{0xcc}, 0x0, 0x9, 0x8, {0x40, 0x1}, 0x8, 0x80f}) syz_open_procfs(0x0, &(0x7f0000000000)="2f65786500000000000409004bddd9de91be10eeaf000ee9a90f798058439ed554fa07424ada75af1f02ac06edbcd7a071fb35331ce39c5a00000000") write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000040)={0x28, 0x2, 0x0, {0x0, 0x8, 0x2}}, 0x28) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, &(0x7f0000000280), 0x10000030}}], 0x1, 0x0, &(0x7f0000003280)={0x0, 0x1c9c380}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') write$FUSE_LK(r4, &(0x7f0000000240)={0x28, 0x0, 0x2, {{0x722, 0xb57b, 0x0, r5}}}, 0x28) [ 267.317961] alloc_inode+0x80/0x190 [ 267.321603] new_inode_pseudo+0x71/0x1a0 [ 267.325695] ? prune_icache_sb+0x1c0/0x1c0 [ 267.329946] ? _raw_spin_unlock+0x2c/0x50 [ 267.334113] new_inode+0x1c/0x40 [ 267.337499] shmem_get_inode+0xf1/0x920 [ 267.341493] ? shmem_encode_fh+0x340/0x340 [ 267.345750] ? lock_downgrade+0x900/0x900 [ 267.349906] ? lock_release+0x970/0x970 [ 267.353893] ? arch_local_save_flags+0x40/0x40 [ 267.358491] ? usercopy_warn+0x110/0x110 [ 267.362585] __shmem_file_setup.part.45+0x83/0x2a0 [ 267.367550] shmem_file_setup+0x65/0x90 [ 267.371541] __x64_sys_memfd_create+0x2af/0x4f0 [ 267.376221] ? memfd_fcntl+0x1230/0x1230 [ 267.380328] do_syscall_64+0x1b9/0x820 [ 267.384231] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 267.389629] ? syscall_return_slowpath+0x5e0/0x5e0 [ 267.394572] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 267.399441] ? trace_hardirqs_on_caller+0x310/0x310 [ 267.404474] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 267.409512] ? prepare_exit_to_usermode+0x291/0x3b0 [ 267.414549] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 267.419421] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 267.424633] RIP: 0033:0x457569 [ 267.427841] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 267.446752] RSP: 002b:00007f67d7cb1a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 267.454474] RAX: ffffffffffffffda RBX: 0000000020000100 RCX: 0000000000457569 [ 267.461766] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000004bc78a 02:05:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 267.469046] RBP: 000000000072bf00 R08: 0000000000100020 R09: 00000000fbad8001 [ 267.476328] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f67d7cb26d4 [ 267.483650] R13: 00000000004c4a1e R14: 00000000004d7d88 R15: 0000000000000003 02:05:59 executing program 4 (fault-call:2 fault-nth:4): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:05:59 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="153f6234488dd25d766070") r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000940)=ANY=[@ANYBLOB="b702000007800000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4d0ff00000000b7060000ffffffff2d640500000000006504c0ffffffffffffff000001000000b7030000000000006a0a00fe000000008500000026000000b70000000000000095000000000000001182d83d36d87d43a5b4f8f7bc55d746c22b3ed6fcb6b01d818ca225f20beb1dbf2700bc581dacd9d4cd25ef4f5f634aab88bf0a0f1159186cb39b128dfaa1ee22a470d6f04fddf4fd0b3037767b11216810307d046fbc3c5a"], &(0x7f0000000340)='GPL\x00'}, 0x48) recvmsg(r0, &(0x7f00000001c0)={&(0x7f00000000c0)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000380)=""/224, 0xe0}, {&(0x7f0000000140)=""/14, 0xe}, {&(0x7f0000000600)=""/254, 0xfe}, {&(0x7f0000000700)=""/249, 0xf9}, {&(0x7f0000000180)=""/15, 0xf}], 0x5, &(0x7f0000000800)=""/150, 0x96, 0x1ff}, 0x40) sendto(r0, &(0x7f0000000040), 0x0, 0x10, &(0x7f00000008c0)=@hci={0x1f, r2, 0x3}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000080)="3c2dbcd4057b6c6a639a2f0086dd", &(0x7f0000000500)=""/215, 0x3ffe}, 0x28) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000300)=0x8) 02:05:59 executing program 1: r0 = getpid() capset(&(0x7f0000000440)={0x20080522, r0}, &(0x7f0000000100)={0xe609, 0x2, 0x5, 0x4, 0x1, 0xfffffffffffff0e4}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000007440), 0x0, 0x0, &(0x7f00000003c0)) ptrace$setregs(0x2921de7b1829906, r0, 0x9, &(0x7f0000000500)="b53435e2069d6cd25354fd3cfef281cccbebf7a92b9e1381980a2dfac02e6636a195b455c69437f8dba51f9760756f1061b58db2dbec4622576926ddaaab2ce7535478e2fc69189b0d77ca55038d3643d1fa537324b744a2b7561301faf0ad073d30e830311878f28723d4ee17182de6fd27ddb3c07fb26c8a7a3c64cb2a4dcde7a24b2e7912d9a1b62976f92f741ad80b7badc6716f108fe46c346475afed76a33d568a25324bc764f6d2a5448e48496b7f1fea5e837dc595636678") r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000280)=0x800) getpid() ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000180)={0x1, 0xfff, 0x100000000, 'queue1\x00', 0x10}) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xb) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000140)) r5 = gettid() kcmp$KCMP_EPOLL_TFD(r5, r5, 0x7, r3, &(0x7f0000000000)={r4}) r6 = syz_open_pts(r3, 0x0) close(r3) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000400)={0xffffffffffffffff}, 0x117, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f00000004c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000380), 0x0, {0xa, 0x4e20, 0x800, @remote, 0x6}, r7}}, 0x38) ioctl$TCXONC(r6, 0x540a, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r2, 0xc058534f, &(0x7f0000000300)={{0xcc}, 0x0, 0x9, 0x8, {0x40, 0x1}, 0x8, 0x80f}) syz_open_procfs(0x0, &(0x7f0000000000)="2f65786500000000000409004bddd9de91be10eeaf000ee9a90f798058439ed554fa07424ada75af1f02ac06edbcd7a071fb35331ce39c5a00000000") write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f0000000040)={0x28, 0x2, 0x0, {0x0, 0x8, 0x2}}, 0x28) syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, &(0x7f0000000280), 0x10000030}}], 0x1, 0x0, &(0x7f0000003280)={0x0, 0x1c9c380}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') write$FUSE_LK(r4, &(0x7f0000000240)={0x28, 0x0, 0x2, {{0x722, 0xb57b, 0x0, r5}}}, 0x28) 02:05:59 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @ipv4={[], [], @rand_addr}}}}, 0x108) preadv(0xffffffffffffffff, &(0x7f00000014c0)=[{&(0x7f0000000140)=""/4096, 0x1000}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') preadv(r1, &(0x7f0000001800)=[{&(0x7f0000001980)=""/249, 0xf9}, {&(0x7f0000001240)=""/207, 0xcf}, {&(0x7f0000001340)=""/158, 0x9e}, {&(0x7f0000001500)=""/212, 0xd4}, {&(0x7f0000001600)=""/209, 0xb5}, {&(0x7f0000001880)=""/233, 0xe9}, {&(0x7f0000001400)=""/122, 0x7a}], 0x7, 0x0) 02:05:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fsetxattr$security_smack_transmute(r0, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x1) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000029b026b14664c1fcbae8ac1bb7084afa0c4af191fae991c113f4d13601a0a7d9950c9862795774964930ed03ccb8a5abd5d294f0ba660939caec1f65d2f7f72e43938df2ac3b352d3de181d6d6a0dd9ac1d8614e48ff5bef269f20d8ac2cc70f7fe16e4d9ed97a8e6a6e99e837a25eb49c5c7b34e26662ec9ae06cae50e8257532bda85a1598ed8ff5aeef9cf579e75a75b6630df2207cd48b8e248dfe5fc69520d213d683394458e59e988d95e06eb470fc057bd372"], &(0x7f0000000140)=0x8) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) fanotify_mark(0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, &(0x7f00000004c0)='./file0\x00') ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000011000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x2000, 0x1}) r5 = getpgid(0x0) syz_open_procfs$namespace(r5, &(0x7f00000000c0)='ns/net\x00') close(r2) 02:05:59 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 268.216292] FAULT_INJECTION: forcing a failure. [ 268.216292] name failslab, interval 1, probability 0, space 0, times 0 [ 268.256933] CPU: 0 PID: 8045 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 268.264154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 268.273511] Call Trace: [ 268.276124] dump_stack+0x1c4/0x2b4 [ 268.279778] ? dump_stack_print_info.cold.2+0x52/0x52 [ 268.285002] should_fail.cold.4+0xa/0x17 [ 268.289079] ? graph_lock+0x170/0x170 [ 268.292907] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 268.298020] ? smack_d_instantiate+0x136/0xea0 [ 268.302625] ? kasan_kmalloc+0xc7/0xe0 02:05:59 executing program 2: r0 = accept$inet(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000000100)=""/158, &(0x7f00000001c0)=0x9e) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0xffffffffffffffff) r1 = open(&(0x7f0000000000)='./file0\x00', 0x40002, 0x0) mmap(&(0x7f0000000000/0xb000)=nil, 0xb000, 0x1, 0x4031, 0xffffffffffffffff, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r1, 0xc028660f, &(0x7f0000000040)) r2 = add_key(&(0x7f0000000280)='logon\x00', &(0x7f00000002c0)={'syz', 0x3}, &(0x7f0000000300)="720700000083fc", 0x7, 0xfffffffffffffffe) fcntl$setlease(r0, 0x400, 0x1) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, r2) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000340)={0x4cd0, 0x6c, "fa2d630c82a5700f132749c92e712742064ee735a4a7caea5c098274137ea68c74d8db1b8c799c36d7cd3a3546922ed7923eed408382756f59cba832132827efa0108eb3459ab80c9da3d752118e5de82ce4a0c6dd7a0a708f59f458db9bd5b1a2d1b2d0fe6eaf0f10a7563f"}) [ 268.306527] ? kasan_slab_alloc+0x12/0x20 [ 268.310693] ? graph_lock+0x170/0x170 [ 268.314515] ? graph_lock+0x170/0x170 [ 268.318331] ? find_held_lock+0x36/0x1c0 [ 268.322430] ? ___might_sleep+0x1ed/0x300 [ 268.326595] ? arch_local_save_flags+0x40/0x40 [ 268.331204] ? lock_downgrade+0x900/0x900 [ 268.335379] __should_failslab+0x124/0x180 [ 268.339646] should_failslab+0x9/0x14 [ 268.343466] kmem_cache_alloc+0x2be/0x730 [ 268.347644] ? kasan_check_write+0x14/0x20 [ 268.351920] __alloc_file+0xa8/0x470 02:05:59 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000340)) fgetxattr(r0, &(0x7f0000000140)=@known='trusted.overlay.origin\x00', &(0x7f0000000180)=""/125, 0x7d) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f00000000c0)="ad9139e5c9f36fb0cc5d7be247eae63f2760296a25d1443b62722cc4fb154eb95a718e480a16a96deedef8d4333b7dd147976c5f24a2d30ea958e2a7fc2da5819f2c6bcdbc289843cbf238133f8721", 0x4f, 0xfffffffffffffff8) keyctl$assume_authority(0x10, r2) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x8bafa80d526e70b3, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffff9c, 0x84, 0x7b, &(0x7f0000000240)={0x0, 0x7f}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000300)={r4, 0x2}, &(0x7f0000000380)=0x8) ioctl$KVM_SET_PIT(r1, 0xae71, &(0x7f0000000400)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}]}) [ 268.355661] ? file_free_rcu+0xd0/0xd0 [ 268.359644] ? d_instantiate+0x79/0xa0 [ 268.363552] ? lock_downgrade+0x900/0x900 [ 268.367721] ? kasan_check_read+0x11/0x20 [ 268.371892] ? do_raw_spin_unlock+0xa7/0x2f0 [ 268.376319] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 268.380925] alloc_empty_file+0x72/0x170 [ 268.384996] alloc_file+0x5e/0x4d0 [ 268.388544] ? _raw_spin_unlock+0x2c/0x50 [ 268.392707] alloc_file_pseudo+0x261/0x3f0 [ 268.396960] ? alloc_file+0x4d0/0x4d0 [ 268.400785] ? usercopy_warn+0x110/0x110 [ 268.404863] ? kasan_check_write+0x14/0x20 [ 268.404897] __shmem_file_setup.part.45+0x110/0x2a0 [ 268.404921] shmem_file_setup+0x65/0x90 [ 268.404940] __x64_sys_memfd_create+0x2af/0x4f0 [ 268.422818] ? memfd_fcntl+0x1230/0x1230 [ 268.426918] do_syscall_64+0x1b9/0x820 [ 268.430830] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 268.436207] ? syscall_return_slowpath+0x5e0/0x5e0 [ 268.441147] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 268.446004] ? trace_hardirqs_on_caller+0x310/0x310 [ 268.451029] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 268.456055] ? prepare_exit_to_usermode+0x291/0x3b0 [ 268.461080] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 268.465937] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 268.471128] RIP: 0033:0x457569 [ 268.474324] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 268.493228] RSP: 002b:00007f67d7cb1a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 268.500941] RAX: ffffffffffffffda RBX: 0000000020000100 RCX: 0000000000457569 02:05:59 executing program 0: set_mempolicy(0x4003, &(0x7f0000000140)=0x6, 0x9) r0 = creat(&(0x7f0000000340)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x43ffe) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r0, 0x0, 0x0, 0xa6ba0) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000380)=ANY=[@ANYRES32=r0, @ANYBLOB="0800000085ff8965caf4910206333c855ea13e7555f287b99c450cab0ebcae21e10c7f673ba4a2b86fc2d43627fc1cce5f575d281134c48d76307fe48579d5f16df642cf03832bc8e00dfde23ebf4e996a94440b91914592d8b7db375e0abdc62d829437bc45ca36becd03dfc3d57580a3f06db41e18ffffffff3fe42f65b5"]) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) io_submit(r1, 0x653, &(0x7f0000000540)=[&(0x7f00000000c0)={0x804000000000000, 0xff01000000000000, 0x8, 0x1, 0xff01000000000000, r0, &(0x7f0000000000), 0x377140be6b5ef4c7, 0xc00}]) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x202, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x5c831, 0xffffffffffffffff, 0x0) [ 268.508213] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000004bc78a [ 268.515486] RBP: 000000000072bf00 R08: 0000000000100020 R09: 00000000fbad8001 [ 268.522757] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f67d7cb26d4 [ 268.530027] R13: 00000000004c4a1e R14: 00000000004d7d88 R15: 0000000000000003 02:05:59 executing program 4 (fault-call:2 fault-nth:5): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:05:59 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:05:59 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x20000, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f00000001c0)={0x0, r0, 0x75, 0x4, 0x9f, 0x10001}) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000080)={0x28, 0x2, 0x0, {0x5, 0x1, 0x7fffffff}}, 0x28) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0xfffffffffffffffd) ioctl$KVM_X86_SETUP_MCE(r3, 0x9000aea4, &(0x7f00000000c0)) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000140)={{0x9, 0x6}, {0x0, 0x7}, 0x8, 0x4, 0x9b5}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x400000, 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000200)={0x6, 0xf5, 0x4, 0x6e06}) 02:05:59 executing program 3: r0 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x478, 0x10000) ioctl$KVM_SET_GUEST_DEBUG(r0, 0x4048ae9b, &(0x7f0000000180)={0x0, 0x0, [0x1f, 0x9, 0x1, 0x33e, 0x0, 0xadb, 0x6, 0xd48]}) r1 = memfd_create(&(0x7f0000000040)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) write$binfmt_aout(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="cc00000000000000aa"], 0x5) ioctl$NBD_DISCONNECT(r1, 0xab08) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f00000000c0)) execveat(r1, &(0x7f0000000000)='\x00', &(0x7f00000007c0), &(0x7f0000000240), 0x1000) 02:05:59 executing program 1: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000200)="680c4c067e5cf188f070c2c4f5d7aad9eba35d38314a81ef590dfdc53ff08f8c695a4f5fe4cc3597b50d98293a70cdb3dcc5922cd125f0200953e8ec9e973129bb26e9b4fc36e287cd0b80b874378114d9668cf455122278a8af3489a803e773e890d8a7a3084e3bf242f380df846b844b47ad7fc32ac369cbe8994990bae24967c0779b0960ad4d3c5848d11dc3b4f8911923fd4dfa7cde9eadf90e27017bb55c43b9d8100ee720d5ad899d9214e2c1fed64986bc36c3cfc725d014402e0db285a62c01f7fbbf37c421f04a920eb4371e3193f98aa4b9f48be514267cf2c080f8e785f01608210be76a8f6f44fdfb25bd834b674ca155288a5f08e7873fca3c934bbe6e17ca0efda3370fd7c4b5cb3847b213194d960ab24f6c9281b4b5a3fd7e1f6f59a27ee358377b4c58a726c0eb42595348e3b7202e4d075d5ef404d9e4ae8775e632c6465d046e8c79d4e05800b1a9095fa9e6cf70e6d5ecee089952694205efc14799716018a6f4eb359b56c5b9f1eb5f57f3c006677d1f42490f02493c0914e779e4e5a6e937c8686df5e6fdf5bebd58800f7b2fae032836fbaf305bbfdf9a213705082d45317228e54a9c43fed922c26893d8c816aaf0ef8dfe19bc53e8507804d37bc07a79b9ebf9684955d32f0edb79a4f2222f91ebfc4cd2b28a09c1046bf2de7bd5753c22f746f6a4e8b76e1418313aaddbfc52", 0x1fa) r0 = socket$inet(0x2, 0x4000040000000001, 0xfffffffffffffffc) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x1, 0x1c8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200002c0], 0x0, &(0x7f0000000000), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'sit0\x00', 'eql\x00', 'ifb0\x00', 'eql\x00', @link_local, [], @remote, [], 0x108, 0x108, 0x138, [@physdev={'physdev\x00', 0x48, {{'eql\x00', {}, 'vlan0\x00'}}}]}}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}]}, 0x240) 02:05:59 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008011, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='bbr\x00', 0x4) recvfrom(r0, &(0x7f0000f9cf9b)=""/101, 0xffffff24, 0x122, 0x0, 0x4f) read(r0, &(0x7f0000000380)=""/172, 0xffffff88) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000000)) 02:06:00 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000005880)='attr/keycreate\x00') write$nbd(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="5f446698010000000300040003000000a001949a18f23c282955a690327ab1a4a1bc20f3bcc9d3b6a5ac9c07af26ed356ad850d5f3a942a723a1a203d7f532339ef7bee7ced01a8a4155fdb13fc32fb8e1ecd83f5549bfabe6d4f7988c302385e46b59657f67db34f42e9ed7afa536e393930e4e38fabcf9b5efee964256c5661b5171781802c05dfb4ae90000000000000000000000000000000000"], 0x68) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000000)={[{0x6, 0x80000001, 0x0, 0x6, 0x6, 0x4, 0x3, 0x5, 0x100, 0xfd, 0x400, 0x7ff, 0x100000000}, {0x101, 0x8, 0x5, 0x7, 0x8, 0x4, 0x4, 0x6, 0x0, 0x81, 0x5, 0x400, 0x9}, {0x80000000, 0x1ff, 0x4, 0xe9a, 0x10001, 0x839c, 0x2, 0x0, 0x10000, 0x5, 0x1a, 0x4, 0x2}], 0x7}) openat$audio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x81, 0x0) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000300)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1b, 0xfffffffffffffffe, "e1d3f8eec8d0b1e8563df7de92a8260857dbf5ae46354569636517b58f805ae208258dbb7d0abe8d208f0f1bcc0d6ab62d80dd21ad00", "7b3177f4fc2eb04172daa8fdd1c4c4cf144a2342a36605861388de7e07195d787705000000000000004af44acfe05900000078710600", "ee52c10d1e72a9432c222982fcccff747a313199090000ae379738b0d800"}) accept$nfc_llcp(r1, &(0x7f0000000080), &(0x7f0000000240)=0x60) 02:06:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x8912, &(0x7f0000000380)="053f0400488d7525fe02afdea5750073b6129cdf77795c267e5145a8cf7e2ba7fed95ef737f364e02dfe6ce025d9355bd714fba216f9f19e962a83c3a5d3033766e8120227a161d57d86e2986fb9a3ac22bea4fbb3fbb5e1e3f7c804f8dbade9c9392d1bc019fdf6d10909dbf1b86feb203a4a943a49258d7d081fd00c7782f1e2fed3fe5982b396eb35fcc464c473d9ee") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="78010000320029080000000000000000030000006401170095994c96deee735934e58b79eb50b70be83c5db9f1017fa5174cfb77096355b4501eebf597a7547afea36f0c4615fac6c415973e13af09fa2c2dc53e52b1786898a8cdc893ac85adc04e402bb702621bb2d3817cd8a7f5f4296d1b463bccd5cae0a42e9088a6f06fe20c902752d5a5bc74c3ccde8ddc04c881f4679d940b4a469836a11ba4108ea22d239ee7b1fcd68424122e7457149c3937a75055346a9b2e35bbd08f68f59bad3760ed467887a63274712a6001a778cf74780a6c787671e99335dd1684c81c10a8407d0c917bfdce6271f9a3e66c1b4999738a59727265dec78bd19094c2ce61dfcef1b6dae8870fb429c161c2dd1c710888abfc3baed1df6ad19d0c93d05181d6c455299822d41f8ed2ba401d06be0092c820a9e1a0f128d42cb31c3c18c45735e05e1e658cbb5bc4b91f20f5760e721effa1fc8faf8f94c59c2708005300ffffffff08008b00ac14141b00"], 0x178}}, 0x0) ppoll(&(0x7f0000000000)=[{r0}, {r1, 0xb406}, {r0, 0x240}, {r0}, {r0, 0x200}], 0x5, &(0x7f0000000080), &(0x7f0000000140)={0xffff}, 0x8) 02:06:00 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp6\x00') r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000140)={{0xa, 0x0, 0x0, @loopback, 0x3}, {0xa, 0x4e22, 0x2, @remote, 0x2}, 0x608, [0x9, 0x0, 0x10001, 0x8, 0x2, 0x0, 0x2, 0x80]}, 0x5c) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0x4) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000080)={'NETMAP\x00'}, &(0x7f0000000380)=0x1e) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f0000000740)) write$binfmt_aout(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000070073010000e9000000ffffffff79000000080000d80000000000000000cb47ba143ecdbf35c6e47c791f4ade381c3fdd0dd1c2847e38de1d011e772e36fd1a4fe501b362b0ae7854cdaad59c34e4076482195afe14688f7c8d9e58461082c96e271dd2e6c52018d1cff96daad95bdd228ac0eda42f324a1e1590447ec9a7b58757a01b264117ef55a1d60bea94457b6fbb2aa86a05f0cf0fcaddc3475ef5514e0a0fec44f78634af44b56ba45670df23536bc1c1e4b3"], 0xb9) sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) write$binfmt_misc(r2, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x34000) mknodat(r0, &(0x7f0000000700)='./file0\x00', 0x8048, 0x200) r3 = accept4(r1, 0x0, &(0x7f0000000040), 0x0) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x1) sendmsg$key(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x2, 0x0, 0x0, 0xfffffffffffffffc, 0x20000000000001ef}, 0x10}}, 0x0) prctl$getname(0x10, &(0x7f0000000600)=""/236) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(0xffffffffffffffff, 0x7709, 0x0) bind$inet6(r0, &(0x7f00000005c0)={0xa, 0x4e21, 0x8, @local}, 0x1c) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2005000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x40, r4, 0x108, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6_vti0\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x4000) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000240)={{0x7, 0x2, 0x1000, 0x0, 'syz0\x00'}, 0x0, 0x0, 0x200, 0x0, 0x1, 0x0, 'syz1\x00', &(0x7f0000000040)=['net/tcp6\x00'], 0x9, [], [0x0, 0x48000000000, 0xbfd8, 0xffffffff]}) io_setup(0x0, &(0x7f00000000c0)) [ 268.848826] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 268.876701] FAULT_INJECTION: forcing a failure. [ 268.876701] name failslab, interval 1, probability 0, space 0, times 0 [ 268.912661] CPU: 0 PID: 8090 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 268.919889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 268.929252] Call Trace: [ 268.931862] dump_stack+0x1c4/0x2b4 [ 268.935523] ? dump_stack_print_info.cold.2+0x52/0x52 [ 268.940740] should_fail.cold.4+0xa/0x17 [ 268.944813] ? graph_lock+0x170/0x170 [ 268.948645] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 268.953756] ? smack_d_instantiate+0x136/0xea0 [ 268.953774] ? kasan_kmalloc+0xc7/0xe0 [ 268.953789] ? kasan_slab_alloc+0x12/0x20 [ 268.953809] ? graph_lock+0x170/0x170 [ 268.953837] ? graph_lock+0x170/0x170 [ 268.953861] ? find_held_lock+0x36/0x1c0 [ 268.970323] ? ___might_sleep+0x1ed/0x300 [ 268.970345] ? arch_local_save_flags+0x40/0x40 [ 268.970363] ? lock_downgrade+0x900/0x900 [ 268.970402] __should_failslab+0x124/0x180 [ 268.995368] should_failslab+0x9/0x14 [ 268.999181] kmem_cache_alloc+0x2be/0x730 [ 269.003345] ? kasan_check_write+0x14/0x20 [ 269.007603] __alloc_file+0xa8/0x470 [ 269.011346] ? file_free_rcu+0xd0/0xd0 [ 269.015251] ? d_instantiate+0x79/0xa0 [ 269.019159] ? lock_downgrade+0x900/0x900 [ 269.023333] ? kasan_check_read+0x11/0x20 [ 269.027498] ? do_raw_spin_unlock+0xa7/0x2f0 [ 269.027520] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 269.027540] alloc_empty_file+0x72/0x170 [ 269.027559] alloc_file+0x5e/0x4d0 [ 269.044151] ? _raw_spin_unlock+0x2c/0x50 [ 269.048314] alloc_file_pseudo+0x261/0x3f0 [ 269.048335] ? alloc_file+0x4d0/0x4d0 [ 269.048357] ? usercopy_warn+0x110/0x110 [ 269.060466] ? kasan_check_write+0x14/0x20 [ 269.064728] __shmem_file_setup.part.45+0x110/0x2a0 [ 269.069768] shmem_file_setup+0x65/0x90 [ 269.073754] __x64_sys_memfd_create+0x2af/0x4f0 [ 269.078447] ? memfd_fcntl+0x1230/0x1230 [ 269.082529] do_syscall_64+0x1b9/0x820 [ 269.086434] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 269.091816] ? syscall_return_slowpath+0x5e0/0x5e0 [ 269.096760] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 269.101625] ? trace_hardirqs_on_caller+0x310/0x310 [ 269.106659] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 269.111692] ? prepare_exit_to_usermode+0x291/0x3b0 [ 269.116735] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 269.121601] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 269.126813] RIP: 0033:0x457569 [ 269.130016] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 269.148924] RSP: 002b:00007f67d7cb1a88 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 269.156653] RAX: ffffffffffffffda RBX: 0000000020000100 RCX: 0000000000457569 [ 269.163942] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000004bc78a [ 269.171213] RBP: 000000000072bf00 R08: 0000000000100020 R09: 00000000fbad8001 [ 269.178495] R10: 0000000020000100 R11: 0000000000000246 R12: 00007f67d7cb26d4 [ 269.185793] R13: 00000000004c4a1e R14: 00000000004d7d88 R15: 0000000000000003 [ 269.205972] netlink: 352 bytes leftover after parsing attributes in process `syz-executor0'. [ 269.255923] netlink: 352 bytes leftover after parsing attributes in process `syz-executor0'. 02:06:00 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:00 executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = getpid() prlimit64(r1, 0x7, &(0x7f0000000000)={0x6, 0x6}, &(0x7f0000000040)) setsockopt$inet6_int(r0, 0x29, 0xce, &(0x7f0000000180), 0x4) ioprio_get$pid(0x0, r1) 02:06:00 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0xa000, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e23, 0x3, @mcast2, 0xc0000}}}, &(0x7f0000000100)=0x84) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000280)=@assoc_value={r1, 0x8}, 0x8) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f00000001c0)="637075262222000ac0f92a60006c4a947864c820f4b3ca0c907c1f66f0d29b61024b2828b182b270bbf3ddba72aabf5965d7a337c0ae24b12aeb00b5787f562d57eb9cf5e52064995d4f1399754abdef6583c2177e9e5cac1f93") 02:06:00 executing program 4 (fault-call:2 fault-nth:6): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:00 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0a5cc80700000000005070b551a55702fb39e4c2a7a09c045cebf09388bab3308760b1be36db218e487f1f142ed9df6e80bb9b7196f5bb30ab4b20b12ff346f6eb79d05204ff87e589831401519e07d338bff7a1e255c54bb15abf7560b9a113883b0466cdf2c95c527764bb9c869da3acdd6b00f7983ea1dd2173569b06e67fad757e6d2fe410cb68ab33e1c67d8cea3d7c682f1ba4586c9cb2e28a86951d81491b054c3c0ac0862011512fdfd3cfaf00a67459f3549a728ab4af97eaa328c14ceb5dc21b33109212d9b89cedf7db147ba8f3ab80ab1d401604f9920a020c74dfbd5cc5fad5a183adc48eb1848a3a1fa366ee11c78d81f562f6097863a41b6f01628cdb8540dc477e36c6354d3edc8715a2562680896a62a2310e2aee6db208546ed9ef5584a838d785ee607bbcc8f0e6009c9fe20e0a8938fe6ec20f27076249e26d13ab387c168a06523063048b4ce562d170b5d61446454395508106684910c0903c96dce421f7d6dee287c42f9ba33a4a70206703d1f24520801faeb33de6ef83cc58eba3e73e74cf9d355fd186bd999b30b5a98393e7bcbcbe149e1d7d11ed3f8bd22d34b5e1e02104a7cd3dde4c5d9ce6cabfe37d40777d08eabe80d5c797b9c623b95f708af3b612f0ed25b11de325c17aec87f8d31cf111efda04e9683f1905fc8fe2e2ef7da1427863b7e179f35600baad4cd165b3570db78445b1a0344f3757975c0f705cca2130e009b10aeb5e1d2ac9") r1 = timerfd_create(0x100000000000008, 0x0) r2 = dup2(r0, r1) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000040)={0x0, 0x56, "b37ad799c2f48f3fe9c0df7d7760cd5f64441b52d652d9181be7f242c4ebbe3e7c6cc2822eebb136d48ec3b564b0e048b8907c2cae2d55b573fbd566c71147439d62afaa29c17a8b0cf6acee73e90b06b54bab1f52f5"}, &(0x7f00000000c0)=0x5e) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000100)={0x0, 0xa9f}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000540)={r4, 0x3, 0x2, [0xfffffffffffffffd, 0x1000]}, &(0x7f0000000580)=0xc) getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000440)={r3, 0xa66, 0x800, 0x4, 0x6, 0x67, 0x800, 0x3, {r4, @in6={{0xa, 0x4e20, 0x0, @ipv4={[], [], @loopback}, 0x4}}, 0x4, 0xf9f, 0x9, 0x8, 0x8000}}, &(0x7f0000000500)=0xb0) 02:06:00 executing program 0: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x0) ioctl$KIOCSOUND(r0, 0x4b2f, 0x2) ioctl$TIOCSBRK(r1, 0x5427) 02:06:00 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="153f6234488dd25d766070") syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x401, 0x1) r1 = socket$alg(0x26, 0x5, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x85, 0x80) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e22, 0x2, @local, 0x6}}, [0xb17, 0x0, 0x10001, 0x7fffffff, 0x2d5, 0x9, 0x7, 0xfa3d, 0x3, 0xff, 0xdb7, 0x8, 0x9, 0xfff, 0x3]}, &(0x7f0000000200)=0x100) ioctl$PIO_UNISCRNMAP(r2, 0x4b6a, &(0x7f0000000300)="4b452a3bec63ba14dc8ab5d31f7038f8d48b4fc984befebcb44394cbb9ebaf26ea8bcf16314e7176f10fb4b19ce22d277b76adc9ad7d9651dc23cb4347dee94f561f2ab889aa84605da150c5f368347e024f8c40887f4c248b605dfb520efcb2d617e96d394d2a738069b47231b13ed406ac203b0676b928be74ef948b04bac7dfb2924a33dcbd3e0aea7cbadbea22d4853bd286bc088f54249855b20cc2c68e0dd072dfce18e6e685d0af719d91addc28da0e494a52cd83ee3f0cd0608e7af1d1ce") getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000240)={r3, 0x64, "8a08bb3374f207f5bccf6226c37c66e5171bd3cd2d8b2dc554f31e43f707c6e81f3cb31bf82cc522dbcc42832b6326498fa01586521753f5a7b11149b2182bb3dec28193b623a2ca950c5d0874844fe1970171df00aa77583b2f59d56f74118c6dc3c5f1"}, &(0x7f00000002c0)=0x6c) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0x1) bind$alg(r1, &(0x7f000001f000)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(sha3-224-generic,cbc-camellia-asm)\x00'}, 0x58) close(r1) 02:06:00 executing program 1: r0 = socket$inet6(0xa, 0x6, 0x1) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") mmap(&(0x7f0000000000/0xc72000)=nil, 0xc72000, 0xfffffffffffffffc, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000040), 0x4) 02:06:00 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(0xffffffffffffffff, 0x8001) r1 = socket$inet6(0xa, 0x6, 0x0) syz_emit_ethernet(0xdd, &(0x7f0000000000)={@empty, @remote, [], {@ipv4={0x800, {{0xe, 0x4, 0x9, 0x0, 0xcf, 0x67, 0x6, 0x7, 0x6f, 0x0, @multicast2, @empty, {[@lsrr={0x83, 0x23, 0x2a2, [@dev={0xac, 0x14, 0x14, 0x12}, @remote, @multicast1, @broadcast, @dev={0xac, 0x14, 0x14, 0x14}, @multicast1, @empty, @broadcast]}]}}, @igmp={0x1f, 0x67d2, 0x0, @loopback, "77af44d797f5afb59571d9ed57dd21dcdb13426a7df8f9411be75ce81b73a51bc29911d87051e33cd81a7a20a71ee8556ed7de472ce26a82746cb6a3a0c0c6683dde5c71d0774335df9534f83e637319fe90b60a745f53a286144a3ce2ac12ee847104c326f0128eff5cb8b35dc7f08e0c7f68187d04bc577ef3f2799ae7afcb9ad50099f3e4d116d14a3e7e7cef3a"}}}}}, &(0x7f0000000100)={0x1, 0x4, [0x6d1, 0x920, 0x976, 0xf22]}) setsockopt$inet6_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000140)={0x9}, 0x4) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000780)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f00000007c0)="e328ade1fda9296a0ec9f5eda6162056", 0x10) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @ipv4}, 0x1c) 02:06:00 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 'bond0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f00000000c0)=[{{&(0x7f0000002980)=@rc={0x1f, {0x40000000}}, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000100)}}], 0x1b3, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0xffffffffffffffff, r0, 0x0, 0x7, &(0x7f0000000140)='vmnet0\x00', 0xffffffffffffffff}, 0x30) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x100) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000100)={0x0, @local, @local}, &(0x7f00000001c0)=0xc) bind$bt_hci(r2, &(0x7f0000000400)={0x1f, r3, 0x3}, 0xc) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000380)={0x2, 0x0, [{0x106000, 0x7, &(0x7f0000000040)=""/7}, {0x7000, 0xa8, &(0x7f00000002c0)=""/168}]}) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000200)=""/84, &(0x7f0000000280)=0x54) 02:06:00 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{0xffffffffffffffff, 0x40012}], 0x1, 0xff) writev(0xffffffffffffffff, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:01 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) r0 = perf_event_open(&(0x7f0000000580)={0x4, 0x70, 0x4, 0x31, 0x100000001, 0xfff, 0x0, 0x80000000, 0x4, 0xf, 0x4, 0x9, 0x0, 0x3, 0x80, 0x5, 0x5, 0x20, 0x8, 0x0, 0x3, 0x8, 0x6, 0x3, 0x0, 0xe11, 0x4, 0x6, 0x3, 0x1f, 0x20, 0xffffffffffff9936, 0x3ff, 0xfffffffeffffffff, 0x8, 0x6, 0x9, 0x80000001, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000540), 0x2}, 0x10000, 0x80000000, 0x8001, 0x1, 0x8, 0x381, 0x400}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$dmmidi(&(0x7f0000000480)='/dev/dmmidi#\x00', 0x4, 0x4000) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f00000004c0)={0x0}) ioctl$DRM_IOCTL_GEM_CLOSE(r1, 0x40086409, &(0x7f0000000500)={r2}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000080)=0x61) read(r3, &(0x7f0000000040)=""/11, 0xb) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000100)) ioctl$TIOCGLCKTRMIOS(r3, 0x5432, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x6}) r4 = syz_open_pts(r3, 0x0) r5 = syz_open_dev$admmidi(&(0x7f0000000240)='/dev/admmidi#\x00', 0x9, 0x301001) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000280)={{{@in=@loopback, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000000380)=0xe8) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='9p\x00', 0x80, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@version_u='version=9p2000.u'}], [{@uid_eq={'uid', 0x3d, r6}}, {@smackfsroot={'smackfsroot', 0x3d, '/dev/ptmx\x00'}}, {@fscontext={'fscontext', 0x3d, 'user_u'}}, {@mask={'mask', 0x3d, 'MAY_APPEND'}}, {@smackfsdef={'smackfsdef'}}]}}) r7 = dup3(r4, r3, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000001c0)=0x2) 02:06:01 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000011ff0)={0x2, 0x4e20, @multicast2}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000100)='ip6_vti0\x00', 0x10) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @dev}, 0x10) recvfrom$unix(r3, &(0x7f0000000140)=""/191, 0xbf, 0x20, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x640000, 0x0) listen(r2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bond_slave_0\x00', 0x10) listen(r0, 0x0) 02:06:01 executing program 3: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x3}, 0x1c) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x40, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000000040)={0x6, 0xbe1, 0x80, {0x77359400}, 0x4, 0x2d}) listen(r0, 0xdd1) r2 = socket$inet6(0xa, 0x6, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x10002, 0x0) connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, [], 0xf}, 0x3}, 0x1c) [ 270.065465] FAULT_INJECTION: forcing a failure. [ 270.065465] name failslab, interval 1, probability 0, space 0, times 0 [ 270.100799] CPU: 1 PID: 8170 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 270.108014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 270.117385] Call Trace: [ 270.119991] dump_stack+0x1c4/0x2b4 [ 270.123652] ? dump_stack_print_info.cold.2+0x52/0x52 [ 270.128871] should_fail.cold.4+0xa/0x17 [ 270.132951] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 270.138065] ? graph_lock+0x170/0x170 [ 270.141878] ? graph_lock+0x170/0x170 [ 270.145693] ? __lock_acquire+0x7ec/0x4ec0 [ 270.149944] ? find_held_lock+0x36/0x1c0 [ 270.154032] ? ___might_sleep+0x1ed/0x300 [ 270.158191] ? arch_local_save_flags+0x40/0x40 [ 270.162797] __should_failslab+0x124/0x180 [ 270.167049] should_failslab+0x9/0x14 [ 270.170860] kmem_cache_alloc+0x2be/0x730 [ 270.175018] ? graph_lock+0x170/0x170 [ 270.178826] ? mark_held_locks+0x130/0x130 [ 270.183079] __alloc_file+0xa8/0x470 [ 270.186818] ? file_free_rcu+0xd0/0xd0 [ 270.190722] ? find_held_lock+0x36/0x1c0 [ 270.194810] ? is_bpf_text_address+0xac/0x170 [ 270.199317] ? lock_downgrade+0x900/0x900 [ 270.203486] ? check_preemption_disabled+0x48/0x200 [ 270.208516] alloc_empty_file+0x72/0x170 [ 270.212589] path_openat+0x170/0x5160 [ 270.216414] ? rcu_bh_qs+0xc0/0xc0 [ 270.219962] ? unwind_dump+0x190/0x190 [ 270.223873] ? __lock_is_held+0xb5/0x140 [ 270.227942] ? graph_lock+0x170/0x170 [ 270.231759] ? path_lookupat.isra.43+0xc00/0xc00 [ 270.236520] ? unwind_get_return_address+0x61/0xa0 [ 270.241460] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 270.246497] ? expand_files.part.8+0x571/0x9a0 [ 270.251091] ? find_held_lock+0x36/0x1c0 [ 270.255174] ? __alloc_fd+0x347/0x6e0 [ 270.258983] ? lock_downgrade+0x900/0x900 [ 270.263141] ? getname+0x19/0x20 [ 270.266530] ? kasan_check_read+0x11/0x20 [ 270.270743] ? do_raw_spin_unlock+0xa7/0x2f0 [ 270.275160] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 270.279754] ? __lock_is_held+0xb5/0x140 [ 270.283884] ? _raw_spin_unlock+0x2c/0x50 [ 270.288047] ? __alloc_fd+0x347/0x6e0 [ 270.291869] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 270.297435] do_filp_open+0x255/0x380 [ 270.301250] ? may_open_dev+0x100/0x100 [ 270.305248] ? get_unused_fd_flags+0x122/0x1a0 [ 270.309840] ? __alloc_fd+0x6e0/0x6e0 [ 270.313660] ? __lock_is_held+0xb5/0x140 [ 270.317735] do_sys_open+0x568/0x700 [ 270.321464] ? filp_open+0x80/0x80 [ 270.325022] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 270.330484] ? do_sys_ftruncate+0x449/0x550 [ 270.334821] __x64_sys_open+0x7e/0xc0 [ 270.338649] do_syscall_64+0x1b9/0x820 [ 270.342554] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 270.347941] ? syscall_return_slowpath+0x5e0/0x5e0 [ 270.352881] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 270.357744] ? trace_hardirqs_on_caller+0x310/0x310 [ 270.362795] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 270.367829] ? prepare_exit_to_usermode+0x291/0x3b0 [ 270.372860] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 270.377725] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 270.382924] RIP: 0033:0x4111a1 [ 270.386126] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 8a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 d3 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 270.386136] RSP: 002b:00007f67d7cb1a80 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 02:06:01 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0xd85, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) r3 = dup2(r0, r0) syz_mount_image$btrfs(&(0x7f0000000140)='btrfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x0, &(0x7f00000007c0), 0x0, &(0x7f0000000240)=ANY=[]) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r3, 0xc008551b, &(0x7f0000000140)=""/124) [ 270.386153] RAX: ffffffffffffffda RBX: 0000000020000110 RCX: 00000000004111a1 [ 270.386162] RDX: 00007f67d7cb1afa RSI: 0000000000000002 RDI: 00007f67d7cb1af0 [ 270.386171] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 270.386180] R10: 0000000000000075 R11: 0000000000000293 R12: 0000000000000004 [ 270.386195] R13: 0000000000000000 R14: 00000000004d7d88 R15: 0000000000000003 02:06:01 executing program 4 (fault-call:2 fault-nth:7): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:01 executing program 1: syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x1000, 0x80002) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0xfffffffffffffffd, 0x1, &(0x7f0000000300)=[{&(0x7f0000000140)="400000000002000019000000dc0100002c000000010000000000000000000000002000000020000040000000000000003d5cbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="6d696e5f62617463685f7469697f6e2c000000000000000000000000000000"]) 02:06:01 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:01 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xfffffffffffffffd) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f00000003c0)) mount(&(0x7f00000003c0)=ANY=[], &(0x7f0000000200)='./file0\x00', &(0x7f00000001c0)="18765468f7c38d", 0x100000, &(0x7f0000000400)) clone(0x70024000, &(0x7f0000000180), &(0x7f0000000100), &(0x7f0000000040), &(0x7f0000000180)) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000000)={0x2e, 0x4, 0x0, {0x0, 0x0, 0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x2e) mount$fuse(0x20000000, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x7a04, &(0x7f0000000300)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000000c0)='./file0\x00', 0x2) [ 270.557361] EXT4-fs (loop1): Unrecognized mount option "min_batch_tiin" or missing value [ 270.637613] FAULT_INJECTION: forcing a failure. [ 270.637613] name failslab, interval 1, probability 0, space 0, times 0 [ 270.653499] CPU: 1 PID: 8199 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 270.660712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 270.670072] Call Trace: [ 270.672689] dump_stack+0x1c4/0x2b4 [ 270.676362] ? dump_stack_print_info.cold.2+0x52/0x52 [ 270.681603] should_fail.cold.4+0xa/0x17 [ 270.685705] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 270.685721] ? graph_lock+0x170/0x170 [ 270.685743] ? graph_lock+0x170/0x170 [ 270.685768] ? __lock_acquire+0x7ec/0x4ec0 [ 270.698494] ? find_held_lock+0x36/0x1c0 [ 270.698541] ? ___might_sleep+0x1ed/0x300 [ 270.698559] ? arch_local_save_flags+0x40/0x40 [ 270.715572] __should_failslab+0x124/0x180 [ 270.719829] should_failslab+0x9/0x14 [ 270.723658] kmem_cache_alloc+0x2be/0x730 [ 270.727983] ? graph_lock+0x170/0x170 [ 270.731794] ? mark_held_locks+0x130/0x130 [ 270.736044] __alloc_file+0xa8/0x470 [ 270.739768] ? file_free_rcu+0xd0/0xd0 [ 270.743686] ? find_held_lock+0x36/0x1c0 [ 270.747790] ? is_bpf_text_address+0xac/0x170 [ 270.752290] ? lock_downgrade+0x900/0x900 [ 270.756632] ? check_preemption_disabled+0x48/0x200 [ 270.761659] alloc_empty_file+0x72/0x170 [ 270.765737] path_openat+0x170/0x5160 [ 270.769547] ? rcu_bh_qs+0xc0/0xc0 [ 270.773091] ? unwind_dump+0x190/0x190 [ 270.777007] ? __lock_is_held+0xb5/0x140 [ 270.781079] ? graph_lock+0x170/0x170 [ 270.784893] ? path_lookupat.isra.43+0xc00/0xc00 [ 270.789657] ? unwind_get_return_address+0x61/0xa0 [ 270.794595] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 270.799635] ? expand_files.part.8+0x571/0x9a0 [ 270.804232] ? find_held_lock+0x36/0x1c0 [ 270.808320] ? __alloc_fd+0x347/0x6e0 [ 270.812133] ? lock_downgrade+0x900/0x900 [ 270.816278] ? getname+0x19/0x20 [ 270.819673] ? kasan_check_read+0x11/0x20 [ 270.823856] ? do_raw_spin_unlock+0xa7/0x2f0 [ 270.828285] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 270.832888] ? __lock_is_held+0xb5/0x140 [ 270.837488] ? _raw_spin_unlock+0x2c/0x50 [ 270.841652] ? __alloc_fd+0x347/0x6e0 [ 270.845463] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 270.851026] do_filp_open+0x255/0x380 [ 270.854837] ? may_open_dev+0x100/0x100 [ 270.858845] ? get_unused_fd_flags+0x122/0x1a0 [ 270.863440] ? __alloc_fd+0x6e0/0x6e0 [ 270.867249] ? __lock_is_held+0xb5/0x140 [ 270.871353] do_sys_open+0x568/0x700 [ 270.875125] ? filp_open+0x80/0x80 [ 270.878706] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 270.884162] ? do_sys_ftruncate+0x449/0x550 [ 270.888524] __x64_sys_open+0x7e/0xc0 [ 270.892340] do_syscall_64+0x1b9/0x820 [ 270.896231] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 270.901635] ? syscall_return_slowpath+0x5e0/0x5e0 [ 270.906572] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 270.911423] ? trace_hardirqs_on_caller+0x310/0x310 [ 270.916447] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 270.921472] ? prepare_exit_to_usermode+0x291/0x3b0 [ 270.926502] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 270.931374] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 270.936588] RIP: 0033:0x4111a1 [ 270.939795] Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 b4 17 00 00 c3 48 83 ec 08 e8 8a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 d3 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 270.958701] RSP: 002b:00007f67d7cb1a80 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 [ 270.966429] RAX: ffffffffffffffda RBX: 0000000020000110 RCX: 00000000004111a1 [ 270.973702] RDX: 00007f67d7cb1afa RSI: 0000000000000002 RDI: 00007f67d7cb1af0 [ 270.980977] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a 02:06:01 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = pkey_alloc(0x0, 0x1) pkey_free(r1) r2 = socket$inet(0x2b, 0x801, 0x0) r3 = add_key(&(0x7f0000000140)='syzkaller\x00', &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$assume_authority(0x10, r3) listen(r2, 0x0) r4 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x589d, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000080)={[0x3, 0x100000000, 0x1, 0x3, 0x7, 0x1e0, 0x5, 0x10000, 0x7ff, 0x3, 0x9, 0x8, 0x9, 0x1f, 0x7a, 0x48a], 0x14000, 0x18000}) dup2(r0, r2) 02:06:02 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 270.988254] R10: 0000000000000075 R11: 0000000000000293 R12: 0000000000000004 [ 270.995548] R13: 0000000000000000 R14: 00000000004d7d88 R15: 0000000000000003 [ 271.017896] IPVS: ftp: loaded support on port[0] = 21 02:06:02 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x2, 0x414000) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1a, &(0x7f0000000700)=ANY=[@ANYRES32=0x0, @ANYBLOB="6c000000768daa9aff2e03e361c36bed90031cc2056d2ce352f6cec0ccb45e45d7c1ab5d06756863a83deafcc80397b961af92b663cd36d79d865deb1f0b0100b734b51cd4fd1e226cdaf7889eae77ea1a8e40298f4da8809df020980c7d3fa8f00000000040dbddbcbbf5c3d688b7e94875f3192769f48fc3c7722e784af2cf2e2e9d906c642b0b2cfd3c2dafcf4d39148e2d5aa239b04690fa4feaaa0fff41a9fd4f465d9bffa74c36cbcef1e92168e2ce7b6a3c603b30711e6a3e32cdc30c176fee469b90736ee3c4b798d26606b3a7a7ef222db6ec11f04e55c22f53f9f12cb9195708fe13aac5dd8a07006dfd8c73326155ed4e4e018cd101352d0ce3b4c1b417308cac68992f544a07bd33dc18bb7525327409e7006f624913fae60f9be9a6bb364662615c2414936a61f11d9cd420d5605143376811f050205517fde37bf0a362a4f22a69bda02f2711d8532d9551f464547b7f0b4c6790d2716ca61df6373ebf0c0a45a7796dd6fe7c6da249b02af44f06ad771acd02b5137be29e4924ad335128b6d7ac7731502d08d188cd932809e58fdee8df613c8677e5f4a4efc29fa095cb31cf6bdef79ecabe69ec5a440ea506862c5771595b26d4eb93b639a987ba757d2b9adbdb61bb86d972638a2b11220aa63ce5bca009db7b23751ed3bc9d7f99"], &(0x7f0000000180)=0x74) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00000001c0)=@assoc_id=r2, &(0x7f0000000200)=0x4) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'poly1305-simd\x00'}, 0x58) r3 = accept4(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000240)={0x100000000, 0x1, 0x11, 0x9, r2}, &(0x7f00000002c0)=0x10) sendmsg$rds(r3, &(0x7f0000001f00)={&(0x7f00000003c0)={0x2, 0x0, @multicast2}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000580)=""/11, 0xb}, {&(0x7f00000005c0)=""/30, 0x200005de}], 0x2, &(0x7f0000001bc0)}, 0x0) 02:06:02 executing program 4 (fault-call:2 fault-nth:8): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:02 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000080)=0x4) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000000)}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x1f}, 0x2c) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f00000001c0)='team0\x00') [ 271.214293] FAULT_INJECTION: forcing a failure. [ 271.214293] name failslab, interval 1, probability 0, space 0, times 0 [ 271.234320] CPU: 1 PID: 8220 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 271.241528] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 271.250892] Call Trace: [ 271.253523] dump_stack+0x1c4/0x2b4 [ 271.256161] IPVS: ftp: loaded support on port[0] = 21 [ 271.257179] ? dump_stack_print_info.cold.2+0x52/0x52 [ 271.257220] should_fail.cold.4+0xa/0x17 [ 271.271658] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 271.276770] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 271.276792] ? zap_class+0x640/0x640 [ 271.276821] ? graph_lock+0x170/0x170 [ 271.276856] ? check_preemption_disabled+0x48/0x200 [ 271.276874] ? graph_lock+0x170/0x170 [ 271.286280] ? debug_smp_processor_id+0x1c/0x20 [ 271.286296] ? perf_trace_lock+0x14d/0x7a0 [ 271.286317] ? perf_trace_lock_acquire+0x15b/0x800 [ 271.295131] ? find_held_lock+0x36/0x1c0 [ 271.295154] ? __lock_is_held+0xb5/0x140 [ 271.295199] ? ___might_sleep+0x1ed/0x300 [ 271.295225] ? arch_local_save_flags+0x40/0x40 [ 271.303698] __should_failslab+0x124/0x180 [ 271.303722] should_failslab+0x9/0x14 [ 271.303741] kmem_cache_alloc_trace+0x2d7/0x750 [ 271.303760] ? check_preemption_disabled+0x48/0x200 [ 271.303790] __kthread_create_on_node+0x137/0x540 [ 271.313018] ? loop_get_status64+0x140/0x140 [ 271.313039] ? __kthread_parkme+0x1a0/0x1a0 [ 271.321194] ? __lockdep_init_map+0x105/0x590 [ 271.321213] ? __lockdep_init_map+0x105/0x590 [ 271.321233] ? loop_get_status64+0x140/0x140 [ 271.329957] kthread_create_on_node+0xb1/0xe0 [ 271.329977] ? __kthread_create_on_node+0x540/0x540 [ 271.329996] ? graph_lock+0x170/0x170 [ 271.330026] lo_ioctl+0x7f6/0x1d80 [ 271.338054] ? lo_rw_aio_complete+0x470/0x470 [ 271.338122] blkdev_ioctl+0x9ac/0x2010 [ 271.338145] ? blkpg_ioctl+0xc10/0xc10 [ 271.347859] ? lock_downgrade+0x900/0x900 [ 271.347877] ? check_preemption_disabled+0x48/0x200 02:06:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000100)="153f6234488dea5d666070") syz_emit_ethernet(0x7ffff, &(0x7f0000000000)=ANY=[@ANYBLOB="3fada9fcd703aa65e424a698941554feee5faaaaeaaaaa810045000024796b07dc9541b9be9ef5c0350069003deec630750000000000000000000000000000"], 0x0) [ 271.347902] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 271.347917] ? kasan_check_read+0x11/0x20 [ 271.347936] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 271.347953] ? rcu_bh_qs+0xc0/0xc0 [ 271.347995] ? __fget+0x4d1/0x740 [ 271.357230] ? ksys_dup3+0x680/0x680 [ 271.357251] ? kasan_check_write+0x14/0x20 [ 271.357347] block_ioctl+0xee/0x130 [ 271.366096] ? blkdev_fallocate+0x400/0x400 [ 271.366116] do_vfs_ioctl+0x1de/0x1720 [ 271.366135] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 271.366153] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 271.366175] ? ioctl_preallocate+0x300/0x300 [ 271.366204] ? memset+0x31/0x40 [ 271.375115] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 271.375136] ? smack_file_ioctl+0x210/0x3c0 [ 271.375150] ? fget_raw+0x20/0x20 [ 271.375169] ? smack_file_lock+0x2e0/0x2e0 [ 271.375195] ? rcu_read_lock_sched_held+0x108/0x120 [ 271.375223] ? do_syscall_64+0x9a/0x820 [ 271.384742] ? do_syscall_64+0x9a/0x820 [ 271.384764] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 271.384783] ? security_file_ioctl+0x94/0xc0 02:06:02 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='map_files\x00') fchdir(r0) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) mknod$loop(&(0x7f0000000080)='./file0/file0\x00', 0x4000000000002, 0x1) [ 271.384805] ksys_ioctl+0xa9/0xd0 [ 271.384827] __x64_sys_ioctl+0x73/0xb0 [ 271.392165] do_syscall_64+0x1b9/0x820 [ 271.400550] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 271.400584] ? syscall_return_slowpath+0x5e0/0x5e0 [ 271.400600] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 271.400631] ? trace_hardirqs_on_caller+0x310/0x310 [ 271.408655] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 271.408676] ? prepare_exit_to_usermode+0x291/0x3b0 [ 271.408706] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 271.419517] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 271.419532] RIP: 0033:0x4573d7 [ 271.419549] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 271.419563] RSP: 002b:00007f67d7cb1a88 EFLAGS: 00000246 [ 271.428970] ORIG_RAX: 0000000000000010 [ 271.428981] RAX: ffffffffffffffda RBX: 0000000020000110 RCX: 00000000004573d7 [ 271.428991] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 02:06:02 executing program 2: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f00000001c0)="153f6234488dd25d766070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYBLOB="0d000000501572df59f386c8a5a992f738965c9689ab7cc3cbeac2cb06bf5b48672fa493199cb738f1a2aae61685cf9e00f685bb00de146784bf69d366631768a5096b0ff89ebd6807ab0a4e315d4a2f2c50ed2bc2e10c58a9915041d3ec72a3f704444e0f5b0350505e913c1e78c71fb18dc4097a3080cd2f3741ca9b4c40906a67bc1eb68e912480b96ff6ca0c7efcaf"], &(0x7f0000000040)=0x15) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000080)={r2, @in6={{0xa, 0x4e22, 0x1, @loopback, 0x1}}, 0x3, 0x9, 0x5, 0x6, 0x6}, &(0x7f0000000140)=0x98) ioctl$int_in(r1, 0x5452, &(0x7f0000001380)=0x4) recvmmsg(r1, &(0x7f0000003480)=[{{&(0x7f00000011c0)=@generic, 0x80, &(0x7f0000002700)=[{&(0x7f0000001240)=""/75, 0x4b}], 0x1, &(0x7f00000027c0)=""/243, 0xf3}}], 0x500, 0x0, 0x0) shutdown(r1, 0x0) syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0xf53, 0x101000) socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000300), 0x4) [ 271.429001] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 271.429011] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000004 [ 271.429021] R13: 0000000000000000 R14: 00000000004d7d88 R15: 0000000000000003 02:06:02 executing program 4 (fault-call:2 fault-nth:9): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:02 executing program 1: openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/attr/fscreate\x00', 0x2, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ashmem\x00', 0x200000, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) socket$can_raw(0x1d, 0x3, 0x1) signalfd4(0xffffffffffffff9c, &(0x7f0000000380), 0x8, 0x0) socket$key(0xf, 0x3, 0x2) r0 = socket$key(0xf, 0x3, 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)={0xf, 0x80000001, 0x3f, 0x3, 0x0, 0x1, 0x40}, 0x2c) r2 = dup2(r0, r1) getsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f0000000240)=0x4, &(0x7f0000000280)=0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r3, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0x8, @mcast2, 0xffff}}, 0x6, 0x7}, &(0x7f00000000c0)=0x90) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f00000001c0)={r4, 0x27, "32b460a73383f7ca4925648f048af80578fd8a5db4dd75dd0640dcec886177daa0fa90ae18fa92"}, &(0x7f0000000200)=0x2f) [ 271.789345] FAULT_INJECTION: forcing a failure. [ 271.789345] name failslab, interval 1, probability 0, space 0, times 0 [ 271.806510] CPU: 1 PID: 8248 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 271.813721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 271.823092] Call Trace: [ 271.825724] dump_stack+0x1c4/0x2b4 [ 271.829374] ? dump_stack_print_info.cold.2+0x52/0x52 [ 271.835087] should_fail.cold.4+0xa/0x17 [ 271.839167] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 271.844284] ? up_read+0x110/0x110 [ 271.847827] ? down_read+0x1d0/0x1d0 [ 271.851529] ? graph_lock+0x170/0x170 [ 271.855320] ? graph_lock+0x170/0x170 [ 271.859106] ? lock_acquire+0x1ed/0x520 [ 271.863069] ? lo_ioctl+0x8e/0x1d80 [ 271.866709] ? find_held_lock+0x36/0x1c0 [ 271.870768] ? __lock_is_held+0xb5/0x140 [ 271.874847] ? ___might_sleep+0x1ed/0x300 [ 271.878983] ? arch_local_save_flags+0x40/0x40 [ 271.883568] __should_failslab+0x124/0x180 [ 271.887794] should_failslab+0x9/0x14 [ 271.891583] kmem_cache_alloc_trace+0x2d7/0x750 [ 271.896243] ? check_preemption_disabled+0x48/0x200 [ 271.901273] __kthread_create_on_node+0x137/0x540 [ 271.906107] ? loop_get_status64+0x140/0x140 [ 271.910501] ? __kthread_parkme+0x1a0/0x1a0 [ 271.914829] ? __lockdep_init_map+0x105/0x590 [ 271.919311] ? __lockdep_init_map+0x105/0x590 [ 271.923799] ? loop_get_status64+0x140/0x140 [ 271.928193] kthread_create_on_node+0xb1/0xe0 [ 271.932675] ? __kthread_create_on_node+0x540/0x540 [ 271.937680] ? graph_lock+0x170/0x170 [ 271.941472] lo_ioctl+0x7f6/0x1d80 [ 271.945004] ? lo_rw_aio_complete+0x470/0x470 [ 271.949488] blkdev_ioctl+0x9ac/0x2010 [ 271.953367] ? blkpg_ioctl+0xc10/0xc10 [ 271.957244] ? lock_downgrade+0x900/0x900 [ 271.961398] ? check_preemption_disabled+0x48/0x200 [ 271.966410] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 271.972195] ? kasan_check_read+0x11/0x20 [ 271.976330] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 271.981594] ? rcu_bh_qs+0xc0/0xc0 [ 271.985142] ? __fget+0x4d1/0x740 [ 271.988587] ? ksys_dup3+0x680/0x680 [ 271.992290] ? kasan_check_write+0x14/0x20 [ 271.996530] block_ioctl+0xee/0x130 [ 272.000145] ? blkdev_fallocate+0x400/0x400 [ 272.004453] do_vfs_ioctl+0x1de/0x1720 [ 272.008328] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 272.013875] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 272.019142] ? ioctl_preallocate+0x300/0x300 [ 272.023563] ? memset+0x31/0x40 [ 272.026844] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 272.032372] ? smack_file_ioctl+0x210/0x3c0 [ 272.036704] ? fget_raw+0x20/0x20 [ 272.040146] ? smack_file_lock+0x2e0/0x2e0 [ 272.044369] ? rcu_read_lock_sched_held+0x108/0x120 [ 272.049386] ? do_syscall_64+0x9a/0x820 [ 272.053356] ? do_syscall_64+0x9a/0x820 [ 272.057342] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 272.062899] ? security_file_ioctl+0x94/0xc0 [ 272.067312] ksys_ioctl+0xa9/0xd0 [ 272.070768] __x64_sys_ioctl+0x73/0xb0 [ 272.074647] do_syscall_64+0x1b9/0x820 [ 272.078527] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 272.083884] ? syscall_return_slowpath+0x5e0/0x5e0 [ 272.088803] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 272.093653] ? trace_hardirqs_on_caller+0x310/0x310 [ 272.098670] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 272.103674] ? prepare_exit_to_usermode+0x291/0x3b0 [ 272.108683] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 272.113520] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 272.118707] RIP: 0033:0x4573d7 [ 272.121891] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 02:06:03 executing program 3: r0 = socket$inet(0x2, 0x80003, 0x2000000084) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0xe0000, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000180)={0x20000000}) sendto$inet(r0, &(0x7f0000000040)="c1", 0x1, 0x20000008000, &(0x7f00000000c0), 0x10) sendto$inet(r0, &(0x7f0000000080)="58325d8c0800f5764e953c0bc5b5f0", 0xf, 0x0, &(0x7f0000000100), 0x10) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) 02:06:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000002c0), 0x4) r1 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{}, {0xffffffffffffffff, 0x444}], 0x2, &(0x7f0000000040)={0x0, 0x989680}, &(0x7f0000000080)={0x6}, 0x8) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r3, 0x40000000af01, &(0x7f0000000140)) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000001800)={0x0, 0x84, "c49ed275ab91425130ea1ced43c1b0e1cb261cb9078dac3254fce8f1b0589be4d6983d0491efdf3c14dbd6d878ee1b83d5feaac03db7baa6133b828cd8a2fa73109e7846f759273bf35b86f778485f6baba001188871678ffb96191d01623615315597ece8ce0ae7d66e049ac0f53671a2034d4047e71ab98bbf1b30549fae1811b67e4c"}, &(0x7f0000000180)=0x8c) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000001980)=@add_del={0x3, &(0x7f0000001940)='dummy0\x00', 0x8000}) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f00000018c0)={r4, 0x200000000000000}, 0x8) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000300)={{0x2, 0x0, @multicast1}, {0x307}, 0x8, {0x2, 0x0, @local}, 'teql0\x00'}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001740)=""/163, &(0x7f0000000540)=""/246, &(0x7f0000000640)=""/4096}) r5 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000001700)={0x0, 0x6a, &(0x7f0000002800)="49c12125d235971ca2daccda085663559d015eff87b10d6952e773e358f9087d59b79aedb029786b420420375ec8e30299bedcc50f521f4f075cef7edb6e8a57fd7889cbd2f301fb9e4c4a1a17748bb3640a41844e7290ff41f8623fbda8795563f310a6a72fc5715d8d"}) perf_event_open(&(0x7f0000000380)={0x0, 0x70, 0x6, 0x0, 0x0, 0x5, 0x0, 0x2, 0x200, 0x8, 0x0, 0x0, 0x0, 0x39, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x1, 0x2, 0x5, 0x20, 0x1, 0x0, 0xdf, 0x8, 0x0, 0x22, 0x0, 0x4, 0x0, 0x3ff, 0x0, 0x0, 0x401, 0x0, @perf_bp={&(0x7f0000000200), 0x9}, 0x20, 0x401, 0x0, 0x1, 0x5c1, 0x0, 0x5}, r1, 0x7, 0xffffffffffffffff, 0x0) ioctl$UI_END_FF_UPLOAD(r5, 0x406855c9, &(0x7f0000000400)={0xa, 0x7, {0x57, 0x0, 0x6, {0x5, 0x5}, {0x3, 0x101}, @ramp={0x2, 0x27f, {0x7, 0x1, 0x2, 0x3f}}}, {0x57, 0x7ff, 0x0, {0x2, 0x4}, {0x80000001, 0x7f}, @rumble={0x40, 0x6}}}) close(r5) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$ASHMEM_GET_PIN_STATUS(r5, 0x7709, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000f1dff8)={0x0, r5}) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000000500)='fou\x00') sendmsg$FOU_CMD_DEL(r5, &(0x7f00000016c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001680)={&(0x7f00000019c0)=ANY=[@ANYBLOB="18000000448174c9fe0b1c09106908b66261fff09febb7060210e82dd357a6d3", @ANYRES16=r7, @ANYBLOB="01032cbd7000ffdbdf250200000004000500"], 0x18}, 0x1, 0x0, 0x0, 0x4040}, 0x0) ioctl$FS_IOC_GETVERSION(r2, 0x80087601, &(0x7f0000000480)) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000001900)=0x75e2) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000140)={0x2, &(0x7f0000000100)=[{0x3ff, 0x1, 0x800}, {0xf9, 0x0, 0xfffffffffffffffa, 0x5}]}, 0x8) 02:06:03 executing program 2: r0 = creat(&(0x7f0000001dc0)='./file0\x00', 0x0) r1 = dup2(r0, r0) recvmmsg(0xffffffffffffffff, &(0x7f0000009680)=[{{&(0x7f0000008140)=@vsock, 0x80, &(0x7f0000008380), 0x0, &(0x7f0000009800)=""/53, 0x35}}], 0x1, 0x0, &(0x7f0000001d40)={0x77359400}) rmdir(&(0x7f0000000040)='./file0\x00') ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f0000000080)=""/77) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000500)=0x6eba) mount(&(0x7f0000000100)=@nbd={'/dev/nbd'}, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='cgroup\x00', 0x0, 0x0) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000180)) [ 272.140782] RSP: 002b:00007f67d7cb1a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 272.148476] RAX: ffffffffffffffda RBX: 0000000020000110 RCX: 00000000004573d7 [ 272.155732] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 272.162984] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 272.170238] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000004 [ 272.177491] R13: 0000000000000000 R14: 00000000004d7d88 R15: 0000000000000003 02:06:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 272.254254] EXT4-fs warning (device sda1): ext4_group_extend:1762: can't shrink FS - resize aborted 02:06:03 executing program 4 (fault-call:2 fault-nth:10): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 272.308343] EXT4-fs warning (device sda1): ext4_group_extend:1762: can't shrink FS - resize aborted 02:06:03 executing program 2: r0 = creat(&(0x7f0000001dc0)='./file0\x00', 0x0) r1 = dup2(r0, r0) recvmmsg(0xffffffffffffffff, &(0x7f0000009680)=[{{&(0x7f0000008140)=@vsock, 0x80, &(0x7f0000008380), 0x0, &(0x7f0000009800)=""/53, 0x35}}], 0x1, 0x0, &(0x7f0000001d40)={0x77359400}) rmdir(&(0x7f0000000040)='./file0\x00') ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f0000000080)=""/77) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000500)=0x6eba) mount(&(0x7f0000000100)=@nbd={'/dev/nbd'}, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='cgroup\x00', 0x0, 0x0) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000180)) [ 272.419894] FAULT_INJECTION: forcing a failure. [ 272.419894] name failslab, interval 1, probability 0, space 0, times 0 [ 272.431477] CPU: 1 PID: 8268 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 272.431490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 272.431498] Call Trace: [ 272.431526] dump_stack+0x1c4/0x2b4 [ 272.431554] ? dump_stack_print_info.cold.2+0x52/0x52 [ 272.431594] should_fail.cold.4+0xa/0x17 [ 272.431636] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 272.431657] ? __lock_acquire+0x7ec/0x4ec0 [ 272.431682] ? print_usage_bug+0xc0/0xc0 [ 272.431703] ? graph_lock+0x170/0x170 [ 272.431725] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 272.431746] ? check_preemption_disabled+0x48/0x200 [ 272.431766] ? pick_next_entity+0x197/0x390 [ 272.431783] ? graph_lock+0x170/0x170 [ 272.431803] ? print_usage_bug+0xc0/0xc0 [ 272.431821] ? perf_trace_lock+0x14d/0x7a0 [ 272.431850] ? find_held_lock+0x36/0x1c0 [ 272.431875] ? __lock_is_held+0xb5/0x140 02:06:03 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000000280), &(0x7f0000744000), &(0x7f0000001880), &(0x7f0000001900)) mknod(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000540), &(0x7f00000006c0)) r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) open$dir(&(0x7f0000000140)='./file0\x00', 0x0, 0x4) r1 = creat(&(0x7f0000000400)='./file0\x00', 0x49) lsetxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=@known='security.apparmor\x00', &(0x7f0000000680)='syscall\x00', 0x8, 0x3) r2 = syz_open_procfs(0x0, &(0x7f0000000840)="636c6561725f7265667300b04978e60c4ba32fd7b949714bcbe80c57af59747c61a31619cbafea034f5b6bb15332860b9f14c654d1012484f5c9d8edcad2f073e0ca5078fc64d38d1e297b9d66a71452b92cae675696040000001e87b8b54da0d1b5f3b4d6f8caf34a15ed2b2c98fcbf6778a196ad93aa3d2d7a067208277959e31ef261fa1ccb16594e7025d84ae407ab4a4139dc9a16b927000000000000000000") getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in=@dev}}, &(0x7f0000000600)=0xe8) lsetxattr$security_capability(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='security.capability\x00', &(0x7f0000000640)=@v3={0x3000000, [{}, {0x0, 0x3}], r3}, 0x18, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='syscall\x00') sendfile(r2, r4, &(0x7f0000000080), 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x1000000000016) recvfrom$unix(r2, &(0x7f0000000240)=""/106, 0x6a, 0x10001, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)) linkat(r2, &(0x7f0000000340)='./file0\x00', r1, &(0x7f0000000380)='./file0\x00', 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x27e, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f00000006c0)={{0x2, 0x4e24, @rand_addr=0x1}, {0x1}, 0x40, {0x2, 0x4e23, @broadcast}, 'bridge_slave_1\x00'}) [ 272.431915] ? ___might_sleep+0x1ed/0x300 [ 272.468986] ? arch_local_save_flags+0x40/0x40 [ 272.469023] __should_failslab+0x124/0x180 [ 272.469047] should_failslab+0x9/0x14 [ 272.469067] kmem_cache_alloc+0x2be/0x730 [ 272.469104] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 272.469190] __kernfs_new_node+0x127/0x8d0 [ 272.469215] ? debug_smp_processor_id+0x1c/0x20 [ 272.486830] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 272.486852] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 272.486880] ? perf_trace_lock+0x7a0/0x7a0 [ 272.486894] ? perf_trace_lock+0x14d/0x7a0 [ 272.486911] ? perf_trace_lock_acquire+0x15b/0x800 [ 272.486933] ? graph_lock+0x170/0x170 [ 272.486949] ? zap_class+0x640/0x640 [ 272.486966] ? graph_lock+0x170/0x170 [ 272.486982] ? perf_trace_lock+0x7a0/0x7a0 [ 272.487018] ? find_held_lock+0x36/0x1c0 [ 272.487050] kernfs_new_node+0x95/0x120 [ 272.487077] kernfs_create_dir_ns+0x4d/0x160 [ 272.487137] internal_create_group+0x5fc/0xd80 [ 272.487173] ? remove_files.isra.1+0x190/0x190 [ 272.487188] ? up_write+0x7b/0x220 [ 272.487204] ? up_read+0x110/0x110 [ 272.487222] ? down_read+0x1d0/0x1d0 [ 272.487261] sysfs_create_group+0x1f/0x30 [ 272.487282] lo_ioctl+0x1310/0x1d80 [ 272.487326] ? lo_rw_aio_complete+0x470/0x470 [ 272.487346] blkdev_ioctl+0x9ac/0x2010 [ 272.487387] ? blkpg_ioctl+0xc10/0xc10 [ 272.496721] ? lock_downgrade+0x900/0x900 [ 272.496739] ? check_preemption_disabled+0x48/0x200 [ 272.496767] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 272.496782] ? kasan_check_read+0x11/0x20 [ 272.496802] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 272.496822] ? rcu_bh_qs+0xc0/0xc0 [ 272.496855] ? __fget+0x4d1/0x740 [ 272.504733] ? ksys_dup3+0x680/0x680 [ 272.504755] ? kasan_check_write+0x14/0x20 [ 272.504785] block_ioctl+0xee/0x130 [ 272.504804] ? blkdev_fallocate+0x400/0x400 [ 272.504824] do_vfs_ioctl+0x1de/0x1720 [ 272.504843] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 272.504871] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 272.504894] ? ioctl_preallocate+0x300/0x300 [ 272.504910] ? memset+0x31/0x40 [ 272.504929] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 272.504961] ? smack_file_ioctl+0x210/0x3c0 [ 272.504976] ? fget_raw+0x20/0x20 [ 272.504996] ? smack_file_lock+0x2e0/0x2e0 [ 272.505013] ? rcu_read_lock_sched_held+0x108/0x120 [ 272.505045] ? do_syscall_64+0x9a/0x820 [ 272.505064] ? do_syscall_64+0x9a/0x820 [ 272.505087] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 272.505106] ? security_file_ioctl+0x94/0xc0 [ 272.505131] ksys_ioctl+0xa9/0xd0 [ 272.505156] __x64_sys_ioctl+0x73/0xb0 [ 272.505177] do_syscall_64+0x1b9/0x820 [ 272.505195] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 272.505216] ? syscall_return_slowpath+0x5e0/0x5e0 [ 272.505240] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 272.513539] ? trace_hardirqs_on_caller+0x310/0x310 [ 272.513559] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 272.513581] ? prepare_exit_to_usermode+0x291/0x3b0 [ 272.513608] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 272.513648] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 272.513663] RIP: 0033:0x4573d7 [ 272.513680] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 272.513690] RSP: 002b:00007f67d7cb1a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 272.513709] RAX: ffffffffffffffda RBX: 0000000020000110 RCX: 00000000004573d7 [ 272.513720] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 272.513731] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 272.513742] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000004 [ 272.513753] R13: 0000000000000000 R14: 00000000004d7d88 R15: 0000000000000003 [ 272.574719] EXT4-fs warning (device sda1): ext4_group_extend:1762: can't shrink FS - resize aborted 02:06:03 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 272.911204] audit: type=1804 audit(1540001164.041:35): pid=8274 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor3" name="/root/syzkaller-testdir823104128/syzkaller.fUwJ6Y/40/file0" dev="sda1" ino=16611 res=1 02:06:04 executing program 2: r0 = creat(&(0x7f0000001dc0)='./file0\x00', 0x0) r1 = dup2(r0, r0) recvmmsg(0xffffffffffffffff, &(0x7f0000009680)=[{{&(0x7f0000008140)=@vsock, 0x80, &(0x7f0000008380), 0x0, &(0x7f0000009800)=""/53, 0x35}}], 0x1, 0x0, &(0x7f0000001d40)={0x77359400}) rmdir(&(0x7f0000000040)='./file0\x00') ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f0000000080)=""/77) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000500)=0x6eba) mount(&(0x7f0000000100)=@nbd={'/dev/nbd'}, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='cgroup\x00', 0x0, 0x0) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000180)) [ 273.039208] audit: type=1804 audit(1540001164.161:36): pid=8274 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor3" name="/root/syzkaller-testdir823104128/syzkaller.fUwJ6Y/40/file0" dev="sda1" ino=16611 res=1 [ 273.076516] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 273.093879] EXT4-fs warning (device sda1): ext4_group_extend:1762: can't shrink FS - resize aborted [ 273.109212] audit: type=1804 audit(1540001164.201:37): pid=8288 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir823104128/syzkaller.fUwJ6Y/40/file0" dev="sda1" ino=16611 res=1 02:06:04 executing program 4 (fault-call:2 fault-nth:11): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:04 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 273.250353] audit: type=1804 audit(1540001164.201:38): pid=8281 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor3" name="/root/syzkaller-testdir823104128/syzkaller.fUwJ6Y/40/file0" dev="sda1" ino=16611 res=1 [ 273.292449] audit: type=1804 audit(1540001164.311:39): pid=8281 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor3" name="/root/syzkaller-testdir823104128/syzkaller.fUwJ6Y/40/file0" dev="sda1" ino=16611 res=1 [ 273.318122] FAULT_INJECTION: forcing a failure. [ 273.318122] name failslab, interval 1, probability 0, space 0, times 0 [ 273.329967] CPU: 0 PID: 8300 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 273.337171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 273.346528] Call Trace: [ 273.349141] dump_stack+0x1c4/0x2b4 [ 273.352803] ? dump_stack_print_info.cold.2+0x52/0x52 [ 273.358032] should_fail.cold.4+0xa/0x17 [ 273.362118] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 273.367237] ? check_noncircular+0x20/0x20 [ 273.371490] ? update_load_avg+0x2470/0x2470 [ 273.375923] ? graph_lock+0x170/0x170 [ 273.379762] ? graph_lock+0x170/0x170 [ 273.383589] ? check_preemption_disabled+0x48/0x200 [ 273.388651] ? graph_lock+0x170/0x170 [ 273.392467] ? __lock_acquire+0x7ec/0x4ec0 [ 273.396727] ? __update_load_avg_blocked_se+0x730/0x730 [ 273.402134] ? graph_lock+0x170/0x170 [ 273.405945] ? __update_load_avg_se+0xb90/0xb90 [ 273.410647] ? graph_lock+0x170/0x170 [ 273.414473] ? print_usage_bug+0xc0/0xc0 [ 273.418579] ? find_held_lock+0x36/0x1c0 [ 273.422674] __should_failslab+0x124/0x180 [ 273.426928] should_failslab+0x9/0x14 [ 273.430761] kmem_cache_alloc+0x47/0x730 [ 273.434849] ? plist_requeue+0x620/0x620 [ 273.438930] ? rcu_bh_qs+0xc0/0xc0 [ 273.442498] radix_tree_node_alloc.constprop.18+0x1f7/0x370 [ 273.448228] idr_get_free+0x725/0xec0 [ 273.452059] ? ida_pre_get+0x130/0x130 [ 273.455973] ? save_stack+0xa9/0xd0 [ 273.459607] ? save_stack+0x43/0xd0 [ 273.463249] ? kasan_kmalloc+0xc7/0xe0 [ 273.467141] ? kasan_slab_alloc+0x12/0x20 [ 273.471297] ? kmem_cache_alloc+0x12e/0x730 [ 273.475639] ? __kernfs_new_node+0x127/0x8d0 [ 273.480059] ? kernfs_new_node+0x95/0x120 [ 273.484225] ? internal_create_group+0x5fc/0xd80 [ 273.489014] ? sysfs_create_group+0x1f/0x30 [ 273.493347] ? lo_ioctl+0x1310/0x1d80 [ 273.497157] ? blkdev_ioctl+0x9ac/0x2010 [ 273.501232] ? block_ioctl+0xee/0x130 [ 273.505040] ? do_vfs_ioctl+0x1de/0x1720 [ 273.509107] ? ksys_ioctl+0xa9/0xd0 [ 273.512758] ? __x64_sys_ioctl+0x73/0xb0 [ 273.516828] ? do_syscall_64+0x1b9/0x820 [ 273.520902] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 273.526313] idr_alloc_u32+0x201/0x3f0 [ 273.530214] ? __fprop_inc_percpu_max+0x2d0/0x2d0 [ 273.535072] ? lock_acquire+0x1ed/0x520 [ 273.539061] ? __kernfs_new_node+0x14e/0x8d0 [ 273.543486] ? __lock_is_held+0xb5/0x140 [ 273.547573] idr_alloc_cyclic+0x166/0x350 [ 273.551741] ? idr_alloc+0x1b0/0x1b0 [ 273.555469] ? kasan_check_write+0x14/0x20 [ 273.559721] ? do_raw_spin_lock+0xc1/0x200 [ 273.563980] __kernfs_new_node+0x1ee/0x8d0 [ 273.568231] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 273.573011] ? _raw_spin_unlock_irq+0x60/0x80 [ 273.577529] ? __schedule+0x150b/0x1ed0 [ 273.581561] ? graph_lock+0x170/0x170 [ 273.585378] ? graph_lock+0x170/0x170 [ 273.589208] ? trace_hardirqs_on+0xbd/0x310 [ 273.593534] ? kasan_check_read+0x11/0x20 [ 273.597703] ? find_held_lock+0x36/0x1c0 [ 273.601789] kernfs_new_node+0x95/0x120 [ 273.605786] kernfs_create_dir_ns+0x4d/0x160 [ 273.610223] internal_create_group+0x5fc/0xd80 [ 273.614825] ? remove_files.isra.1+0x190/0x190 [ 273.619505] ? up_write+0x7b/0x220 [ 273.623059] ? up_read+0x110/0x110 [ 273.623076] ? down_read+0x1d0/0x1d0 [ 273.623109] sysfs_create_group+0x1f/0x30 [ 273.623129] lo_ioctl+0x1310/0x1d80 [ 273.623155] ? lo_rw_aio_complete+0x470/0x470 [ 273.623174] blkdev_ioctl+0x9ac/0x2010 [ 273.623191] ? blkpg_ioctl+0xc10/0xc10 [ 273.623204] ? lock_downgrade+0x900/0x900 [ 273.623220] ? check_preemption_disabled+0x48/0x200 [ 273.623243] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 273.665480] ? kasan_check_read+0x11/0x20 [ 273.669658] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 273.674950] ? rcu_bh_qs+0xc0/0xc0 [ 273.678518] ? __fget+0x4d1/0x740 [ 273.681996] ? ksys_dup3+0x680/0x680 [ 273.685735] ? kasan_check_write+0x14/0x20 [ 273.689992] block_ioctl+0xee/0x130 [ 273.693647] ? blkdev_fallocate+0x400/0x400 [ 273.697984] do_vfs_ioctl+0x1de/0x1720 [ 273.701908] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 273.707486] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 273.712781] ? ioctl_preallocate+0x300/0x300 [ 273.717199] ? memset+0x31/0x40 [ 273.720516] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 273.726088] ? smack_file_ioctl+0x210/0x3c0 [ 273.730664] ? fget_raw+0x20/0x20 [ 273.734305] ? smack_file_lock+0x2e0/0x2e0 [ 273.738561] ? rcu_read_lock_sched_held+0x108/0x120 [ 273.743663] ? do_syscall_64+0x9a/0x820 [ 273.747656] ? do_syscall_64+0x9a/0x820 [ 273.751657] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 273.757224] ? security_file_ioctl+0x94/0xc0 [ 273.761673] ksys_ioctl+0xa9/0xd0 [ 273.765150] __x64_sys_ioctl+0x73/0xb0 [ 273.769047] do_syscall_64+0x1b9/0x820 [ 273.772978] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 273.778353] ? syscall_return_slowpath+0x5e0/0x5e0 [ 273.783314] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 273.788174] ? trace_hardirqs_on_caller+0x310/0x310 [ 273.793197] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 273.798229] ? prepare_exit_to_usermode+0x291/0x3b0 [ 273.803264] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 273.808129] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 273.813324] RIP: 0033:0x4573d7 [ 273.816546] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 273.835452] RSP: 002b:00007f67d7cb1a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 273.843168] RAX: ffffffffffffffda RBX: 0000000020000110 RCX: 00000000004573d7 [ 273.850441] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 273.857717] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 273.865008] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000004 [ 273.872279] R13: 0000000000000000 R14: 00000000004d7d88 R15: 0000000000000003 [ 273.893684] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:05 executing program 1: socketpair$unix(0x1, 0x1000000005, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x400000, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000000140)={0x0, 0x2, 0x7fffffff, 0x800, 0x0, 0x4, 0xbdc, 0xa8, {0x0, @in6={{0xa, 0x4e22, 0x7, @dev={0xfe, 0x80, [], 0x16}, 0x6}}, 0x401, 0x2, 0x7fffffff, 0x2, 0x5}}, &(0x7f0000000080)=0xb0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000000c0)={r2, 0x7}, &(0x7f0000000200)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0xb6, 0x108000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000588ff8)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r3, 0x7, &(0x7f0000002000)) 02:06:05 executing program 5: bind$inet6(0xffffffffffffffff, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(0xffffffffffffffff, 0x3) r0 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r0, 0x40012}], 0x1, 0xff) writev(r0, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:05 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f0000000000)='./file0\x00', 0x80, 0x1) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffff9c, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000140)={r2, 0x26, 0x20, "e07bd9a0304b2cb47b88bbee8913933b8294ad382310f57ab85a571c17c7c4a3"}, 0x28) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000180), &(0x7f00000001c0)=0x4) getsockopt$sock_int(r3, 0x1, 0x1, &(0x7f000059dffc), &(0x7f0000000080)=0x1027e) 02:06:05 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000000280), &(0x7f0000744000), &(0x7f0000001880), &(0x7f0000001900)) mknod(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000540), &(0x7f00000006c0)) r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) open$dir(&(0x7f0000000140)='./file0\x00', 0x0, 0x4) r1 = creat(&(0x7f0000000400)='./file0\x00', 0x49) lsetxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=@known='security.apparmor\x00', &(0x7f0000000680)='syscall\x00', 0x8, 0x3) r2 = syz_open_procfs(0x0, &(0x7f0000000840)="636c6561725f7265667300b04978e60c4ba32fd7b949714bcbe80c57af59747c61a31619cbafea034f5b6bb15332860b9f14c654d1012484f5c9d8edcad2f073e0ca5078fc64d38d1e297b9d66a71452b92cae675696040000001e87b8b54da0d1b5f3b4d6f8caf34a15ed2b2c98fcbf6778a196ad93aa3d2d7a067208277959e31ef261fa1ccb16594e7025d84ae407ab4a4139dc9a16b927000000000000000000") getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in=@dev}}, &(0x7f0000000600)=0xe8) lsetxattr$security_capability(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='security.capability\x00', &(0x7f0000000640)=@v3={0x3000000, [{}, {0x0, 0x3}], r3}, 0x18, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='syscall\x00') sendfile(r2, r4, &(0x7f0000000080), 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x1000000000016) recvfrom$unix(r2, &(0x7f0000000240)=""/106, 0x6a, 0x10001, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)) linkat(r2, &(0x7f0000000340)='./file0\x00', r1, &(0x7f0000000380)='./file0\x00', 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x27e, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f00000006c0)={{0x2, 0x4e24, @rand_addr=0x1}, {0x1}, 0x40, {0x2, 0x4e23, @broadcast}, 'bridge_slave_1\x00'}) 02:06:05 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000000280), &(0x7f0000744000), &(0x7f0000001880), &(0x7f0000001900)) mknod(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000540), &(0x7f00000006c0)) r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) open$dir(&(0x7f0000000140)='./file0\x00', 0x0, 0x4) r1 = creat(&(0x7f0000000400)='./file0\x00', 0x49) lsetxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=@known='security.apparmor\x00', &(0x7f0000000680)='syscall\x00', 0x8, 0x3) r2 = syz_open_procfs(0x0, &(0x7f0000000840)="636c6561725f7265667300b04978e60c4ba32fd7b949714bcbe80c57af59747c61a31619cbafea034f5b6bb15332860b9f14c654d1012484f5c9d8edcad2f073e0ca5078fc64d38d1e297b9d66a71452b92cae675696040000001e87b8b54da0d1b5f3b4d6f8caf34a15ed2b2c98fcbf6778a196ad93aa3d2d7a067208277959e31ef261fa1ccb16594e7025d84ae407ab4a4139dc9a16b927000000000000000000") getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in=@dev}}, &(0x7f0000000600)=0xe8) lsetxattr$security_capability(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='security.capability\x00', &(0x7f0000000640)=@v3={0x3000000, [{}, {0x0, 0x3}], r3}, 0x18, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='syscall\x00') sendfile(r2, r4, &(0x7f0000000080), 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x1000000000016) recvfrom$unix(r2, &(0x7f0000000240)=""/106, 0x6a, 0x10001, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)) linkat(r2, &(0x7f0000000340)='./file0\x00', r1, &(0x7f0000000380)='./file0\x00', 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x27e, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f00000006c0)={{0x2, 0x4e24, @rand_addr=0x1}, {0x1}, 0x40, {0x2, 0x4e23, @broadcast}, 'bridge_slave_1\x00'}) 02:06:05 executing program 4 (fault-call:2 fault-nth:12): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 274.762978] FAULT_INJECTION: forcing a failure. [ 274.762978] name failslab, interval 1, probability 0, space 0, times 0 [ 274.792914] CPU: 0 PID: 8313 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 274.800129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 274.809490] Call Trace: [ 274.812099] dump_stack+0x1c4/0x2b4 [ 274.815765] ? dump_stack_print_info.cold.2+0x52/0x52 [ 274.821000] should_fail.cold.4+0xa/0x17 [ 274.825082] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 274.830218] ? lock_release+0x970/0x970 [ 274.834338] ? arch_local_save_flags+0x40/0x40 [ 274.838925] ? graph_lock+0x170/0x170 [ 274.842764] ? graph_lock+0x170/0x170 [ 274.846585] ? find_held_lock+0x36/0x1c0 [ 274.850670] ? __lock_is_held+0xb5/0x140 [ 274.854753] ? ___might_sleep+0x1ed/0x300 [ 274.858926] ? arch_local_save_flags+0x40/0x40 [ 274.863524] ? kernfs_activate+0x21a/0x2c0 [ 274.867785] __should_failslab+0x124/0x180 [ 274.872049] should_failslab+0x9/0x14 [ 274.875864] kmem_cache_alloc+0x2be/0x730 [ 274.880030] ? lock_downgrade+0x900/0x900 [ 274.884188] ? do_raw_spin_lock+0xc1/0x200 [ 274.888446] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 274.893474] __kernfs_new_node+0x127/0x8d0 [ 274.894290] audit: type=1804 audit(1540001165.921:40): pid=8316 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor0" name="/root/syzkaller-testdir552283608/syzkaller.KcLKQK/52/file0" dev="sda1" ino=16695 res=1 [ 274.897726] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 274.897744] ? graph_lock+0x170/0x170 [ 274.897772] ? __lock_is_held+0xb5/0x140 [ 274.897788] ? wait_for_completion+0x8a0/0x8a0 [ 274.897816] ? mutex_unlock+0xd/0x10 [ 274.940911] ? kernfs_activate+0x21a/0x2c0 [ 274.945168] ? kernfs_walk_and_get_ns+0x340/0x340 [ 274.950028] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 274.955577] ? kernfs_link_sibling+0x1d2/0x3b0 [ 274.960199] kernfs_new_node+0x95/0x120 [ 274.964199] __kernfs_create_file+0x5a/0x340 [ 274.964596] audit: type=1804 audit(1540001165.921:41): pid=8316 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor0" name="/root/syzkaller-testdir552283608/syzkaller.KcLKQK/52/file0" dev="sda1" ino=16695 res=1 [ 274.968640] sysfs_add_file_mode_ns+0x222/0x530 [ 274.968670] internal_create_group+0x3df/0xd80 [ 274.968697] ? remove_files.isra.1+0x190/0x190 [ 275.005126] ? up_write+0x7b/0x220 [ 275.008687] ? up_read+0x110/0x110 02:06:06 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000000280), &(0x7f0000744000), &(0x7f0000001880), &(0x7f0000001900)) mknod(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000540), &(0x7f00000006c0)) r0 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) open$dir(&(0x7f0000000140)='./file0\x00', 0x0, 0x4) r1 = creat(&(0x7f0000000400)='./file0\x00', 0x49) lsetxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=@known='security.apparmor\x00', &(0x7f0000000680)='syscall\x00', 0x8, 0x3) r2 = syz_open_procfs(0x0, &(0x7f0000000840)="636c6561725f7265667300b04978e60c4ba32fd7b949714bcbe80c57af59747c61a31619cbafea034f5b6bb15332860b9f14c654d1012484f5c9d8edcad2f073e0ca5078fc64d38d1e297b9d66a71452b92cae675696040000001e87b8b54da0d1b5f3b4d6f8caf34a15ed2b2c98fcbf6778a196ad93aa3d2d7a067208277959e31ef261fa1ccb16594e7025d84ae407ab4a4139dc9a16b927000000000000000000") getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in=@dev}}, &(0x7f0000000600)=0xe8) lsetxattr$security_capability(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='security.capability\x00', &(0x7f0000000640)=@v3={0x3000000, [{}, {0x0, 0x3}], r3}, 0x18, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='syscall\x00') sendfile(r2, r4, &(0x7f0000000080), 0x1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x1000000000016) recvfrom$unix(r2, &(0x7f0000000240)=""/106, 0x6a, 0x10001, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)) linkat(r2, &(0x7f0000000340)='./file0\x00', r1, &(0x7f0000000380)='./file0\x00', 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x27e, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f00000006c0)={{0x2, 0x4e24, @rand_addr=0x1}, {0x1}, 0x40, {0x2, 0x4e23, @broadcast}, 'bridge_slave_1\x00'}) [ 275.012240] ? down_read+0x1d0/0x1d0 [ 275.015994] sysfs_create_group+0x1f/0x30 [ 275.020165] lo_ioctl+0x1310/0x1d80 [ 275.023820] ? lo_rw_aio_complete+0x470/0x470 [ 275.028335] blkdev_ioctl+0x9ac/0x2010 [ 275.032241] ? blkpg_ioctl+0xc10/0xc10 [ 275.036142] ? lock_downgrade+0x900/0x900 [ 275.040310] ? check_preemption_disabled+0x48/0x200 [ 275.045352] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 275.051174] ? kasan_check_read+0x11/0x20 [ 275.055337] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 275.060642] ? rcu_bh_qs+0xc0/0xc0 [ 275.064215] ? __fget+0x4d1/0x740 [ 275.067693] ? ksys_dup3+0x680/0x680 [ 275.071425] ? kasan_check_write+0x14/0x20 [ 275.075290] audit: type=1804 audit(1540001165.921:42): pid=8321 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor3" name="/root/syzkaller-testdir823104128/syzkaller.fUwJ6Y/41/file0" dev="sda1" ino=16614 res=1 [ 275.075692] block_ioctl+0xee/0x130 [ 275.101521] ? blkdev_fallocate+0x400/0x400 [ 275.105860] do_vfs_ioctl+0x1de/0x1720 [ 275.109771] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 275.115319] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 275.120613] ? ioctl_preallocate+0x300/0x300 [ 275.125043] ? memset+0x31/0x40 [ 275.128342] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 275.133917] ? smack_file_ioctl+0x210/0x3c0 [ 275.136504] audit: type=1804 audit(1540001165.921:43): pid=8321 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor3" name="/root/syzkaller-testdir823104128/syzkaller.fUwJ6Y/41/file0" dev="sda1" ino=16614 res=1 [ 275.138274] ? fget_raw+0x20/0x20 [ 275.138294] ? smack_file_lock+0x2e0/0x2e0 [ 275.138309] ? rcu_read_lock_sched_held+0x108/0x120 [ 275.138336] ? do_syscall_64+0x9a/0x820 [ 275.138355] ? do_syscall_64+0x9a/0x820 [ 275.181183] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 275.186736] ? security_file_ioctl+0x94/0xc0 [ 275.191167] ksys_ioctl+0xa9/0xd0 [ 275.194646] __x64_sys_ioctl+0x73/0xb0 [ 275.198557] do_syscall_64+0x1b9/0x820 [ 275.202466] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 275.207850] ? syscall_return_slowpath+0x5e0/0x5e0 [ 275.212802] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 275.217666] ? trace_hardirqs_on_caller+0x310/0x310 [ 275.222709] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 275.227739] ? prepare_exit_to_usermode+0x291/0x3b0 [ 275.232776] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 275.237662] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 275.242858] RIP: 0033:0x4573d7 [ 275.246062] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 02:06:06 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = socket$nl_route(0x10, 0x3, 0x0) getpgid(0xffffffffffffffff) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) perf_event_open$cgroup(&(0x7f0000000400)={0x7, 0x70, 0x0, 0x0, 0x800, 0x0, 0x0, 0x101, 0x0, 0xa, 0x0, 0x600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xdf, 0x0, 0x0, 0x75ea, 0x0, 0x0, 0x0, 0x5, 0x9, 0x0, 0x0, 0x4, 0x2799, 0x0, 0xfff, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x6}, r2, 0x0, 0xffffffffffffffff, 0x1) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r2) r3 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r3, &(0x7f000047b000)={0xa, 0x4000004e20}, 0x1c) mount(&(0x7f0000000540), &(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='cgroup2\x00', 0x0, &(0x7f0000000600)="cf9df31b1801567673ee73a04f0a8be988af1e30b728f5a56a0e8a7dbd6b4057edd821d079f3c71364ebaf9e2a274d2faa5d6760fbed54aec8de962918ec5db3fa4bb1e6e7") listen(r3, 0x20000003) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f0000000240)=""/114) r4 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r4, &(0x7f0000419000)={0xa, 0x4e20, 0x7f000000, @loopback}, 0x1c) accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0xc, 0x0) getpriority(0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r5 = accept(0xffffffffffffffff, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f0000000040)=0x80) r6 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r6) r7 = syz_open_dev$sndpcmp(&(0x7f0000000300)='/dev/snd/pcmC#D#p\x00', 0x7, 0x4000) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000340)) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) getsockopt$inet_opts(r5, 0x0, 0x9, &(0x7f0000000380)=""/99, &(0x7f0000000480)=0x63) clock_gettime(0x0, &(0x7f00000004c0)={0x0, 0x0}) write$input_event(r7, &(0x7f0000000500)={{r8, r9/1000+30000}, 0x17, 0x3}, 0x18) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f00000001c0), &(0x7f0000000540)=0x4) getsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000280)=""/7, &(0x7f00000002c0)=0x7) 02:06:06 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f000000a980)=[{{&(0x7f0000008540)=@nfc_llcp, 0x80, &(0x7f000000a900), 0x2b8}}], 0x1, 0x0, &(0x7f000000ab00)={0x0, 0x1c9c380}) syz_emit_ethernet(0xfb4, &(0x7f0000001c80)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff9100160081002c008848000000000000000000000000000001000000000000000000000000000090518e628ef4c61394110400000000000000000000000000000001fe8000000000000000000000000000aaff0404024e580800fe80000000000000000000000000002000000000000000000000000000000001000d00000000000007280000000408ff44008d2a0000000000000100000000000000f9ffffffffffffff0100010000000000000100001307aae3a20faceb5de4672257b7f5900ae02efa000100c910fe8000000000000000000000000000bb000100000100c91000000000000000000000000000000001002c04023f00000000fe8000000000000000000000000000aaff020000000000000000000000000001ff080404ba200200fe80000000000000000000000000001efe80000000000000000000000000001cff01000000000000000000000000000100000000000000000000000000000000840200000000000005020800c910fe80000000000000000000000000001600006b05000000000000010800000000000000004b091fd4a96b2791fa26e0010700000000000000040105050200060401003a000001670000000c21880b006000030001b4e9eb2fef24fb7ed5b7a8f2a9c162055550fec62abcba421eca3fa315030f4ba3ed0288ff3e10d26fabc9ac36540c5b615f0166f90a4dedc4af50b227c10bdc77bf894ace6d548c050e95bf3d92f06faceecc7b0c2f3a7f9d2e7c50a98f5a5a0c000800c84199b2570a1d631f19959414600c5b49778b5921e46670a207242741ee7ad31bc291c2a144e0806696d3ac9a741f020e7854a3edb238c914d343f90daaeea0268b8493ac464bcb67d74c9b4e051a4b58c1ab3b4676391ae276b9e8c3e064964525269fcbf01e8fc78cd8b6eb09a0a4c51ef9b7a646c637e51e08de98cac9344ddd6046628195179dcbc0a794446653ffe837f761f02b959b17d00a6877eea8b09f8cc9008cf4eb2c995784d33ddbcfecddd18564ef65fd8d4fccb792d365fa90c118bf8bad9ed8dfdbf9d63efec3a21660aa3f1ec570a379362c709d4f9a7cb62d339fead9dd1cd1e477b49df8fb6b4387568fd37e08d43899d885ce92b882c73bfa029e9beec0d2eee01d38fc7f29416b50459eb5ee848677d08b251e403b55f246ceebfb05bdb403dcb1f88020f16a1552df78a8c0e8d0582ca34f16752bfe71a272f96feff619ff61e9861a50f33d45ead7844f6afd8dfce4f9bee9a7564d545421d6ed7128c7b3c5cad42460ed3221cc08cd133ff55e936931dc6b5595e75e6ddea6bd25b6c9feb69f886ab8c2c865328170d78c5820bca06912bbd56079df4364af56e75c0f1f378075377671c183989b5aff32eb8606dea5c40e3cae8acc150616d05c120207a539e89ef11a5611769537353188a979d8b05c633c5137b0892f98576c8b89744221d0513986aba5522e1dc091850e7aa6dabaf349f9316e4410d1f24948774d9de7d0717fba0bc7790ad40d47b86d0842ed799a5c818f3a759d3362643f36ad38db679cdeca8624609b5af0099a7cf195cc21a56eec6c76448d5e16d73d397ae787fdf2ceca0cf7a65d4ed0a728ecbe054b6105791834d7f741e2a1b28a162391f859cb45f0ced8ae76053d5d1330ecda07b84ef87cafc4e36e4dad93a68b314003a6fc6e640e3c025b90de873a890df7c34a770adf4d4cf8dec8bba2f4306d58ee6f2d072e21251b89dae970c9d2c807fb61dacebc97e822638b798ffa785fbdc9ae65b301cc8484bb4cdd0842300be63d04b2d23ef7b657d916cd4cce546a206cf4c3b63b3a6ea8ea20c4ed08a2597eab99bff9e925386e52bb12acbd1f66fe791795c236d603f3a90037efd697440530bb366c107b248705b873e5269366de81eb3c3c73e13a7a9363a305de75621ed52b021894f7b9c34a75370ddb7ef4a633c51c10b274c305180b66ea0fd712ffb61ab575960507f944f93c907916cddc3e48e12fbb83851d95f6d0253901e6aeb6179a079be314a69a710bfa11160c9ed387d83f629102a35c170e9564feb8d48f1a1b286cd5b0aefcca7fd5a039ebf67dde9a6a482437247c2e33b930f1146716d8168354837646f1764c11387d9893db20c2c700dd64f1ef76cb6fed8ee1909a3504fb9a603a622a797293d140e7ab6ea8bd749aa42a38c8b0a2256d8bf4d33228ca23301b7dd258410720fc27dadaf4e30f30bb6cbed3c952edfe32c4fd0bc38853444d02eb090a795c49f2de3d7dedceac50c222f2b9be3ae9fb8f9f6b163be4278e73236a6a12ebd02e8f52b884ef266488c4394ae8e10b06bd1c5524ce60270e154220b8d4d70b55af625c74fad0289a70805e7f12cd5240f4fe8259ba55d8a562bff6f92250f85b0f5be639c21653f5648dbf43b0008b7aa57603acd9c078f6c5acd8d68f0173ee4bcfdfe540d281e9e635647c0efccc71a8c25f3f36578358b39f1f1c79061de1bdcf54820dc1e21d07522c32ec4c2ed45f4125579f4b29183e77c4c1d23e9d0a71fa1fcee53696a36809d76395f30900ac1cde37abf5e6b39cc1e79d090084539756dae3e3435f2ff945553606ad41b2d1f2c52ed53bceb1ccc8a38f215f42e1e8769181c7b9293b5511d187a656e7819e7afec47b819fa0eb47787acbcf8c87b74ff9bfd80bfe9a63c8e1cc558ad6d8d8d1e9d1631dae204daefca89da3f3b7c4dd82549ee6f6e944ec461361d40efb2c46a662a4b50694aaeca4e584ca403767886560daa692141843f9708d86f4fd3985be040eee186b895c46828e25389855236ba9e09edd89a8396fddef9b685dfd22e1df9c5a87f77feb3c5dc108395debbf8f3c7d7e39b21337243cb26fd7431abeb60239245be9b8eb67d2cc5d5828e6764ec42b2624697ad079681eea4d326f6fb3f35e0052bf103eb9855f5f73dfa1e607d5b5899050fbc1f90b1a37333d83886a41fabc59e3837cbc9c277df952eb4e8a580af5fe95b2a92c947e982ab1ce7658221bfcbe24d6b54b34b120c87b53de61aa33233e143a9071b0437c72b2f44244cdf200d522cb7f45b4249791f6d5ffabc3c5462ddfdbba6cd072ef91f2ea88db8d18263a3a3647d74f1ddb3058ed0a84245072625656cdde5da4bfb33cc707f37c9cbfce20883cae63837856238d8c3d43f43452a130c3a62f649a2bf5b4ab48390a07adf3ccc9f243b5faf017c05a97dbafc4f4f877de6a4f2b13492d5b6d184a9155239b710930468daacae79e01f779198d19c076782f17d357d8fd9fe9222784a41cea1552a7086991d898024f55f4c6e0e939f475bac8822bd01ba100253e2d38e243ef1bde72123818f00cd70a7703dcda6135afafa8e95651589411a62aa4330d3d0c776affd31ba39caced443e59b2a0262dad18e027bb21759732160c9f19d6dbd5212e7ab1c7cf0908cf2628105230ce6820b54c61654a63e99a2e81ff94f7f9a77e498e2fb5d079687c0aa24741628f4b08ce7ea6055dcfd3ecceffa5f0124d9ece48aa2c30466b8bc0c7cc879b5a32e96a0804ee5a512ef4765da061a255a0502d6c43d25752f0d23700e61f01f1f2df12dd5417c4f51c5e66bd3b90b6589fe41cc3ef196c4bb0b6c1cef3f0236a3cdf6b7abdcc81a8046c5d06056732f9a31cbdfbbd3c0bf02e210a9303c6622dc524843096a4d2efd6bbe32ef14e4dd7692431d27cd0bb88bbda303ca2bd66ebf57b135790e2e97b33afc3da449c5fc5934c9c827b06417e37cee2d5d250c99d880d86df89e9204e130b60e1a33eac71b165e73377409a9ac25c9f07cc963069d19ccf2d48b2e5045291731120e46a35b34b24bcddca5bb835b274f33876fd29aaa3d413c8275a669fefc19e259f06663844973c809e6f80b0ad35960122e4044dde107f8b269fe23baed08dbacc5dbd25b12e1e2c9c7f50262e9f3923e68e81305bbdfdde3363493c79adc5190d5a3b273ab662fb30481ce327e28b0daef30dae6dc27967afcca812b8a93d6ab2be44f2788ecefd3623a43690a9a0fa3abad42967c3ed5f586801a5da69449e0a7455f98e17c8e59194e9af3052bfdeb543464f478f80fe8f19e9e429f37bcef8e1025cffac5ae43bacd11a34a63cf3d1b51f3c0b7bb356d3df3e1e21f10a5a766db3b2dab48f481ac1b950626054a78327e5652620afb6a210b63cc381de3504787459ec7a413f81cbd6112a9ceb14fdbecb6b63facda5331bb44c47589e976b843a36210ed3e6e4cbf6138c33fff8d73f2d93e65d77633cc0e518e2c442361bf9bfda6e0c8b3152f5a8ea0ad4f89e0cfc2c2545667b8091e6e33ac15c2039b7de8829afa44c2d9303ddb2b883500c5a6fe98730093408008d17f0d0f5e230fdc141ac7db56da698f63834d37f76c4050df02d5c8193bd58875299acee4a029c8f5b2456d307bfb7aa58d4dcda50639ffb66340c6b6bdfaa86b14816ed8d50940ee32a6b0a7f996adac99fa5f7e66bf2621de2c87a6a2766e3b13d773aaba326cb583cfa0639f062c40d5f28b4f4d1bca432d8370b4b331b099874349052a3f55a900a97f89c7f722bcc916c00249b9bf06eef6d440b2429fdfe85d405e18773c3511808e676d4e6b253832f1c2bef61090c48bd0097bc0733de02736ed63da449f0927a19d4b7fed78341b8ea90d86685cb5ca99b553d165648395e1cf5dc0842b0774a024445dc491c95afb4949736e1882bfdc26d7388faa2cc7357a8ef13c1a82e1e6c8ad377813dc52567f70415010e1fbcfd4093457a32e60461394222c332a25c7bad2f3da9ad8039e61131901ec0b6e254b23a2301e6d182a1f35ebddb23a0eb6e669c28c76ad82ba1fb3c43a1bc50ede4722f6613ed8249e262992a365596709778a04b0b1a41e71835e65dfaf4c000e76592586469e7c96c53ff45119ec1ef00f0dcc804b9c9c7f36e08e73ba9d79917f62c985b10f684e7cf1c7c9e4d6e9bc82946d0fa17332b10f9b23c93ff5d94bb3c4ab325d075743976a15d15bce7fd4c49b17ec0834063c8165a658aaf16b229cf77c8b41347c2961f9551dadeb7d7ebdbd709ec6773d64930f29bd3ad137217a87861909663ee4d4b001c7118a939d1a9513e7e0e2f00724f802e40548e8b96d0c6945c99208a679d13fed5db7d2c482e9289ee653cbafcff463f4ee97809d7fc3f1520e36edc5a1fc90f19486f5b2e81463e00b39f54d2ae4ecea76253a91f7667293fb73ace0dd2f8fd844e3a065a8b0a259e47c001bfa768a71b64b2180354d0279da4c630311ad175b81f4b9308a71d3cb13845c21ad0f2faab46aa2d5be09b63794dd0b655430316ca6615e219b1610662fbb5ed6b53c17e9a8015e905ef8f2a82388f6dd7b31f7d95cffa63ceac9f0ec185f929690b324690edf4f2487f64bb1735b8d1b56b0bb5f594460f4fa941a395468047e631bb85c0ca4cfce20f04d407723c79b7d0a4b5edecb5f9e9ec8f2bb513c580193dad0929b9d5aad08eb0841d80829ed6b0f4c91fd2cfa8604ecf9d179d520b1a400498c9318519818645e9d228c358b0d90788efc6337a4d1dd88932b5922270f256aa98444632c8a10941e1cd27f6fdc1c10f76d581c033f3eee86705dca1c612e7fa0ca30a3746eed18557854b223b02c92bd9bdc02dc5339179d51ddeac4262abf0366f019f4642ca1e2382bae7b6798ecd1e4c311894f70862cd527872b29187a5d31b53fa55481774f4e4459850057ef8d330f0ac61a53b9b44c41fa8a2be111a7255cfe1c960040377a94f657d685044e551ddf4e325486974e0fcac40bd52475fcd2e5d067b419db38bca681702ae59d32f65142629e0feec3a9e4c726a0d37b54b817136339fb4fb2a88fff6bb9ac2c510b721f3820c70085de44ab431157f793685f978d71784b15e60e82ab091de76810970f4588f325146fe0d89a275db3503384b23c67e691f95a3e06e710ec7c2427e17db19e0884f10cd99467ef0026405611890fa874b82888f443ed910bdd589cf5366d978bfea944047218141181552c6982a0548b15d43f946cc0b72c439a5ca2f208c81cbd1c2d78d960447353072f6518ffb21481907218644aa8f0bf30d22ad85606eb6bbb4e60440b8ac995c8648f40032cdd8400bf451c37433ca39bde9d788e79db53bbd6b69366f63fc8a8f7f39d47e88c2b6459751f043d31dad74b0480e6881a499697936bbd88148d9e8186b04b65462367ba8760092e8a306b0af4f1dd5416039f554f20a29012aafb90200a1573d24a6c12f99b5c0e60b13bf45d4a2ba7aacca31a6471ae53552a9c37deb80f82d97a48dbfb5dd2d5862c8ebfd2137b2f1337ce515bc1e1b7a388198ec4ea58b9efd09d1aea44a3b4810d434adc16660989fe9d493aa844371d9ee5aa251d9abc34be7aeedf021290a230048cd14b5028e7a67f0666a2a22b50b097fd792d12acd6298f8b9d54f580600000000000000e4894ef6a8e7982ca49baefe45689c56e5c53b07d722070ae486571db30e2792aba2f51eb736b36e656a393a5c2f1a5305c038f6a521e3c53d8249bba81330010086dd001f0002957a113f51982656244b3411ac5af9d69178b022d9b909895bd15a5b6ee67c8dade625e9c0b204a26d6f57080845d9421c4c4fe4572e389499bd49c83e09820ed7a31560f719d142da311feb640ead495d3455d766ed5e05e50c77b9de404838badfd0b2fca75bed1b63d560bbc146592d26997de449fe49bdbe5a1621e85af7cb97aa69dd1491e5bb7692960540341694f0da346bae100ad0d5dc39ea784d8797b3acb1b21d7366920053405a78c36ccac324ccc96611dd3ae7c1a9e97a247e51ab421416d05a7b4ff8080088be0000000214020f2b0100000000000001080022eb000000022201b8040200000000000003008e83180800655800000001dac4078e6bbe5c997a0a9638a0e2b2f7ef3679e48dfa4b385b370ed6a2688b86d123bb6ccf808c2dd0e0142aae7ba591d8a39068cbabd8e34b8fd70082a2519b99a4ebf9cd2b3238cca2cc68e89426c7eff156716b103ad63d3f4bafbcee210add3c9c502fad712e3023bc6bb23ba487be2a3282d8d5c7d02b57065ffd7f476c7022ae7a0042a5326be0a3ebaaf94d5981a6f7313c1ee7973ba88afeb8d03ce5d3943ae80621276951b5f4db73f0061d4e28990d31d9fac4987a068f682089e287158c1bab02e984b9c5edeb7062874250d5499ce34f422a3d83524ba460601ba7315e45f7c0da45d5fadeda2b0146119dd97db4384262431562daa0e299ebd9837cf8ac87f1d1c47c83bb8408faa716baa4cb1aa6ef3bf20ba90a84df3df75d9789da97c7ae07066afcf962e2d44c1bddd0a05f7b94341bf1e33bbdff0627efaf17d7950da04c52fcb5c92336bb90707fc3b59a43ed5ba7721e623d3913efb3ab73ebeb8d1e7e5bed512aeedef7121332b02ba60760611c1e94eefb36336e5f4648016de4566c6168fc06df938288c4e11a89f2ce658d3c90000000000000000000000000000049853e62f65baad849567787bb661bf7192e297282b2dbfcef6296fc4ba11dc26b333ca6042ba08555c8557a6af06a359774f8c6b71dcec410a39dd75de12a960cf16eb8763932ad0900e1bbd09cc98d4e3e29d9130e6af9a6b1fa8b86545fd6616fb4864c7d5747c31374b803af037024dbaa9b78e66969b98c5d9106dd2651b5c6de5a9630dba89aa9c6de24b7aa77dbd8b6810f8dd106723d17c7b5b3ecef5394b6bd427fd462ea00f41be1501da11c0e4a89319691d9e919117aebe9fa8156fd0dbf5f9c65005f1de5ad6fa2eb7b6d4e8742165ab65687868bb3c5e3c9b1c59a5864450ccd05"], &(0x7f0000000640)={0x0, 0x0, [0x118, 0x0, 0xda8]}) [ 275.264968] RSP: 002b:00007f67d7cb1a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 275.264986] RAX: ffffffffffffffda RBX: 0000000020000110 RCX: 00000000004573d7 [ 275.264995] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 275.265004] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 275.265014] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000004 [ 275.265022] R13: 0000000000000000 R14: 00000000004d7d88 R15: 0000000000000003 02:06:06 executing program 5: bind$inet6(0xffffffffffffffff, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(0xffffffffffffffff, 0x3) r0 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r0, 0x40012}], 0x1, 0xff) writev(r0, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 275.358245] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:06 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000c97ff8)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) close(r1) socket$inet(0x2, 0x8000a, 0x6) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000b04000)={0x0, 0x0, &(0x7f0000000080)=""/188, &(0x7f0000034000)=""/95, &(0x7f0000ce1f30)=""/208}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001400)=ANY=[]) setsockopt$netlink_NETLINK_RX_RING(r1, 0x10e, 0x6, &(0x7f0000000000)={0x1, 0xef7, 0x9, 0x8}, 0x10) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000d7c000)={0x0, r1}) sendto$inet6(r1, &(0x7f00000006c0)="2329e1785c22c4aa45fd2a02c1e8", 0xe, 0x0, &(0x7f0000000740)={0xa, 0x0, 0x5, @mcast2}, 0x1c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r1, 0x28, &(0x7f0000000040)}, 0x10) 02:06:06 executing program 4 (fault-call:2 fault-nth:13): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 275.590125] audit: type=1804 audit(1540001166.721:44): pid=8332 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor0" name="/root/syzkaller-testdir552283608/syzkaller.KcLKQK/53/file0" dev="sda1" ino=16687 res=1 [ 275.644943] FAULT_INJECTION: forcing a failure. [ 275.644943] name failslab, interval 1, probability 0, space 0, times 0 [ 275.682967] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 275.687456] CPU: 1 PID: 8358 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #69 [ 275.692515] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 275.696745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 275.696754] Call Trace: [ 275.696781] dump_stack+0x1c4/0x2b4 [ 275.696807] ? dump_stack_print_info.cold.2+0x52/0x52 [ 275.696853] should_fail.cold.4+0xa/0x17 [ 275.696878] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 275.696903] ? lock_release+0x970/0x970 [ 275.696922] ? arch_local_save_flags+0x40/0x40 [ 275.696941] ? graph_lock+0x170/0x170 [ 275.696960] ? graph_lock+0x170/0x170 [ 275.696988] ? find_held_lock+0x36/0x1c0 [ 275.697005] ? __lock_is_held+0xb5/0x140 [ 275.697034] ? ___might_sleep+0x1ed/0x300 [ 275.697057] ? arch_local_save_flags+0x40/0x40 [ 275.697075] ? kernfs_activate+0x21a/0x2c0 [ 275.697107] __should_failslab+0x124/0x180 [ 275.697131] should_failslab+0x9/0x14 [ 275.697151] kmem_cache_alloc+0x2be/0x730 [ 275.697170] ? lock_downgrade+0x900/0x900 [ 275.697188] ? do_raw_spin_lock+0xc1/0x200 [ 275.697211] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 275.697234] __kernfs_new_node+0x127/0x8d0 [ 275.697258] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 275.697275] ? graph_lock+0x170/0x170 [ 275.697304] ? __lock_is_held+0xb5/0x140 [ 275.697324] ? wait_for_completion+0x8a0/0x8a0 [ 275.697355] ? mutex_unlock+0xd/0x10 [ 275.697372] ? kernfs_activate+0x21a/0x2c0 [ 275.697402] ? kernfs_walk_and_get_ns+0x340/0x340 [ 275.697424] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 275.697442] ? kernfs_link_sibling+0x1d2/0x3b0 [ 275.697468] kernfs_new_node+0x95/0x120 [ 275.697493] __kernfs_create_file+0x5a/0x340 [ 275.697519] sysfs_add_file_mode_ns+0x222/0x530 [ 275.697548] internal_create_group+0x3df/0xd80 [ 275.697578] ? remove_files.isra.1+0x190/0x190 [ 275.697600] ? up_write+0x7b/0x220 [ 275.697616] ? up_read+0x110/0x110 [ 275.697646] ? down_read+0x1d0/0x1d0 [ 275.697680] sysfs_create_group+0x1f/0x30 [ 275.697705] lo_ioctl+0x1310/0x1d80 [ 275.697733] ? lo_rw_aio_complete+0x470/0x470 [ 275.697756] blkdev_ioctl+0x9ac/0x2010 [ 275.697779] ? blkpg_ioctl+0xc10/0xc10 [ 275.697796] ? lock_downgrade+0x900/0x900 [ 275.697816] ? check_preemption_disabled+0x48/0x200 [ 275.697841] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 275.697857] ? kasan_check_read+0x11/0x20 [ 275.697878] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 275.697898] ? rcu_bh_qs+0xc0/0xc0 [ 275.697929] ? __fget+0x4d1/0x740 [ 275.697958] ? ksys_dup3+0x680/0x680 [ 275.878976] ? kasan_check_write+0x14/0x20 [ 275.879004] block_ioctl+0xee/0x130 [ 275.879022] ? blkdev_fallocate+0x400/0x400 02:06:07 executing program 0: syslog(0x4, &(0x7f0000000140)=""/101, 0xffffffffffffff93) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x4000, 0x0) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x400040) dup(r0) 02:06:07 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x19, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000060b8"], 0x0, 0x0, &(0x7f00000003c0)}) r3 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4, 0x408400) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f00000000c0)={0x2e, 0x3, 0x0, {0x6, 0xd, 0x0, '/dev/binder#\x00'}}, 0x2e) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=[@enter_looper], 0x48, 0x0, &(0x7f0000000480)="f27aec438116cefc2a394072b6ad8809e53ac6553db7f225a4e47722a00ba8846454ad779316094e4bee8cab76761555d3676404fb3c728f045f7d9ecc9b2662539500d7df7d1802"}) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000200)=""/51) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="01634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000a692a230d5f2aca1c5dd3b5ca47b16a5c84597551da8a2fe2d771f88f7080e82c88fa043290f055074e03a0c32c0a3265b07e7e1b80e797e7a3a00d07c915a62827fa52179d2966ed29c0079d488ba4359d5f7578ccc665be818e8df76e62a64db0d291ae9026c40352b8f3db4a90e56a566e4abbc5c42f6f0d25609c20aad06cee2d111bca63fb07450041c93137828b6e056f6b36e599098ce4e47217fad3c7380c31e76e4bb6acb9fffe5226a48b378a39d2f7f1b8a7934ac4826203f92375c5335e389c00de1c35591313efe6e8c280f95cf71d47111c773a2497aa3b5", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000500)}) 02:06:07 executing program 5: bind$inet6(0xffffffffffffffff, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(0xffffffffffffffff, 0x3) r0 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r0, 0x40012}], 0x1, 0xff) writev(r0, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 275.879040] do_vfs_ioctl+0x1de/0x1720 [ 275.879066] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 275.879082] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 275.887345] ? ioctl_preallocate+0x300/0x300 [ 275.887359] ? memset+0x31/0x40 [ 275.887377] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 275.887404] ? smack_file_ioctl+0x210/0x3c0 [ 275.887419] ? fget_raw+0x20/0x20 [ 275.887435] ? smack_file_lock+0x2e0/0x2e0 [ 275.887449] ? rcu_read_lock_sched_held+0x108/0x120 [ 275.887476] ? do_syscall_64+0x9a/0x820 [ 275.887491] ? do_syscall_64+0x9a/0x820 [ 275.887523] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 275.887540] ? security_file_ioctl+0x94/0xc0 [ 275.887560] ksys_ioctl+0xa9/0xd0 [ 275.887581] __x64_sys_ioctl+0x73/0xb0 [ 275.887600] do_syscall_64+0x1b9/0x820 [ 275.887644] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 275.895433] ? syscall_return_slowpath+0x5e0/0x5e0 [ 275.895450] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 275.895468] ? trace_hardirqs_on_caller+0x310/0x310 [ 275.895486] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 275.895505] ? prepare_exit_to_usermode+0x291/0x3b0 [ 275.895528] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 275.895551] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 275.895568] RIP: 0033:0x4573d7 [ 275.910521] Code: 48 83 c4 08 48 89 d8 5b 5d c3 66 0f 1f 84 00 00 00 00 00 48 89 e8 48 f7 d8 48 39 c3 0f 92 c0 eb 92 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 5d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 275.910531] RSP: 002b:00007f67d7cb1a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 02:06:07 executing program 0: r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFCONF(r1, 0x8910, &(0x7f0000000100)=@req={0x28, &(0x7f0000000080)={'vlan0\x00', @ifru_data=&(0x7f0000000040)="525e861fdd7ce05c42f893f97c01723a44d15f8f45024d4fa68590fe8ebd8a46"}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) ioctl(r0, 0xc0884122, &(0x7f0000000140)) 02:06:07 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = socket$nl_route(0x10, 0x3, 0x0) getpgid(0xffffffffffffffff) mount(&(0x7f00000000c0), &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) perf_event_open$cgroup(&(0x7f0000000400)={0x7, 0x70, 0x0, 0x0, 0x800, 0x0, 0x0, 0x101, 0x0, 0xa, 0x0, 0x600000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xdf, 0x0, 0x0, 0x75ea, 0x0, 0x0, 0x0, 0x5, 0x9, 0x0, 0x0, 0x4, 0x2799, 0x0, 0xfff, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext, 0x0, 0x0, 0x2, 0x0, 0x8, 0x0, 0x6}, r2, 0x0, 0xffffffffffffffff, 0x1) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r2) r3 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r3, &(0x7f000047b000)={0xa, 0x4000004e20}, 0x1c) mount(&(0x7f0000000540), &(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)='cgroup2\x00', 0x0, &(0x7f0000000600)="cf9df31b1801567673ee73a04f0a8be988af1e30b728f5a56a0e8a7dbd6b4057edd821d079f3c71364ebaf9e2a274d2faa5d6760fbed54aec8de962918ec5db3fa4bb1e6e7") listen(r3, 0x20000003) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f0000000240)=""/114) r4 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r4, &(0x7f0000419000)={0xa, 0x4e20, 0x7f000000, @loopback}, 0x1c) accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0xc, 0x0) getpriority(0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r5 = accept(0xffffffffffffffff, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f0000000040)=0x80) r6 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r6) r7 = syz_open_dev$sndpcmp(&(0x7f0000000300)='/dev/snd/pcmC#D#p\x00', 0x7, 0x4000) ioctl$SG_SET_RESERVED_SIZE(r7, 0x2275, &(0x7f0000000340)) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) getsockopt$inet_opts(r5, 0x0, 0x9, &(0x7f0000000380)=""/99, &(0x7f0000000480)=0x63) clock_gettime(0x0, &(0x7f00000004c0)={0x0, 0x0}) write$input_event(r7, &(0x7f0000000500)={{r8, r9/1000+30000}, 0x17, 0x3}, 0x18) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f00000001c0), &(0x7f0000000540)=0x4) getsockopt$packet_buf(r5, 0x107, 0xf, &(0x7f0000000280)=""/7, &(0x7f00000002c0)=0x7) [ 275.910549] RAX: ffffffffffffffda RBX: 0000000020000110 RCX: 00000000004573d7 [ 275.910559] RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 [ 275.910569] RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000a [ 275.910579] R10: 0000000000000075 R11: 0000000000000246 R12: 0000000000000004 [ 275.910588] R13: 0000000000000000 R14: 00000000004d7d88 R15: 0000000000000003 [ 275.930701] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 02:06:07 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001d80)={"74756e6c3000000000000000e0002000", 0x0}) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, r2}, 0x58) [ 276.189947] binder: 8361:8378 got reply transaction with no transaction stack [ 276.217362] binder: 8361:8378 transaction failed 29201/-71, size 24-8 line 2762 02:06:07 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = msgget(0x3, 0x88) msgrcv(r2, &(0x7f00000006c0)={0x0, ""/4096}, 0x1008, 0x3, 0x1000) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_GUEST_DEBUG(r3, 0x4048ae9b, &(0x7f0000000000)={0x3}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f00000000c0)={0x0, r3, 0x6, 0x1000, 0x3ff, 0x3}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000180)="2e65f32efe0a6766c7442400008000006766c7442402000000006766c744240600000000670f011c24b866000f00d066b88044a2b20f23c80f21f866350400d0000f23f80f0766b80500000066b9080000000f01c10f0766b8010000000f01c10f01dfb835008ee0", 0x68}], 0x1, 0x0, &(0x7f00000000c0), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000003c0)=[@text64={0x40, &(0x7f0000000340)="b9024d564b0f3248b83cc6e176511aef170f23d80f21f835000000300f23f8660f383dc70f06470fbe641303470f01c83e460fc7183e66410f38802866b845000f00d80f35", 0x45}], 0x1, 0x0, &(0x7f00000006c0), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000680)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 276.329099] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 02:06:07 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) sched_getaffinity(r2, 0x8, &(0x7f0000000100)) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x80801, 0x14) getdents(r3, &(0x7f0000000180)=""/243, 0xf3) bind$alg(r1, &(0x7f00000002c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-avx\x00'}, 0x74) r4 = accept$alg(r1, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x121882, 0x106) sendmmsg(r4, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x10, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0xffffffff}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000380)={r5, 0x3, 0x3bd3, 0x3, 0x2, 0x3ff}, &(0x7f00000003c0)=0x14) 02:06:07 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:07 executing program 2: mkdir(&(0x7f00000004c0)='./file0\x00', 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setxattr$system_posix_acl(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)='system.posix_acl_access\x00', &(0x7f0000000580)={{}, {}, [], {}, [], {0x10, 0x1}}, 0x24, 0x0) open(&(0x7f0000000080)='./file0/file1\x00', 0x41, 0x0) chown(&(0x7f00000000c0)='./file0\x00', r1, r2) mount$9p_xen(&(0x7f0000000000)='security.ima\x00', &(0x7f0000000040)='./file0/file1\x00', &(0x7f0000000100)='9p\x00', 0xd8a70f3824bedb0b, &(0x7f0000000140)={'trans=xen,', {[{@privport='privport'}, {@privport='privport'}, {@cache_mmap='cache=mmap'}], [{@obj_role={'obj_role'}}, {@fowner_eq={'fowner', 0x3d, r1}}]}}) lsetxattr$security_ima(&(0x7f00000002c0)='./file0/file1\x00', &(0x7f0000000300)='security.ima\x00', &(0x7f0000000340)=@v2, 0xa, 0x0) 02:06:07 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:07 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000380)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3cad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88c60fd7140fbc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz0\x00', 0x200002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={"6e72300100", 0x801}) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x20000, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000080)=@assoc_id=0x0, &(0x7f00000000c0)=0x4) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f0000000100)={r4, @in6={{0xa, 0x4e23, 0x7, @ipv4={[], [], @remote}, 0x7fffffff}}}, 0x84) openat$cgroup_type(0xffffffffffffffff, &(0x7f00000004c0)='cgroup.type\x00', 0x2, 0x0) recvmsg$kcm(r1, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000017c0), 0x0, &(0x7f0000001840)=""/33, 0x21}, 0x0) write$cgroup_type(r2, &(0x7f0000001900)="746808066164656400", 0xfdef) socketpair(0x0, 0x2, 0x0, &(0x7f00000005c0)) 02:06:07 executing program 2: syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_PIE_OFF(r0, 0x7006) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000880)={@un=@abs={0x0, 0x0, 0x4e21}, {&(0x7f0000000680)=""/183, 0xd4}, &(0x7f0000000300), 0x21}, 0xfffffffffffffeef) ioctl$KVM_GET_NESTED_STATE(r0, 0xc080aebe, &(0x7f0000000ec0)={0x0, 0x0, 0x2080}) timer_settime(0x0, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}}, &(0x7f0000000380)) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000900)=0x6) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000180)='./file0\x00', 0x2, 0x0) mknodat(r1, &(0x7f0000000140)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000080)='./file0\x00', r1, &(0x7f0000000100)='./file1\x00', 0x4) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000500)={{{@in=@local, @in6=@mcast2}}, {{@in6=@mcast2}, 0x0, @in=@local}}, &(0x7f0000000600)=0xe8) mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x5, 0x0, 0x3f}) setsockopt$inet6_dccp_int(r0, 0x21, 0x1, &(0x7f0000000200)=0xfffffffffffffffc, 0x4) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000440)='/dev/autofs\x00', 0xc000, 0x0) faccessat(r1, &(0x7f00000000c0)='./file0/file0\x00', 0x40, 0x100) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000240)=""/72) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f00000002c0)=""/60) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000180)={0x0, 0x40}, &(0x7f00000001c0)=0x8) kexec_load(0x201ef1c0, 0x1, &(0x7f0000000180)=[{&(0x7f00000001c0), 0x2, 0x1d14bd000, 0x1000000}], 0xc0b11f2000000000) gettid() [ 276.792054] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 276.803835] binder_alloc: binder_alloc_mmap_handler: 8361 20001000-20004000 already mapped failed -16 [ 276.836240] binder: BINDER_SET_CONTEXT_MGR already set [ 276.853489] binder: 8361:8362 ioctl 40046207 0 returned -16 [ 276.860684] device nr0 entered promiscuous mode [ 276.868958] binder_alloc: 8361: binder_alloc_buf, no vma [ 276.887599] binder: 8361:8378 transaction failed 29189/-3, size 0-0 line 2970 [ 276.919204] binder: 8361:8423 got reply transaction with no transaction stack [ 276.948731] binder: 8361:8423 transaction failed 29201/-71, size 24-8 line 2762 [ 276.968876] binder: release 8361:8367 transaction 2 out, still active [ 276.982494] binder: undelivered TRANSACTION_COMPLETE [ 276.997583] binder: undelivered TRANSACTION_ERROR: 29201 [ 277.005841] binder: undelivered TRANSACTION_ERROR: 29201 [ 277.016601] binder: send failed reply for transaction 2, target dead 02:06:08 executing program 1: unshare(0x4000004) r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x1, 0x800) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)={0x9, 0x144, 0xeff, 0x8000000000000016, 0x0, r0}, 0x2c) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000080)={r1, 0xffffffffffffffff, 0x4}, 0x10) 02:06:08 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) sched_getaffinity(r2, 0x8, &(0x7f0000000100)) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x80801, 0x14) getdents(r3, &(0x7f0000000180)=""/243, 0xf3) bind$alg(r1, &(0x7f00000002c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-avx\x00'}, 0x74) r4 = accept$alg(r1, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x121882, 0x106) sendmmsg(r4, &(0x7f0000007f00)=[{{&(0x7f00000056c0)=@can, 0x10, &(0x7f00000000c0)}}, {{&(0x7f0000005900)=@pppoe={0x18, 0x0, {0x0, @link_local, 'syzkaller0\x00'}}, 0x80, &(0x7f0000007ac0), 0x1a9, &(0x7f0000007b00)}}], 0x3fffffffffffe0d, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0xffffffff}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000380)={r5, 0x3, 0x3bd3, 0x3, 0x2, 0x3ff}, &(0x7f00000003c0)=0x14) 02:06:08 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:08 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 277.046034] binder: undelivered TRANSACTION_ERROR: 29189 [ 277.118671] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:08 executing program 1: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) ioctl(r0, 0x81, &(0x7f00000000c0)="01000000000000001804000007ff01000000000000d849832f") lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'L-', 0xb8}, 0x28, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/sockcreate\x00', 0x2, 0x0) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x7, 0x8000) syz_open_dev$dspn(&(0x7f0000000180)='/dev/dsp#\x00', 0x5, 0x92000) [ 277.226144] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:08 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000100080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:08 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2, 0x20050, r0, 0x0) write$P9_RWALK(r0, &(0x7f0000000500)=ANY=[@ANYRESHEX], 0x12) write$P9_RGETATTR(r0, &(0x7f0000000200)={0xa0}, 0xa0) perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x4}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 02:06:08 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x141000, 0x0) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000080)={0x2, 0x18, 0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x4, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@loopback, @in=@remote}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x80}}, 0x0) 02:06:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:08 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 277.490751] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 277.561903] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:09 executing program 0: unshare(0x24020400) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$getflags(r0, 0x0) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000040)=0xde0, 0x4) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x280000, 0x0) ioctl$NBD_SET_BLKSIZE(r2, 0xab01, 0x3) 02:06:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:09 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) keyctl$link(0x8, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000400)=0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000480)='comm\x00') r3 = add_key$user(&(0x7f0000000380)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000440)="585ccbe4ed83b8361f000000000000002206297b6897b66147b3c7218a9169a85ea0bdc9e1587a050000000000f1ff42e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d25500200000035c99926022b8753a188748c569f435ffb74b50ec93c152f5e8e198a29e5a7d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40000e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539a1", 0xbd, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) r4 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r4, r3, r3}, &(0x7f0000000240)=""/240, 0xf0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x14}, 0x14}}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000440)=ANY=[], 0x0) mq_notify(r2, &(0x7f00000001c0)={0x0, 0x1e, 0x3, @tid=r1}) semget$private(0x0, 0x7, 0x20) 02:06:09 executing program 1: mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0xfffffffffffffffc, 0x8972, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="7800000255063bb6b194e5416693cb92c6e131bb754c2d65454dd14cdee620d5b3b292ff410d4948e1c48b4209e3ed50eed43eadeb37ea90bf45cdc311075e1f098197886f228f3e9a97ee1eadef5c5dbdf6386b0f4defec4c9632488e76dc7b9e12668645697d3655cc41e19dab522150982eba019c", @ANYRES16=r3, @ANYBLOB="00012dbd7000fcdbdf250e0000005c0001000800080009000000080005000200000014000300ff0100000000000000000000000000010800080006000000080005000400000014000300fe80000000000000000000000000000b080004004e20000008000b00736970000800050006000000"], 0x78}, 0x1, 0x0, 0x0, 0xc0d0}, 0x800) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) 02:06:09 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000980", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:09 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 278.043540] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 278.133997] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:09 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) keyctl$link(0x8, 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000400)=0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000480)='comm\x00') r3 = add_key$user(&(0x7f0000000380)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000440)="585ccbe4ed83b8361f000000000000002206297b6897b66147b3c7218a9169a85ea0bdc9e1587a050000000000f1ff42e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d25500200000035c99926022b8753a188748c569f435ffb74b50ec93c152f5e8e198a29e5a7d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40000e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f4772539a1", 0xbd, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) r4 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x9a, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r4, r3, r3}, &(0x7f0000000240)=""/240, 0xf0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x34000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0x14}, 0x14}}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000440)=ANY=[], 0x0) mq_notify(r2, &(0x7f00000001c0)={0x0, 0x1e, 0x3, @tid=r1}) semget$private(0x0, 0x7, 0x20) 02:06:09 executing program 1: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) prctl$setname(0xf, &(0x7f0000000180)="c58c70d9c789754ab89aed8baaf1c5021c2cc23fd6ad67e81b3ab332dfd2efc4e2492a742a4d4e8780cd39ef5b00689ee4dba610657a2785db794420ce11be4297629daa11e03b03e67ed05a6814482da8ae12bad027a51a04f213a2683da28c11e0b984a068b70fb11dfb6bb7b67f557d3ef28b43c0c8486dfd84c95e00252c5afdb6") creat(&(0x7f0000000040)='./bus\x00', 0x0) open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) 02:06:09 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="7a00000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:09 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x800000000000006) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x400000, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuset.effective_cpus\x00', 0x0, 0x0) r3 = dup3(r0, r0, 0x80000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000340)={r2, 0x10001, 0x5, r3}) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d760638") r4 = socket(0x9, 0x2, 0x0) r5 = getuid() getresuid(&(0x7f0000000140), &(0x7f00000001c0)=0x0, &(0x7f0000000200)=0x0) syz_mount_image$vfat(&(0x7f0000000680)='vfat\x00', &(0x7f00000006c0)='./file1\x00', 0x7b2, 0x3, &(0x7f00000018c0)=[{&(0x7f0000000700)="e7beb09ee94ba0fd19716ac6e1103b9ca07f83e71f8701e4a3d218d43092df2fb8cb5f126ed72b1e12d9a789faeecbeed948e6774882480711e9ba81d868d02a7386c8aff6e3c075fe799e80ea72fe20243f71c5bf9aa5f4fccb622148d553392e318f5a74c73b3a3dfe1241c1ccfe1e9d5aef548bc0e70dc6a59e63802d7bc474892d1fca1c16b4e428e25d4d23eb09f527a92d4878ff6e4bf2e3ee2af4c6811c00764be0103da237af932a94bee806fd18efd1c4b80dd7c549d27175f5dcfb2692d721853f71fd6dd586c2acf44d25fa15d43b4b6430c5bb12121613f7b012e9873296e292532c39b8a97fc936271e6a3518d7d03f2352af6b1c3b8474c9a4b9f08098adfdff7ae925d73a902ec993a35850a79eebc86a5a23107ae6f411733d22af56f955ee4d129220ccaa92a685c4806e1ee25a805c23ad33be29952e9d8d607680d9e6ca1fd7cce744f48d7cf2a347a19cb0a146af2b7e52f2036a5a4ddd1631a1e47d068dbbfb897f4799cc7eea59e291ac3513503383bea509194493ffa504c455ffec6ec97f7ac540054ea235dd17c88795288875364fc91963b7fc3e8d317202a7771dd7be8f1aa7708ee48fe713d7bae0a755d7c283e18937930fbdc1703affc59b7f3bc56a25d7b7b76d64c894bed71fc2767848d1fe544faa225ab5f2031920f7e108de72e7040524ec13b0040a7c7dc3cac8ed4eadfc20b0ef30f67d0514565ec41cf137241f9fefabe49151b164f773956843c5ea27ff40a3c2b67c8224b1ac3e402e7c5a5b1174ab1bb0bbdec1fa969a2f551b85a234fc89a2beb8ac1d61d4beb938131bb71be467d98958236d625ec3415884b2cd1bda63b154e68be8509e5f20964534033f07fbcd61fd5029e661aa5fd4d0ba1226c984494a6b5168d754252ada0db893d5081ddce51c4c479d07fe578300522d112fc229fd8d0eab470a260113b63a3b1783db3baf52f00da89c73e83ae0d8effbaabc161f42879ff51ae454ea0344ae87563169ad15fcfbe7d36125d929eb53527b2cf792e75edaedd4a69f5ba51f223f59a04903e23b7c198e42d4eccc9ddccb8641ec8afce51bb91ffa7a5b17e36be527ae071fc842bd222e230def62ac1afc9b163ebbb2d6f1d5f4e06bef0671de75253ab897f1c7e754766851534590520b235e334e469e711526cf53d8d4e5bcc95266bebb9588ec40b3832ad674989080bf9d585a2205216ddd47e9189314e096af7dbc02fb8576b0bbf88231102b2815b3441d7cb7f7a61733743c7fa07b4db8ab8d05b7684eabe93477d35d98364dc273957e5266f63211bcdeca3ec8f4e0aa03d309cb9a3eaff1f736a45406baa5966460f16d51376d1335576f72b92772bc799515f8b1efbcb2464d68128f0d5ef21b55d66d726bfce8559ce09f9e69f1a2f5b00a0e5a6ff4027649dcef24be82d93c982d7a76e5e2f33666006406730d6aaf1629ff61b6c5c20ff7bdfd3ca01afff5e46f785ac80858a26ae878143963d26900dfd2798af5b34c6d283dee5ac088977ff0ab9b0be7de367f46c33a4a9576f8360e3759c31b34e0eebda185d1066db8825d3cc0aadf4a04cf7561fa9338802ca42ea90c86fd9403458bae02bb142139723338841f3623effc27ff8c6b3c9dc0cef5d95b79f13db262ca580442af49414e4cbd6486af7fa8eeb0e7794f52312a4d1ed776d35991d5fe364ff0950fba0eb427ef56828e4e5118ccea8809f9ac9231c1efbd7b1dcfbd942b3f2dcc4e3b41c3df814a19c711d8702776ca23e26610f83af3bab90803e6ac20e1f2cc7a21641fae981c06b7ff29775c932a60d606b57847806b838d7e671fa0e13cf66fb727c6356c8600ace0a763e1c042ea2870305e92847456b0dcbac7441164688cdefe6092c7315477c959ebc8ce5d109a1a29e183d3e6172476210b6b126016151bb8e4c00a1d747d3b2f5a4ad485f1b72d1bc0a2267e7ecd0d6e12bfd70e158fd4966a60e180fd5cf2756e349120e130395bf20925006c74ad8b404f6d90de7760fbf31c3c77cc8f170c053b9f3ec10c01b0000ae24551c66203d2c4247f09d011cf82a841dc984136d8be16ca64d12cbf37cbb72374cd334a47d449dd15b11eadf1afad79e664925043fa14ccba7a84fac9467b48cff503fb89abcec0ac18e556fb8e4ba0eaedcbc5e1b1ebe8d5d2777ef56dea48d6ccf8ae36cecb624ecff63a67a7e599b7d897c2d6d6925a08afb2e94c3cbfe65b43b3f22e0f7671cea0dc44c507cc04f0713e05789b66e37b550a818f096fed362657ed1336daec8ddfead7b2565cf9b8c80b5bdd216f71866e81c431e1e422c1e2378d33ec5886759ff0ac118a39fdee87d76f78568ad41171e7f9d5763dda6b75b1a95f9eac22ece169c8b94c9da431e84bab2cd1038ab7255570970a2b76ff93017006caa7c070442ec5840e3dcb8c249ccb327834bfb8b889fcb6fe2cb4c8da2d447c636d198578f265316b033c43abf022466ed4d549524edf7be68808f3d7a145b30e53180e69c4c5481503e0ce7e75abea3992470ffe490fa31a65c274437ea0c31800dc7ee58d85331d5d41cb651a49c702b8546c477b886c2996a314d5a754570115c02656eaf3ac2cbe090022558b6356854095b107ed3d00fa87bdf87424b2997c58aff6776ea03da18bf3ee2580656fc9044d64e69f4ffad6c77d4547727b7d02ac68f526a88a674d6b236dc3dff015ad9a719e10210ba30fae539e639136bc68ee3c9d50e65a673d6e2ee33f0a94286d093387fb92a93c1f83bc555e6cb698e464a1cc410d54571448eb7dce31cb509e2cb2277149852734bc4959320adef15042d4478d206616e0acb224cca2b3b1f58efab6b24e583b9104a8b7587b6296dc64b4c1b34ad3982200d583efae4beead91da1b6b75c653f7493195e1787eae5e1250df1019924b5c425ab579575fdae264adaaa5c551ea40d10efeaf621e11e0ce058bf56c3819a27d07a725eb4f6bcdd03baa50b43927748dfe031ede36311632587a07037b88a0e47488be55d69d82512b27746cdb8b867858eb9c5b4f31d217d4449e4d4734938ea014081e490dd70b5c1adf72e5494ea9afd660f2ee67867c3b4ee2d629d7a7ff1f92a4dc2c9c9fe444461fe0efc955749585d153416f15fbe91d5eaee90636d74cc7b13b8e260a6ad2229173ef397ad62b220a021e23d614cca3d383d4bf25234320c8aa6169c562b4bc416296a4f04c2263ce2c415fd4e16f647e6b9af6dfc2ecf463854d6620938a09314a54fe0e2293d7f3f678f3af1dd508e0f083031e846ece6114f0b26e16cbdadcc617be00241d87f9f5baccf468dd9f10d6305526837dff20f6d1f2e72921546a7053c1229655a8ecd9faa384dc3aff7099c93d07420c74af0818c9792631a28aaa1de14b1527f328816ed6790037b9ada88938cc51dd7335635e07853f5f50cc0a76ddd7a8634869601f5fcdfd62460d8b9fa3534fcb0462c34874a71b2d423b20d7235f65f893b75675a9f54fdabbb4bf1d91554962ba0636c20a74625fcfbdada8c0ceb41d943a2cb991d37260f8cb1bda3da49e44ef01fb17ccbe48b2ddc5de27e36d79c2a6b2ff67c95801ff04a29bcad4131e2f626e6254ae6907686bf728a8b97a9c174b601a1d31cbc25fcb1786a26947f99f6208be461620614546526618b8bf67dda0d83f0541f5435d58fa43ddf86bb249e92aaca7b05bee1e90ee6912c259cf3bd57a838cad579bebd49e3d0975c2f81a455638c7a7345ef7a57436edc18739d8edec2db776dcc90642bc1cf67a24a5caa14a875c503b27abdc7efe92ca0ada508dd554753ed68aca54bd0524195bdf4f8934b9cced2f08a8b2fb47b313315253eae399f55fa700963445b7a87708d3eeb6e98df4f7fb21764f28904ba409ae35ff165567952249a6fd1c04e23b4e6ec826b2833a909c2f8c3f6bb06529e65375a4e1f0629d48f99695b4eeb6cee28c0b6782de9c06ae9c481fe492651f49a8a400b5afd269a95225c719e02edf91c763c987ee41279c9ee4f03e07bf1c3f731caa6427e21d2bec0518ca26253ddb0388a64b39a8cba3a9ff9eba90e7cd448d1517166b0c7b91ca539cfb885ff18445c39f5ac8eaac40e1a51d1ef33c189755cf0d3bcf2b77c40a66d896f83a0b45f5073901dde0258ca7a3e209d4dbf69e412dc497045450b918c7bbb3af53b94d88da7183a6475c68f7de34c510c747b0b0873c622e5c50ca6908184cc485bb563dc602f2fb626e86d9a320df6399f48d30c6163857646ef832db23f7b1c917f6e6216b63745decd58199730893e2bae3b2b63286d2e3078efe769acb0a53b878b257d7682a650ab9753bd1b58b111534db20c3bef88792558958fcdf0223ba68ab63aa3778ba47cb0822e374c1a0fc93ae5b9ef54080159afd97b00c194463ba84621ea57cf3a065decacaf7f10992b69eaa3aa6b20300cda3aea23a8465faec74f0847a6b1a7583fa354ac4a442d98e9c9024b978f9b66fa0acbda3c05d831237b8d7cc81e54bd80a50b93eaeb0fa732296e079071ed668eaff9e26e6cc46a9e72b58703eb5af3fd7a8b524c571ac88895d55f50f539ef754cb7d72ce85893fcaf5de742ad590afc20f7d4f39850df52f2bb330a9713f388c1b5f3cd5ddbd9957d1119e94a89f95a30f59218a7cd4f24673f7bfd8b333779fd656782dac3d99333cebeb53c0121036b172e27f1e850bcc9c3b705e8a0c0a4faa80885e031ae922910a50b2f083b3ccd8808d2aa72d689dab79009e0edc9072063fe756fdef6b5bd50e212fd11d45263d026072432bb72f28430f07193b99fb737eb8aec0ec1fc2052c1942b9b29d15c293359fa3aea29074a5344dd4c3c8a8c14e2af383d3a0f1651813faa095545490ebc463dd9df62ee11dfeaf9e1138de231bdf64ec8cfdfcc9e21a21d3c17f6889b92e0db311d4beff42c47dba477a9273a43e83b7f5f24b28b81ddfbc94809c71ea70aee71dde0ed730ada0a19a9a169aa6758944cb03fc682d9011cffee6dc6f243417cc7bffc71b6916f3e561b85d5fc2097443ca5cccb8f69d06341c2a55d49b663f745cee216f9e1948a38b7c184ffd36683a75c3d1ce8e36d3cc10e6ae6f89e32153904ab039c961b421e8b58eefd03256419d138a080fee5d8be35e29e50fd2ca10e0a2228e5be105375f1bbbc1080db42bbbdd0f07916e7411d3b1d4cc2909cac3f4c73f85c324a1d40e3bf612a195595a0c5a053bab1dee94a0ccea8b3610cbf01682fc8f5a5893103a93eb049d0409c79721594d8699f25004ef02a81a0ce8f7a22ba7366f941d22a1642e0ac33e9308a085c44379addef23d41afdc3849815d4592826fe23016962b342c5a15aacd32f95497e6a4b293eb7aa4ebcfd9542684b8ee9adce135afe737e8e57a950a005d75632b208ca8cba32438611383887b21cb53b921ad06f1a52c71f6d2466aecc8b426e4ffe4c9eed8524d8c959f37bc7530a4ee84ff38a812059d010dac5fc0dfece71bc1d85e0a54b78cc5e8115aae2b33e48781c8e7a290028234805d3d7f08aa14de0d79afa2174796cd2ea4882c393688794a77eff8811c235b5555880ce4ad175849d676152488da1476a0cb3c86c3aa057f3c4a2bca2512d329738d0dbb5b72570bb18a29b05561d0ee641047347ec7499c5d8eb32ee900638061c9ccd5166530d44fb24dd0c0b727c14063e142ab30f96977c682a2bae503fe072bcc55fe37f79a82ddd1acea7fc5181e79876a282835b4e55451a42358c706ae3d41b282", 0x1000, 0x200}, {&(0x7f0000001700)="719fa9a3be113234626de40962121db7ac0651073f7113177c723e8dc28525c9e2e043f4510aa7c2fe15ad856a887369e8320b297c87792c0d1c141007a6f8e10d2641c32b3cdfb40385d7cb436c0c14eb87f1859e7987009c7e1fce1cbfbb5857cfe79db2dcf6cb847d26c1522d9460e6cb650cc3a2fc085608804bbc0968ca92e53976db9d2e5d5022ab8a97fdda16cae4a9f70dda9a4db3156d99d60f28", 0x9f, 0x4}, {&(0x7f00000017c0)="5d7d00b3ecb6c289cc1123d9fc193b03128dceda0bd29f87dfbecc8c8a2b8dc19c56eaf4f9f1865c0bb6c9c85699bdee9cb16ca587655b236ea4713a0fd21be2d7fac752f316ed0b3fd683631c28401f8b8175bc4ed7a455942601e2139735e3dd2aeb27111426aad595aa35dd3dab5e96f677dc1bc2fc9f54cd94e54fd365850396875fa35523edba5223f88b10274a5e3fa9a3c74170e42c5f38c18731ad34751309ef52c4f73f8fde5ca3304221a09f0ad4902da26e68a56e276f0f6da769cc4121498510734830b12b9d3ad3666602dbcb6846149aa57a21f685022182f347eb8c5541295dc1a769d83f44fa", 0xee, 0x1}], 0x200000, &(0x7f0000001940)={[{@rodir='rodir'}], [{@hash='hash'}]}) pipe2$9p(&(0x7f0000000240), 0x80800) getsockname$netlink(r0, &(0x7f0000000400), &(0x7f0000000440)=0xc) mount$9p_tcp(&(0x7f0000000080)='127.0.0.1\x00', &(0x7f00000000c0)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x838050, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e23,mmap,loose,access=', @ANYRESDEC=r5, @ANYBLOB=',access=user,permit_directio,uid=', @ANYRESDEC=r7, @ANYBLOB="2c736d61636b66737472616e736d7574653d62646576706f7369785f61636c5f6163636573736c6f707070302c646f6e745f684673682c0063efb67fd954837fe84fbcf1f1301fbe6ce7c6febe1d2551f72ab12bb00151c14b15f846bf93c7587795e008aad400742c86bbb8d427dc85212771698e9a68cb0b71c05227e6bb159310349709c9d55efe1e68739d37b946991e0eca12606eff9618358ad44d5ea3d526b7c3574b2e01e271630021536542c19068a201e6b59a82057bdafc7891a3b6d434bbdc2fded492b0432260d4edf12c3b01c77dd8e69a30779bb495037d5679c7118b48ec3c"]) r8 = creat(&(0x7f0000000180)='./file0\x00', 0x28) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) setresuid(r7, r6, r7) ioctl$TCSBRKP(r8, 0x5425, 0x279) ioctl$PIO_UNIMAP(r8, 0x4b67, &(0x7f00000003c0)={0x3, &(0x7f0000000380)=[{0x4, 0x5}, {0x10000, 0x8}, {0x401, 0xedf2}]}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) setsockopt$packet_int(r4, 0x107, 0x16, &(0x7f0000000040)=0x3, 0xffffffffffffffdf) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 02:06:09 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 278.348856] kauditd_printk_skb: 1 callbacks suppressed [ 278.348871] audit: type=1804 audit(1540001169.481:46): pid=8510 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm=C58C70D9C789754AB89AED8BAAF1C5 name="/root/syzkaller-testdir466789793/syzkaller.FgTlB4/53/bus" dev="sda1" ino=16702 res=1 02:06:09 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x3, 0x402) write$binfmt_elf32(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="7f454c46000000000000000000000000020000000011000000000000380000000000000000000000000020000000008b25000000000000000000eeff00000000000000000000000030adadeb96936d6a45d6044ed2692ad83d140ba1d1b32d53aad9444120f28ddf66589cb328bb97fbef6e0f633a528d89785632a59e4b590c4797f7290aaf9289ffd5c3efc695eb8896307b51bef3aa72421fa0bb106de01afc5f4b4f71436791bbb9e3cf80e883b4448f6fcc12a5a42f25048714c85c8dd64d619c36039bfcf0099648fd3dde0120a264d0094c3545f916a6d4549cabf9ea499778694ba9fd605876b9e3594ea295585866558d7734152b2bf26baf564b4f6e1e935e1c2e4f9a7064a4db44e1ea8e7c9cdf3032364f"], 0x48) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000280)=""/117, 0x75}], 0x1) [ 278.412071] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 278.429566] FAT-fs (loop0): Unrecognized mount option "hash" or missing value 02:06:09 executing program 1: getpgid(0x0) ptrace$peek(0xffffffffffffffff, 0x0, &(0x7f0000000140)) r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x1, 0x22080) r1 = memfd_create(&(0x7f0000000200)="6d657c6f7279a3850f8000", 0x7) renameat(r0, &(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000240)='./file0\x00') ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket(0x10, 0x20000000000003, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0}) recvmmsg(r2, &(0x7f0000001cc0), 0x4000000000002c0, 0x10102, &(0x7f0000001540)={r3}) sendmsg$nl_generic(r2, &(0x7f00000000c0)={&(0x7f0000000180), 0xc, &(0x7f0000000080)={&(0x7f0000003080)={0x14, 0x1a, 0x201}, 0x14}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)="6d657c6f7279a3850f8000000000", 0x26e1, 0x0) 02:06:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:09 executing program 2: setrlimit(0x8, &(0x7f00000a3ff0)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000300)={'bcsh0\x00', &(0x7f0000000240)=@ethtool_rx_ntuple={0x35, {0x7, @usr_ip4_spec={@multicast1, @remote, 0x401, 0x0, 0x1, 0xfff}, @ah_ip4_spec={@broadcast, @remote, 0x3, 0x7ff}, 0x6, 0x7, 0x2, 0x40, 0xfffffffffffffffe}}}) setreuid(0x0, r0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x8, 0x0) ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f0000000040)={0x5, 0x9}) r2 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffd000/0x1000)=nil) r3 = pkey_alloc(0x0, 0x1) pkey_free(r3) ioctl$KVM_TPR_ACCESS_REPORTING(r1, 0xc028ae92, &(0x7f0000000340)={0x7, 0x2}) shmctl$SHM_LOCK(r2, 0xb) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000080)=0x7fffffff, 0x4) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, &(0x7f00000000c0)) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000003c0)={0x0, 0x6b, 0x2, [0x3, 0x4]}, &(0x7f0000000400)=0xc) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000440)={r4, 0x6, 0x58, "5875bf65b0432f4269b1f8d35f8927619e4fd1a6b3aac77a9293a5a2cbe9739caaf0bb9a2ba64da09f070f4bcc04f43a7b543339c629b1f9d8c4f2e320e2938fc91763989aa5e9f3dd06378f5d9f651bc6c678f7afabaaeb"}, 0x60) [ 278.594993] audit: type=1804 audit(1540001169.491:47): pid=8516 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor1" name="/root/syzkaller-testdir466789793/syzkaller.FgTlB4/53/bus" dev="sda1" ino=16702 res=1 02:06:09 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000001080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:09 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) clock_getres(0x0, &(0x7f0000000040)) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000008000)={0x4, {{0x2, 0x0, @multicast2}}}, 0x88) r1 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0xfad4, 0x20000) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r1, 0x111, 0x2, 0x0, 0x4) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000008000), &(0x7f0000000000)=0x369) [ 278.672406] audit: type=1804 audit(1540001169.491:48): pid=8510 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm=C58C70D9C789754AB89AED8BAAF1C5 name="/root/syzkaller-testdir466789793/syzkaller.FgTlB4/53/bus" dev="sda1" ino=16702 res=1 02:06:09 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:09 executing program 2: r0 = socket$inet6(0xa, 0x80003, 0x1f) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") fremovexattr(0xffffffffffffffff, &(0x7f0000000000)=@known='trusted.overlay.metacopy\x00') bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000440)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000100)=""/25}, 0x18) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000180)}, 0x20) 02:06:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 278.857652] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 278.904554] audit: type=1804 audit(1540001169.621:49): pid=8512 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor0" name="/root/syzkaller-testdir552283608/syzkaller.KcLKQK/59/file0" dev="sda1" ino=16713 res=1 02:06:10 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r0 = perf_event_open$cgroup(&(0x7f0000000040)={0x5, 0x70, 0x722ae329, 0x5e, 0x5, 0x0, 0x0, 0xdea0, 0x9b75798f66ec30f5, 0xa, 0x5, 0x100000000, 0x9, 0x1, 0x2, 0x80000000, 0xffffffff80000000, 0x81, 0x711, 0x800, 0x1f, 0x0, 0x5, 0x0, 0x7, 0xcebe, 0x950, 0x2, 0x66f, 0x1f, 0x100000001, 0x0, 0xffffffffa0c3f5e2, 0x4, 0x5, 0xfff, 0x40, 0x7f, 0x0, 0x8, 0x0, @perf_config_ext={0x7f, 0x100000001}, 0x100d, 0x5, 0xfffffffffffffbff, 0x5, 0x3, 0x1, 0x9}, 0xffffffffffffff9c, 0x2, 0xffffffffffffff9c, 0x3) socketpair(0x13, 0x3, 0x6, &(0x7f0000000100)={0xffffffffffffffff}) r2 = gettid() ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000140)=r2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7) r3 = openat$random(0xffffffffffffff9c, &(0x7f0000000300)='/dev/urandom\x00', 0x0, 0x0) ioctl$RNDADDTOENTCNT(r3, 0x5207, &(0x7f0000000000)) 02:06:10 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x80010, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x400000000001, 0x229, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x70e000) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000080)) [ 279.012340] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 279.029210] audit: type=1804 audit(1540001169.691:50): pid=8528 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor0" name="/root/syzkaller-testdir552283608/syzkaller.KcLKQK/59/file0" dev="sda1" ino=16713 res=1 02:06:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 279.070236] audit: type=1804 audit(1540001169.691:51): pid=8540 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor0" name="/root/syzkaller-testdir552283608/syzkaller.KcLKQK/59/file0" dev="sda1" ino=16713 res=1 02:06:10 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="003ff7f880", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:10 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='map_files\x00') fchdir(0xffffffffffffffff) r1 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) clone(0x20102100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000280)=""/4096) execveat(r1, &(0x7f00000001c0)='\x00', &(0x7f0000000240)=[&(0x7f0000000200)='H'], &(0x7f0000000400), 0x1000) ioperm(0x1, 0x0, 0x7) write$9p(r0, &(0x7f0000000000)="c370ef0451b8291f05f70e8ea74503b5d7d6e1a6e450e9e0b46111d742bd2e52f257e142436ef717981d9e072ad94501ddd84194e51866c91a16e0afce4460e7bbe32af9ecac3fc6e8c1a4ec734d56af465f47365ec54d6e1360f9956462934fa0582fda8984936b8ffe03cdf48b729a1e99fd4a9f57d9736d09873dcc2024a22165b814cc1dc5a15b4c5d3ec030b1ec1a98317966b5ef156291", 0x9a) 02:06:10 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(0xffffffffffffffff, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:10 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r0 = perf_event_open$cgroup(&(0x7f0000000040)={0x5, 0x70, 0x722ae329, 0x5e, 0x5, 0x0, 0x0, 0xdea0, 0x9b75798f66ec30f5, 0xa, 0x5, 0x100000000, 0x9, 0x1, 0x2, 0x80000000, 0xffffffff80000000, 0x81, 0x711, 0x800, 0x1f, 0x0, 0x5, 0x0, 0x7, 0xcebe, 0x950, 0x2, 0x66f, 0x1f, 0x100000001, 0x0, 0xffffffffa0c3f5e2, 0x4, 0x5, 0xfff, 0x40, 0x7f, 0x0, 0x8, 0x0, @perf_config_ext={0x7f, 0x100000001}, 0x100d, 0x5, 0xfffffffffffffbff, 0x5, 0x3, 0x1, 0x9}, 0xffffffffffffff9c, 0x2, 0xffffffffffffff9c, 0x3) socketpair(0x13, 0x3, 0x6, &(0x7f0000000100)={0xffffffffffffffff}) r2 = gettid() ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000140)=r2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x7) r3 = openat$random(0xffffffffffffff9c, &(0x7f0000000300)='/dev/urandom\x00', 0x0, 0x0) ioctl$RNDADDTOENTCNT(r3, 0x5207, &(0x7f0000000000)) 02:06:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:10 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x0) unshare(0x2000400) r3 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x80000000, 0x801) getsockopt$inet_mreqn(r3, 0x0, 0x20, &(0x7f0000000100)={@broadcast, @broadcast}, &(0x7f0000000140)=0xc) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x0, &(0x7f0000000000), 0x0, r2, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}) 02:06:10 executing program 2: ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000100)={{0x2, 0x4e22, @multicast1}, {0x6}, 0x2, {0x2, 0x4e22, @local}, 'veth0_to_bond\x00'}) ioctl$TCSETA(0xffffffffffffffff, 0x5406, &(0x7f0000000080)={0x3, 0x9, 0x7, 0x10000, 0x6, 0x2, 0x9, 0x1000000000, 0xfffffffffffff036, 0x100}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x224000, 0x0) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x0, 0x4) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f00000004c0)=ANY=[], 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x1}, 0x1c) r3 = socket$l2tp(0x18, 0x1, 0x1) ioctl$BLKRRPART(r2, 0x125f, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x1}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000280)={r4, 0x200}, &(0x7f00000003c0)=0x8) connect$l2tp(r3, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000400)={0x10001, 0x7, 0x5, 0xe7, 0x8000, 0x4}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@rand_addr, 0x4d4, 0x2b}, 0x0, @in6=@mcast2}}, 0xe8) sendmmsg(r3, &(0x7f0000005fc0), 0x800000000000059, 0x1100) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001e80)={&(0x7f00000001c0)=@ipx={0x4, 0x2, 0x9, "c220a378143c", 0x4}, 0x80, &(0x7f00000019c0), 0x0, &(0x7f0000001a80), 0x0, 0x20000000}, 0x805) [ 279.338790] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:10 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = memfd_create(&(0x7f0000000000)='/dev/kvm\x00', 0x4) setsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000080)=@int=0x7fff, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4008ae89, &(0x7f0000000280)={0x77, 0x0, [0x4b564d03, 0x1, 0x400000b1, 0x491]}) [ 279.438137] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:10 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000680", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:10 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(0xffffffffffffffff, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:10 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) sendmsg$key(r0, &(0x7f00000001c0)={0x20480, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0x2, 0x2c}, 0x3a8}}, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0xc4, 0x80080) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x117, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000140)={0x7, 0x8, 0xfa00, {r2, 0x100000001}}, 0x10) [ 279.896570] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:11 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth1_to_bond\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000001c0001040000000000000000020000003ed6797d34acc15ad455a1151a0509f38a365c43f24dea494cde947b962e0859b436c34cdbd5e15009a857b6f93551eb350b1e7fb9d63d4dd1a5b7ba5f95ca6d4724db335cb31f0f29445a655d885f35ff58c05c2410d6405218fc98632dc75a8be4365e08479eea63a425febe62ff965c87668a5a385a17dfefffc6d608000000", @ANYRES32=r1, @ANYBLOB="0083e32cdb9dc7b4ae6c9f54b69e83444569ad0c267fd04581fea9c72c92574aea5421f3fb24fc7a2ef9a63320614499c89d727aff43f36d07416ff310ca955941a3d746be37a5279a857ef6152adb59f7fca3532f64fc2941e76ced51a9d956ebc7711adcf0bc9c446b29c47162a08159ea81f5d0580f2f00fa016606a93c8131"], 0x28}}, 0x0) [ 279.957799] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 280.129366] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. 02:06:11 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/uinput\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$uinput_user_dev(r0, &(0x7f00000000c0)={'syz0\x00'}, 0x45c) mincore(&(0x7f0000ffd000/0x3000)=nil, 0x3000, &(0x7f00000009c0)=""/55) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000780)={{{@in=@broadcast, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@local}}, &(0x7f0000000880)=0xe8) getgid() syz_mount_image$reiserfs(&(0x7f0000000580)='reiserfs\x00', &(0x7f0000000600)='./file0\x00', 0x4, 0x2, &(0x7f0000000740)=[{&(0x7f0000000640)="225fcf976b57ca85ec6998bc2c2a417daee4407bffaee8b12161b3363e92a112996003f3d7e4e651380d1b08d47736418dc4d28bc278ce4c53a6c5941a346334dd6c1dcf2a64c1266295b19e44d1a4cb5b3ae6446cf28d", 0x57, 0x4}, {&(0x7f00000006c0)="96f05c7a6831f03f8c8dbe92171dd9d0a27ddc5319a776da6fe11df16cc8de0bc7179be0043ab34f02f77d65b9e3ce5e74d1e40ef3d5f7765afe88d2fff7ef5c5949199f47caf3175c1b3861985b5d79df876d89e78d3cf2afec60ce0dc49953c5", 0x61, 0x8}], 0x3, &(0x7f00000008c0)=ANY=[@ANYBLOB="626c6f636b2d616c6c6f6361746f723d6e6f626f726465722c6e6f71756f74612c6572726f72733d726f2d72656d6f756e742c626172726965723d666c7573682c626c6f636b2d616c6c6f6361746f723d6e6f626f726465722c6e6f61636c2c67727071756f74612c6673757569643d74653634383765732d737b77002d7634777f2d7f00667b2d63657566773839772c646f6e745f6d6561737572652c7375626a5f726f6c653d776c616e3029252e2c657569643c", @ANYRESDEC=r2, @ANYBLOB="2c7063723d3030303030303030303030303030c4d2cea234322c686173682c00"]) r3 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x1000, 0x14200) setsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, &(0x7f0000000540)=0x2ec0000000000000, 0x4) ioctl$DRM_IOCTL_GEM_OPEN(r3, 0xc010640b, &(0x7f0000000a00)={0x0, 0x0, 0x93}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000a40)={r4, 0x80000, r0}) ioctl$UI_SET_PHYS(r0, 0x4008556c, &(0x7f0000000040)='syz1\x00') 02:06:11 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0003000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:11 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(0xffffffffffffffff, 0x3) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:11 executing program 2: ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000100)={{0x2, 0x4e22, @multicast1}, {0x6}, 0x2, {0x2, 0x4e22, @local}, 'veth0_to_bond\x00'}) ioctl$TCSETA(0xffffffffffffffff, 0x5406, &(0x7f0000000080)={0x3, 0x9, 0x7, 0x10000, 0x6, 0x2, 0x9, 0x1000000000, 0xfffffffffffff036, 0x100}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x224000, 0x0) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x0, 0x4) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f00000004c0)=ANY=[], 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x1}, 0x1c) r3 = socket$l2tp(0x18, 0x1, 0x1) ioctl$BLKRRPART(r2, 0x125f, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x1}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000280)={r4, 0x200}, &(0x7f00000003c0)=0x8) connect$l2tp(r3, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000400)={0x10001, 0x7, 0x5, 0xe7, 0x8000, 0x4}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@rand_addr, 0x4d4, 0x2b}, 0x0, @in6=@mcast2}}, 0xe8) sendmmsg(r3, &(0x7f0000005fc0), 0x800000000000059, 0x1100) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001e80)={&(0x7f00000001c0)=@ipx={0x4, 0x2, 0x9, "c220a378143c", 0x4}, 0x80, &(0x7f00000019c0), 0x0, &(0x7f0000001a80), 0x0, 0x20000000}, 0x805) 02:06:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 280.300511] netlink: 12 bytes leftover after parsing attributes in process `syz-executor0'. [ 280.361152] REISERFS warning (device loop1): super-6502 reiserfs_getopt: unknown mount option "fsuuid=te6487es-s{w" [ 280.405217] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:11 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) write$P9_RSTAT(r1, &(0x7f0000000080)={0x46, 0x7d, 0x2, {0x0, 0x3f, 0xfffffffffffffff7, 0x4, {0x1, 0x1, 0x5}, 0x4000000, 0x7f83, 0x7f, 0x800, 0xa, 'eth0system', 0x2, './'}}, 0x46) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$int_out(r0, 0x5460, &(0x7f0000000000)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000280), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=@getrule={0x14, 0x22, 0x401}, 0x14}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={&(0x7f0000000240), 0xc, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="50000000140031020000000000000000000000000000000000000000000000017f00000100000000000000000000000000000000000000000000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRESHEX=r2], 0x4}, 0x8}, 0x40000) 02:06:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:11 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl(r0, 0xc2604111, &(0x7f0000000080)) [ 280.511795] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:11 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0040000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:11 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:11 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000004c0), 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp6\x00') r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) socket$inet6(0xa, 0x804, 0x80000000000b) syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x1f, 0x4001f9) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000740), &(0x7f0000000780)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x10, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x20003, &(0x7f0000000b00), 0x13b, 0x5}}, 0x20) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0xfffffffffffffeaf, 0xfa00, {0xfffffffffffffffe, &(0x7f0000000240)={0xffffffffffffffff}, 0x13f}}, 0xfffffe78) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f00000001c0)={0x3, 0x1d, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @dev}, r4}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000180)={0x1, 0x10, 0xfa00, {&(0x7f0000000040), r4}}, 0x18) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0x37d) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000280)={0x0, 0x1, "a3"}, &(0x7f0000000200)=0x9) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000380)={0x0, 0x6, 0x30}, 0xc) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, r5}, 0xc) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(0xffffffffffffffff, 0x28, 0x1, &(0x7f00000003c0)=0x5, 0x8) listen(r2, 0x4) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r6, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) write$binfmt_misc(r6, &(0x7f00000012c0)=ANY=[], 0x0) r7 = accept4(r2, 0x0, &(0x7f0000000040), 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB], 0x1}}, 0x80) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000240)) dup3(r0, r7, 0x80000) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r7, 0x84, 0x7, &(0x7f00000004c0), &(0x7f0000000500)=0x4) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000400), &(0x7f0000000440)=0x14) 02:06:11 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:12 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:12 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="4c00000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:12 executing program 2: ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, &(0x7f0000000300)) r0 = inotify_init1(0x0) ioctl$SG_SET_DEBUG(0xffffffffffffffff, 0x227e, &(0x7f00000002c0)=0x1) ioctl$int_in(r0, 0x5452, &(0x7f000001a000)=0x81) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r1, 0x40106410, &(0x7f0000000000)={0x1000, &(0x7f0000000580)="8597cced629b416ad7f3720b9baf2a1c6d8e21c83529fdfb323e0013df06e6c51d12fcf7eb577d6960631069cbeea39e6b05f5dac2526f800013c5c61917d2e5a10d7baf97ea061046231a5f563581fc0ebaf8f00ac2d4195b91c0a381cbc77cd8cb01083abd369c2e16c1db41d46c248336fee78f60368a1348438b1845bba853339b0f1f141fbb27e81181b752bb810e6dcc9069285d615b481b7d87a5d22f7e38fde65890bc47fdf47fcc7e663ae4b7b89e04172586950a3fd4cd1e20810fa882875bb0700184fa3fa24b21561bf2d8c5a8a2266100700412de53ed4b76a3e9ba451b2edb4026f65f31be6c7436d3f87899c23715c8d074eab3e7f3df22eb4da232179c399a89123ebe8e9d512b35b0996a75fc2082558c08239e155f1633098fb729af945e1e05f9eaad541452d55bdbcd6423d12470fdcab5a16f3104e109ac17bf12d1218a02596b3b857fc71515e3772ca76a4a8f37a8c16a31fce82cc4884d8c95ad8ebd8cf83cb05f1bf66ec9796b091886893a906992160e7b9b95d57d0ec2da7281191da3125aefb0df61914710a146af71bf2142aed7faae02662bf9385cb7433e62374871af743921537747c8632f19968d5397fad30c6cc9f6859b47d226de755c24c075f47a293dee0de07959174d9e379b404faf1c90d44653a07edd1cf19144ab6487121e0917d4af524c7b747e4f1fa4fbaccefc20c14cd7b20b9d38b81da6b32ae3926a87100e20ab2fbf7c436af9ca3bdc2e129bcc7c7fdd436e9a5d9c5c13207c746bda34ea1c11af407ce664d70b2066398abb4e27d9b9f514a19d198e9a95cf03237f2d621db2cc2ba9ec44c1aed1e709aa5b8b4dade2d1dac7e9d52283aab35d1a5b1955bae55182b593a9c0fc8d0b1bb646e11380c670566095efea9ea0d35e04b219069bcb58d11549f3822de3692c72c296816e0cf7a88c4dbfb8e23ca2050d7bab102124ea431e8c5c99f3f7ecf37a3bb5fa1f7850032065b6c5a415723ca878904c2d8383d7325d6888a5684b8d3a36d29122a8f0986d3709c61facc10602d712e2b42031e8057952ec8dc6e20eb8f039950cad39a40c30c54c1323c82b353705780476b623c3be4d28e688f802b3eb97b990a807df307dc864386d87fd842d8da54228806ad09acda06ef1746abfe27e1ea4622cdd1bbc0c5a373ddfd2aec18e46a0727c2d2a6a6d8e794e7cc3e2456a7b054fc96965437556ff6d5f845bd5903ce61858cdfa493e612ba748c9bd308f23e5720e001614b2aeb9e63a6030091b3def4e2a93288406edb45342428f099423b2b38a6aa237d3f5db981eeeab3ad7ac64e6389f12d7dcf660a3a6d301f6a870996eb180f1ad4ae9912fa84b0f71aa7f738a816889aaa0462f362b81b7430e66ca3c455d4ab477862bb8c23b3e199763d9334a3748dff62b08cd84bcb5043e3edced7ce92b43dc8a35ff765647d944b1dcd51068bea2bd18e30ef6d497fe2d8a144c48dd01381b72e95b7d722cf0d9a49a09011e2dceb463a5871ca48e5974e045c1059c5b62df7905f5039273d6b72e71f0dea15b6bdbb056e40bdbf36f0d66f9ab10b4e6481121b85de0e64af3538a27340f46adcf3d4092dc9b7120285210192a87f22a97a55182a71bb4a4f11aac3495b28be77becbecf1f20c51b7e31f5f6e562cc314113a082845665c1bd6bb1d57fdf3456e7f882c6c3a2c84a3787858e35c00088e7fa60a01301c02f1a4c6255ebf166139a6d46769d4b5f91f1852a46e3e1e2fd78943ee702943033d149a932220d5ba73d36a46994e435fdd49a0670d0dbd7840797d867aad3913761155f62c6319a7588dccf8222f3f092fdd464292cd831ce7468612e564a9f4c284b5b0d98247b3b6ac0c0da35e8b7a8ff82fb4d8aa26e563794d310668e1e7ba13b280076a90a15ae4e6d3fe804bb83ac6cc3dbaa95ead120b7efd31e0f4112f9e812ddafced4723471f7aab05f94d2e2ace3332e143fc3753476ad1ad9209fadcd94389a95578df8381442f612da97220fbf0f6172cd48f3d623fbaef2ce86aac5d16872128d379fd08ceefe4739ab2c3870009ee94478cb3df8f02648fe9edb736e9de603ba4ac7492507e9ddbef1bf3d32d464ec077bc648272db0fd7b69ad2e7478717709670365499129452439c7f4fc5dbc8cb0927b33123d87838f6fd581ffeca970edaf61fef77c0e7ed487dfd1aece13462248bf716eff2b6d02623d7d47eeab9461db6eba989859d701e25b8f159753f66e2fb2f1ec789d7026d140625b2f97c2ea4d4c629da194234323badf17167c5fd54ef138846cb53f4c95c85d4899eb12538d8f399bfecaf2a7404083fc5f258dd00c8ea65a5227238c85ac8747ed344d420e78d8d9fdcabe6879148e13563e36f0b96d723d0a468985b14e5080b0ed02ce3924a42c070789e63e9311bf7d7927f9d548c088e9cfe5922cffb760a50fe49614b50cd0d48b986826f1eb8d9824d92e51f018cbcd229e81b00b6b72c786efd382678418474e7519fa9ba32559db3ea84b7aa4e7cde88f07e1a579c97c3cf1e3978afdfad6df50cec7f65a0f35acaaf8d5a9c19f0b7dcfaeefd4422799c07a5abcb506e70b4a8afff3e767c42bd08e92d970ada29b2d890ad22b05c138a5ae9dac65565a815dd26efb6c46d32c0a6f46f2e424ca4874255aa5381a41de4717d55e2ac1baa65fa6d24a692c8775711ce0c8f6f067f148693fd08b9b919583a0c83bcd4f818f3bdfcc8b07a8d4d18fa3a379a34ce9408be83a09b43d8f8aff484c9e08dab1260e020c321d122c2a45d7d3eff013784a17489cdf26a6ee6e4c4d992d47406b394963b874d9e3ea8eba4fa80b482bb9eaaeac3816f48624272d7b67278a045bc2e0fd35a4c0cb7ad33a5437c6598a80c63a1dfbc4c06c0b976b6975471b0693e614223a331a167a68658069aed583ee201eddefa93a64f7f63967f4c01ecfc889e83cc06d2d06178b86c7f52005dd349809c6f4ad225be035a3d9f5953fb93fcbe051c3d2c728627dc5554018df7893e205ed41447c6b337c9cf71ea7f0dca1d8c749ad3a76e7e85524696094cf99c1e51462080fc7b11b330ad2f84f838e89c1c84a4b9b5fa133e48bf2d07a2cb9c71f0062b00cee63d76c937af0efdc40ee7d63cf0cf4e9cc530cead5973ed78c4767655b98d59066ab173d996562288c12423dbf88dc63230514fc1d5928d3a193925cd6e864fb20d01fdbfd5d21e4222983a917254ca507dc625d1e35d499c70fa24b65ae83f5417b67d5088e5b6b85928750215b8fd67fea84be653fbe08a3f063cca64e39ea7abc8a4dfb941fbaa5577ab88704e094c7fd1ccf68b9e5d9ea9deb276aecccd99fcd9e7b594a5ca51d25820e22c08f5047b4bc744b246f3a2686275ae733694c91a49e6fa8edcb16d94e7333d3b4389e8ca1df2695ccc7688fe81ea87538817d9e81a8d07f26169bb7a40c701456f0778cddebc19cac68fc2529b64ad31d77a020dad893289e36d0873a25f16e5d1c53c18fe1dbda6cd514a68863a3be74440e2baa9a24bf33c1009233a60e37a5020118db1c341e615b53907d5aac7d8f1478f4b889b4c45827775530ce712962f00ccff25fc27f76006dcd63b56ce320da893491dcaba9bd3daf4bed1da55898cc95216bc03fa9f77e6fe3d0a9cfec008235c4ee36d2589286fe73dd39c7841b281cd40876d9f607dd4b74900526f09ef867b8ee2b98368f43ea34ac7de95d0eac97537207f2b21fa3e725e35fa00ae781fc5cdf2025ea923f76cd0d9b49951b4d7fc6fa091ed956c24e04fa6d50237cee9d9683db471b55eb973118d05b69e3658894290770c5a02bf3cf50add364c2784b57c280c4b732eb213bf00a080ea5e4a0029e9f2dd4417eae636a3f1233b3da88873e2cd9f9815cb1b57f4fac51f9eb2cf680cf048454035ac178480916466db31d4be6ee2c6de5e9dc5145a4f818eeb6acd9437b853e84e03e74313022365053e43c86dab26e53415b4bc68478d70aa6dc417bb142e894caf6b253793d2d28324038a95aa50c200b82250e6858c964a63bd8ea532b80662792063a0fafe91648ecf3e4733617ec0074f8391c4c3d4300431b4c49cd0b290bf9d7f7e298e003ed13bb4810800e8b2979ad3380fc9abd00e6e19e8564a89be36630da4198ce05c73b504705b3f81168a67eb3f4550311b59ab3524300002ed5341d403b4735bc055532a560bb22454818515ed093f413c0001436cbe9266c12a8634bf23b77f17544a00d471aa05758fdd69e13c66c51672a6664c1a5c1eaec99d427c5e5d27689ad9f504e2a9aefbbffcee85c5f07bdfa90080d839b956a0a13939c19c16fb80e90846d6c1abb0f0c1b64669f8e3e8912e3c51760468883f9c9bfee85f9bde5355177653be504e826fe9dc08b1f3f2f400e5d6dc7bb0060b088dcd18bf86d42585ec58dafac53f7bb5860786371a0f6e63b4cb663ea3784ba632a641d3d26c678921fc7f6060bba74f9177c507b64762459d4fbf207ff7e6efa237c20817ed082ef1db3f717eba70ec09ff75f5dc0ebdad0b22a3d0d914386f8aca5a4934e6bcaa4c54b89d343ea6381b1069d49f3cd0f785d2558805f096b2c78f269b714f16f9f213a205e289d391f43ace00d88f7b86f4ebfe69eddef5c526a27c18fb509e8ea05ae7f1791581b056a3091a84b5b0ab3b51016ee568ebe0bada14d1ed75215bc10cdc4b586b6a6fb1d9baabea610bbad30b241ad996973765b76995269c710500f9e11e2a33a3979196b3f7ee4eadcb5207ce98fe85faa9e46a6d7d28cf34c8cf54c9935a1ea3d02ce81c9a4e623ee32a24012ed3034363089919a99c2f4da22c12668d23e78e0052aaeddf447cda3b90dd109de9bd6b0274c90b97ea397b65d022ea0ff280a0093088cd5e9e5240b5ad971df787e123914fbafa7487309d8ceb4266154f991b87e32c9f1e1d74eaee5f00e1894fc4fe33a79949e7e4ce1e0cbc06ea6660b88831860f9ee037515d8503ea69fc9f90c036afa8544ae13503308b75473dfb04595da055f7dc4a06aa39c3d48ae8045668c3845a577c66450b13c5815cb38349ea6106a7d35423198532af2dcb6eb21985f094610d622b01c555cba77cce204f1664a146e3d05a4d1f177b5d144d3cc8fd40ea1df5112f46e977c066fa6847ea35e7887a305de908683559a78e72fa0abfdd09ee743395cf5b4729f0e5bcefd3d4f9b962920d823d5d79f3a226df1563842a0f3afa79bd97c1f1b1f49b60ec6c1d44ee8d7aff9ade4a614cacaeaa15fd893dd659384422b3e83d0e8881d326f396a9a8c5e20473e5a442484181198d9b3f5e2e34f0617a74fe0ceace615244f7148fab7c90f03f4713ab5c7b375a6e57983a795807a6cd3f704f50335be8a7108cda36159e2059aee20e532f4610423363d4180a9f2cb2f6a0f69e7c71bf26aa8e83e3fe3ef6b9474c80f62b0962b42a0cb1f02d3354a33a1387464133bdf885bb8a2b5261d5e19688ca31ca116aad16044d172d5fef20e8dbcf62535e8d52ce8953e3e32879c6dff214d8c1c5efc123daf0b1ad5c1dd31a54294225e2d6de646a61b6b49a6e94918a2e424e1bbf43770b4ab112f7c8aa03325e73e4c05102b8fb15c0b322d8c85b6323f9708d89f6d71601af4bfa93cecf9719b6064008b8b9cda625e2f376b6619702511fb764e66a66af42c27f7e33c197d064bedea4f10bab81f91c0434ee54b09eea0b6c5b0fa0098948a7047b39aabce3de467b39db1e60d8b346b696091de52de67"}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_GET_EVENT(r3, &(0x7f00000000c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000340)}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={0xffffffffffffffff, r2, 0x0, 0x1, &(0x7f00000001c0)='\x00', 0xffffffffffffffff}, 0x30) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000100)=0x20000) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{}, {0xa, 0x0, 0x0, @mcast1}, r4}}, 0x48) mq_notify(0xffffffffffffffff, &(0x7f0000000040)) 02:06:12 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:12 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:12 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:12 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000004080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x2f8, 0x0, 0x7f}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:12 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'sit0\x00', 0x0}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x40000, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r2, 0x8040ae69, &(0x7f0000000780)={0x81, 0x0, 0x56, 0x2, 0x1}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x400, 0x0) ioctl$KVM_SET_XSAVE(r3, 0x5000aea5, &(0x7f0000000280)={"6019de75c6c28377029ed7bd9743f8bd747788a849b17269c9cde4643eb1791a93aef7217cd09cba1645bb2a671f231ca0d0011a7fa3104de43dd6649ee3f7ab8ea76923c0473c7da4e4295cf7d7d27943a99e3407af626c2993003ea56825445eaaac17b25c31877499bc57faf0d62dcc7aeb75ed189f7f007ffb8de04c7ea5b3ba2c8fb4a6893e12cb6b083b82126041baed58ff5adead76f8742e3fb51cd996c297b79416d931297b0ab92cd6574b5e49a18df081b467e4e45d3851dd6c2495f80639cbaf020d1963418ed0a4abd6b8644e1b786078b3331bf0269e3ebb8f1d3a29d6fd700005927a7a4c0e7223a4155d2175a76693120b427f6ffd317bd89ff27360a71997c105a20cbb0927b05b96f4aa5015214629d3e0de7412e68e2d72bebf3afee583d3138cdb5b0913eca3112132cfff6729785c5f58b0ed110b949977ba4f998f690c1c4a290de94f9c9aae948c0db4ca81fb4a9a63d174b01297b2e8fbd341b79661f21900cca9cc26dcc52528f4e16d7b87e746b7c2dacfc6b3178bde5623a2a17edc859670fca44dea1c268f13fd2585d314a997654f2c0ffac188621c55ee3d95e5bbbda173290f190bb61e7ed36ec3ef001f560b5ec0a4d8904655b52edfb94f83cf1d72e2006b312bd6c8a0b916486a1d4fe21a60cc5a2f690e902c04b1e9dd49a4b376dd5bd794c825247980570aa84c02c6cccb9b4bef691c245c22943077169b119a747c62984b10add73df9d72b465a988365cdb7d8a1d95788175c425feb642253edd352aa8d8cca2d4fea32f47a8ff3b52ee9cf6b3afb3e82b54b753def603e5b022a232af555d9315babb74ce3bb539421c21afcb48d0a53cf3742849a2157fa146c6d870f3a914584b4215f2ed67d3e7d23e7b98abd47a4c57d2791cca2711ee1feeb678419a55df934ef85bcb3ea3454f34fdb92854a4f5b39a229b73e058f3d21a552a360bc6accb85a6729e5f96209996e6dc3b8ced1db04f63888bc7651fb34ee71527cbb42cdce5fb9ce7e5dfebe61a51eec57667d4642555b3688581d9d732c9ce957669087e35e5fd5bdd3f32cfa356d5660dcb88f5a89342456bbf2a223e6aa380aaa15ded6fb145b74d36377e1a1f790514a79864007f18f87e8692711a36f3ceff5cfe99010767bdc8ac192a9626fe5b763c79e50f0c46ef4dc0127518de4c95b70e5e8485e807f6fcf3c8c7e03c21c69b6814bf36cbcefef765cbcd11eb0f05edd1f7416611564789569e1a39ae046ce75902a088735eb0a32865269c7f8dbbd8d470ceef683f025535e2fed9284de3f693fed63400ccfe6c0d383f08efe701f93fe1adc35edc31b0f7a3f50b9583b9e33fe2162194d802ab1a32f2f763492ecacaf3e568bdd7e407e5020c2e806fc31d2dfe46e4d3b3e64ef59a20b4bc2457b6b63a2cb166a04ceeea74aac6dee"}) bind$packet(r0, &(0x7f0000000000)={0x11, 0xf7, r1, 0x1, 0x9, 0x6, @random="a846704b517f"}, 0x14) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00000001c0)={0x3, {{0xa, 0x0, 0xdcce, @mcast1, 0x80}}}, 0x88) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0xfffffffffffffffc) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000680)={0x8, 0x0, [{0x7, 0x7, 0x6, 0x0, 0x4}, {0xb, 0x211, 0x401, 0x3, 0xfff}, {0xb, 0x3, 0x1, 0xef, 0x2}, {0x8000001b, 0x101, 0xbe, 0x14d, 0x5}, {0xc0000009, 0x546, 0x3, 0x401, 0x8}, {0x7, 0x63e, 0x401, 0xfffffffffffffff7}, {0x7, 0xe8, 0xb9a, 0x7, 0x4}, {0x80000001, 0x4, 0x1, 0x6}]}) setsockopt$packet_int(r0, 0x107, 0xe, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) 02:06:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:12 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) socket(0xa, 0x1, 0x0) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:12 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001b000)={0xffffffffffffffff}) r2 = request_key(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)="637075736574656d30b42747504c00", 0xffffffffffffffff) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r2) getsockopt$sock_int(r1, 0x1, 0x2c, &(0x7f0000000040), &(0x7f0000000080)=0x4) 02:06:12 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:12 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000002d80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x6, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x1) ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000100)="9098732e3ddc6f035389ff7eff39a092360f7bcca931f0fca497fef46e687729b5067646d70e91ce2f73935b74461fb334a8cb708fb6c09e54585f41bca692efe48073ef7e7ca7f7864cc38320a50ecadb7651f33731d505ca2390de4b9d691d9c30979e4fe1fc73c30cb440c67a4482992a9a12bc94efab91d969ba007b9848aefb2c00d0e1dca096ace83175a9dab1e12feccdb7a3a95a360ead25a86ef3bd99a82d384747ca85e32443b46b5643047260666b736478e40fd5c1333b56b68dc9967a3058b46b6bb26624ad64c7b00cc699638521741b16faaead676cbc5b64baf081be4064ad86eea171a220226ff92f159e77eb86e97ef1cb9536d95b65abcf555e1d37e57b157457b1397b5f701a6a85ed0ec544b49b70e4c6247dd475b5a03b7bdc0d99c65043c11fe914152bfbd0917e4233dfaf3a3353564bcc2b5cc56a74b75a00ec2cebc2795c0df02c891b73392b74754370f95ae1c7521befe10ca7326952079dba5fe210364ec7c458bcc354711e4dbbd1560d5832c2dae28075d871183e264fd3946d39129874bcafcbf32314fdda56bec16f60c6ddc2bdda14cba1972740b340918ebab04a3a69957018026b2d7d16eb64295b967d1ebdb59f637b569e9440660e7f6ccd8b8a582b600fb53cc51678df325633933196d05fa0f1ca7f048a7fb62566fb1137bfb8e5ee7d02f68cf8c532c096924660c20835170872ce698a226aa2bc34ae4f2012d2101ccbc46244f494e57984c07b7f052b1c45edfb247ace95fd21034981692cfe6845b582527ff0c56ec27aadeca4458dd17ce394fda4c745be87d1a819dc00d65eaa6b47862ff120b8216d85b1b6748e19b3e7686951e547c3835a60c78cbc81171c23ff1384f79a5ff6e004a5b63fee0ec33a9b492ddf8a00caa0b4a608f995b51ea4e1a8f4e7ee27edcc7bcf3f06ac934b6613937a824e440e32e3e782d187b68b1d94cf5816b80ab41e99fce7a48631a0b0a0ba0e798aaf71dd9b5df863404fcafe8d123383ebf8e8e827cd0623a0d95b3bb50ca6f31975de3e6508db708241d0de9736a733daec341420baa5b3757f96ab3a3ed4c34b16e4da46b2b7060da7786fdd41cd02077a777d68e9a6d7a09ca697fc1d16af60464c9e3124433011f2b6a9721d9995e490abcf6bb53ec490b858c773c3b72d77b310341cce0f143fbce61b5a7f848d4637891c07817542aca5b308897e6bab07940fd2a70111268ff99fa1f62ead0580b7a8497fdd9b0171225398000dac4a48de2116c919bae23abf9f417cce29dc1abd5321eb81d165bf0029d5fee29520d2b0a14ada6cfcc82220cc77da89d6ea7ba926d685fed663dd2fe9f5709b6c13769a1beb6c61c140604a8612cfee76dfd09708a3a0763f78d818c0e33cb46206185931fb819c8ab5ee93fd7039906364b589d5a41b28c6b5854ee26705d8e9e7c568a7e55e5b233b238e8202d8b754bf2875717b58656f6da67123cf0e7182341186e74409f242d237af51e35d1396f6e2b679e0cfc8f5a2d003bc35adfd9d4fbb4b8bbd072a6d24b20eba4f546c88eaee0d455695dfd7442b472eb584e4a2ef30026c386c28944752c971776bcd7300918019d04e26063d43d5e69bc570fc4303a2bbf1cbe809996ab7d7d5ea80fe71b90b58ce026e5e48b3b7a2343f21966e9ba18ffc3bc881a8c36a6c715c2ed3b6d9f31e26fb91e18be2d50735e02b6e1eaefe04869d11bb577bfa52e908f59306726d7b1f9123a0af4e2484215bfcce01e09b38bd49a970d52ef7bda28b319b502d0626adcbc0a236493afa1103b312b2a9c4bcb88c9ef94d6c116b77365defa2f27a8740e146ffa96dc43e23bde731de6f9a520dd850c8b0bc706fb1e241f46e2cfa6f0e120f16e2ac93eb07ef0306af6bc0f4dee9ab3877e4a1e1546b5531773cef5fac77acdee3a449baf58d2830d400d3e88c084ce5e4eca4b70cf752e7a969a780d42213ff34e3f9616d94827dd446dd1f4af591561730f97f59b95f06e0d3ae7226a709ac9a52c37e4b99a2ad7525c93f749d11839d059ad2fcb4c4afdca625be977eb00a2e4d7673f5f0c8dadb4be9c5c5270db871848277fe638e31efd55748836338132d79ce9252f6b540dbe5948345394b05db6eee6601f084d9e9be33bc243e1b0e30d558cdbc8421516e01ce500019c789c55716b2d49ada9e8e5bcf9a41b76202d67d5506dc12a370653d0d66f3a2a28660f4f4d60e1234c70176773df38418c9a1c97c54ac6544480dc75ef5f0aa9cc50576a90324975368bb3940651006af61bec5c708e62c553df7e0e3d4bd079be80171264b92ade1e85849724e40f278b98b550f73c57d7986f93050ec89c764e537e435dcbe802a785f8ac0bdef12ea34271aed2f2d5656aec12c5f6c7951152d5fa90c12d3b8228c9b836b1fd4537455afe5345057e156b3dfde125e2bbf12f85df7bfeedec264c86b5c64b913ec2d4bfc466b1e3d6f5fd134919049136b6cd27ee451a47dd2f527f9e63d6285b49894b9921023a52386f3758b4e30f7ecbfc4d19a41c929eb58d72a6120f54c92fa526c9b5f4b930009f84d8d5f55375372ba7dd1cf3e0fd1a6aae3d2b82df7174252d5847815320be035a79dae34879cf4edf798861fdfdd01957514ed0bc0b14dd30f3f70bb07d8aa06117ff5f9f1aefffdcdd0313e3f441bf830716724b603074556c5af49097adec057f29c802790ba2876fcc5c0550672e7b3f39f5ffe99dd4792cacf3cccc187dae31f7f9ea79a4b6218c8fc419a8288cdeab08b0be4252ff8d1a963019ffbe9f68d6e6bf82820395842539c4047a9c9001c875fe7803ebf47dc56582c83603f380e497bafafa442457bf5c5c4d79c7540a4e203b6f01c17072441639d3d1f806a4dc325b2ff9737369954650dd769d2639a9b49e5aea8f7ee12480d37baf1c533221327e51d5a4a6bd7ee125daf2131f8cda4d5e2b970679f334c632235c511818f7755fe67431c1dc0c4ea7a06b6e4c9f4db59d272a3aa24c34f6542a3002f6f974464ee25883a132a25f24556e2763961e11a37b054b0d67a23d60d51e3b481353dd85bc6598a68394a9cbd5b3d42e036cf308f0440595bf1f25071269a4e7faf12e98f0a9b5fe3be3bcdf3d42029421424858fa556fb0a28dfd1e26ef0bf7fadce8549137f0e3169f8f4f6ae80e4424000bdabeaa0dac5ad51c661bdc030c2306d73e8aee524f62b113317adaed89ec3cf076ac299d96a606824f31b2d4a366c044f7c07064a77b0315336565fac1beeb8e3f90574ece61bcda4bcee2d1db242acf975a5c1a054e5d137ecf91eba308f86cd3ad14ba546b2420d4fcc0ef2658a5eede94d2543e58485f0e1f42bec0b68cddadbb2ffd7d5b0d1e7909d8daa5954420b51bf32677cbf05198f2dfbd85ad1b73ab0801fdba7ae8a7085455fdac3c6c136518a230e2ea84a62e6dff78d9853ee6bcf7209ab60edb25fcec83c72ea7de504b82bf82d51f47712304f2730c4949d1daa40586e6e232ef7d5cc7e263bc2091e773da553c9da591e11268ae9f0f115f33c4d1bc564f61941fd708d413c35dc80e43ca4c850c172121c6830a8e3b6cfcd72828c2db7c0fb4dffd83489bcbe426dae040efcf1325ca9bf75a3fa35e7f80f34a236fe1b201333f2313f56398a59b00c1a3fcc2f3ab80eeb65b82e3939a1937ab464087daa3efdba4c3957c87a0a367cdf1490203c7806e4eb414f97488e14de05652c6726e7232e01759639cf8e7fda72ea35712a15debefa6ff044f49e28bafab62179c4cd3cd480f32efa6ef89d570acb8bb295c0e81fa67758a8689ca4efc1f2c3427a0b6c97abf0791d10a9edd3138e266c25d82c6685ad0666c5d7b8775bd51df1a15abab5317f97c709f88b43327b6b999315744db743b7871cdc40cfcbee7cceecb1676ff4db0b1e2ec970b995d783feae93d69d3bb36d770b656c84249500ba4312e438b6b7b058f5a05fd70ee16febf38eef211f02769de144d11304001824d1033f18b03523a8036d4122b4b16767131509e2721681963a47059aacf5047a81001accac957b5fa7ad8a4160d85a348edd55aa6925d81a978174f816b97ef189616b22113678bb9b980a1be44fdddd99791d798ead9184f2b288854e5fd0513fced1cdec172232f1ee13cd7b9b0a074afcb936f33a24be813c336fa2b0123df4a20fb42e99dce3065585f11504d747c76bed61c398fce1eaeb849fd2ea64d73d0c68c9f330075aa9d12977a9c252ddf6bae9e8b109d9697f44a90c620e221924039ab9ad91077e49532ecbf2da1d24184e97476682745f0d9999e3c3403871b10e619fd9ad9deb5d0f1d977d52e6f53255423460e67c44f5134aa02f7d4f921aea63bba0463d39a700bb0fb858c9f37eef1466a2992514bef6a98e3e79155e8055137a6fb452b673ba2c413f7546c5ec931c83fc5579312e74200cce8d901a30dcdd2edff2e2975d0530790612abb14e3321e0c50c6b60b4abccad52e26bfdf0cc6c4fb9e4e71bdea2bea2c41b8e0a094dba37861b515cd38468c7318318b54548b605704a039ec8b7b8138333d14fb6fb87fbf67d3025711b348b57426cfe2eeb99eed659d1cb6f6ac5f689085c8fec1ccb6239e374fcf9d18b232eca3c16aa338f6adbdf0448611d9bb4d7eec0b8da0c234131053a6f1bed43f0bdb61c983084e64238dfa08508fa6dac72e9ac5d49dd74e74ddf1462c21586796d9b44874fec0b74b3f8ae863c80567d1c9b17e2a78e371afe58cd5a16e7cf87fe3427b5a5e65e0942aeb853dd2eb03e66c278c4f157f34e2ddd2c5d1cdf3f51d7402f89d8d1cbd33aacad6fd28e4b2fed3d7983a91ffdfd305690c3db2e1835791f377cb48d4bd116e9b56fcdf5cd805eba4a7f13f9aedf653b7b2263e33d6b98c8950f0b231966cc017af80a5dc6c8a08bb8a6939bf3202a48659b203db0cfcc02245ab0211e98316f39ccbd7c3718db351f06784b65279c67ddc47ef7ef14555a599b5dbeeab87a5b1565ea0c9e06be38d18712636a82a5ff9e8584958c3e64ea2cb55beac151da0ee841c5a0df58f495fde4031de5a9db34c18a708c9a3f97d7c0ea69b1a76717543abd34eb8d303cc0783b4239d5bc7d8d612ecae58db98b3eb43be64248e4ac05d717ad44b2c2621b583f033c2dc58cb60dc6ed7611737f9e3329d353f7cdfbcac8896d3a77bda4bd3561df1a052cbab7f0a3831c2e7bac3cd0936d0cdb9e436e8f37c4973ed18d4213b66cc9f3ee6b3cfd736677840cfa7419cad526731e93b7f2eedc90257ce0de8e82a228a615bc4632a96d2b69945630a6e88270cad2130ddfc2a150b7b7e277b3728dd202e4a59ccfed778a2989fb473210d2e49b1f0c8483bb673c9ab32fe36563e917f570d3cbb8e9ea53d4cf8ad6ee17cfc969dacda89e663d3da910723539e2b0e2e5b7cf0b335a5cf92c379b61942bcf9d0cbc02ac0030f436822348f366ad063514e04a8b50348ebf0fbbfb78d6226ed1a3b09c82d5c34b669a65a84cf68f470a8379eae775f204f03570787eb388c4e97f66a52c3b15c05a22845d2bfc7c07473a44ad0f2d8b9ff4b3e558e845854eeb8eb824683d2c24d99a4a17c31f7722a427daf611c9a61f931f3c05b4f8b89ccbd3369c2390daa216b5ebce72390a22c874a1fbbf150fce1ce2fcbd106866536efce1c269b50437b85a57d2cfb34f08806efa28a3d1baf1ba8530d71af46800d8a318cd5a0b9de3450b884445c6450981c3005a87a6e79fa4a8337cc4f37186027e") ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x3) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0xffa8) shmget(0x3, 0x3000, 0x260, &(0x7f0000ffa000/0x3000)=nil) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000000)={0x7e}) 02:06:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:12 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) socket(0xa, 0x1, 0x0) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:13 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) socket(0xa, 0x1, 0x0) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:13 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000040)) r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="24000000070107031dfffd946fa2830020200a0009000100001d85680c9a7ea20400ff7e2800000011e7892c987ee5e015e915929090d1ffffba010000000009b356da5a80d18be34c8546c8", 0x4c}], 0x1}, 0x0) 02:06:13 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)=0xffffffff, 0x4) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x0, 0x0) ioctl$KVM_GET_XSAVE(r0, 0x9000aea4, &(0x7f0000000c40)) r1 = syz_open_dev$vcsn(&(0x7f00000004c0)='/dev/vcs#\x00', 0x0, 0x14400) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000500)={{{@in6, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@rand_addr}}, &(0x7f0000000600)=0xe8) write$vnet(r1, &(0x7f00000001c0)={0x1, {&(0x7f0000000100)=""/164, 0xa4, &(0x7f0000000700)=""/224, 0x2, 0x1}}, 0x68) recvfrom(0xffffffffffffffff, &(0x7f0000000300)=""/115, 0x73, 0x40002063, &(0x7f0000000a00)=@ethernet={0x306, @local}, 0x80) stat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuseblk(&(0x7f0000000280)='/dev/loop0\x00', &(0x7f0000000440)='./file0\x00', &(0x7f0000000480)='fuseblk\x00', 0x0, &(0x7f0000000b40)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x3000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}, {@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x8}}, {@blksize={'blksize', 0x3d, 0x200}}]}}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)="2f65786500000000000489004bddd9de91be10eebf000ee91e18f0c76fbb232a07424ae1e901d2da75af1f0200f5ab26d7e071fb35331ce39c5a0000") ioctl$FS_IOC_FSGETXATTR(r4, 0xc0c0583b, &(0x7f0000000040)={0x0, 0x0, 0x81800400, 0x0, 0x180010000000000}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0), 0xc, &(0x7f0000000380)={&(0x7f0000000840)=ANY=[@ANYBLOB], 0x1}}, 0x0) msgget$private(0x0, 0x3) 02:06:13 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00000000ff", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:13 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:13 executing program 2: r0 = socket(0x15, 0x80005, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x80}, 0x1c) getsockname$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) [ 282.385102] Unknown ioctl -1879003484 02:06:13 executing program 2: r0 = socket(0x1e, 0x2, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000000)) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x400000, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r1, 0x8040ae9f, &(0x7f0000000080)) bind(r0, &(0x7f0000afb000)=@generic={0x1e, "01030000000000b9000000004700000000a979f321b30c7bc8790405c7bad62e0a63a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151d24acef1f1622ca5bdb9c8ea31000077aeb81c90001d6d7c980400000000f70dc136cb184a"}, 0x80) r2 = socket(0x1e, 0x5, 0x0) sendmsg(r2, &(0x7f0000316000)={&(0x7f0000dd7000)=@generic={0x10000000001e, "010000000000000000050001e526cc573c5bf86c483724c71e14dd6a739effea1b48006be61ffe06d79f00000000000000076c3f010039d8f986ff03000000000000af50d5fe32c419d67bcbc7e3ad316a198356ed0008341c1fd45624281e27800ece70b076cf979ac40000bd767e2e78a1dfd300981a1565b3b16d7436"}, 0x80, &(0x7f0000d0bfd0), 0x0, &(0x7f0000000080)}, 0x0) 02:06:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 282.412553] netlink: 64 bytes leftover after parsing attributes in process `syz-executor5'. [ 282.439216] Unknown ioctl -1879003484 02:06:13 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="7400000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:13 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x82002, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f0000000000)={0x6, 0xd6df}) write$sndseq(r0, &(0x7f0000000340)=[{0x5, 0xfffffdf6, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x30) 02:06:13 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:13 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$KDSKBMETA(0xffffffffffffff9c, 0x4b63, &(0x7f0000000080)=0x80000000) ppoll(&(0x7f0000000000)=[{r1}], 0x1, &(0x7f0000000040)={0x77359400}, &(0x7f0000000280), 0x8) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f00000001c0)={{0x80}, "706f72ff070000000000000000000000000b000000000000000000001f0000ffffff03000000ef000003ff02000000000012000000000000004000000600", 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x2000000080003, 0x0) close(r1) close(r2) 02:06:13 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:13 executing program 2: r0 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x9, 0x422002) connect$bt_rfcomm(r0, &(0x7f0000000140)={0x1f, {0x3, 0xa5, 0x3, 0x1, 0x0, 0x8}, 0x80}, 0xa) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = accept4(r1, 0x0, &(0x7f0000000080), 0x80000) connect$bt_rfcomm(r2, &(0x7f00000000c0)={0x1f, {0x7a78, 0x7, 0x9, 0x401, 0x1000ba, 0x200}, 0x200}, 0xa) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/2, 0xffffffffffffffff, 0x800}, 0x18) 02:06:13 executing program 3: write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227c, &(0x7f0000000200)) 02:06:13 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00f83f0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 282.767510] netlink: 64 bytes leftover after parsing attributes in process `syz-executor5'. 02:06:14 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) readv(r0, &(0x7f00000002c0)=[{&(0x7f0000000080)=""/4, 0x4}], 0x1) r1 = dup2(r0, r0) write$FUSE_INTERRUPT(r1, &(0x7f0000000180)={0x10, 0x0, 0x8}, 0x10) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x325900, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f00000001c0)=[@in6={0xa, 0x4e24, 0x2, @local, 0x7}, @in6={0xa, 0x4e20, 0x9d, @loopback, 0x6}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1a}}, @in6={0xa, 0x4e22, 0x2, @loopback, 0x7}, @in6={0xa, 0x4e22, 0x5, @ipv4={[], [], @rand_addr=0x10001}, 0xa091}, @in={0x2, 0x4e24, @broadcast}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xf}}, @in6={0xa, 0x4e20, 0x86ff, @loopback, 0x1}, @in={0x2, 0x4e20, @remote}], 0xcc) r3 = getpid() sendmsg$nl_netfilter(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="541200000d0c000126bd7000fddbdf25070000047f37b3b34edda1699ae77a9772c548a483f7c7818d1d96075c0dc13a78ae525683bb998d0fc4be80219d6023ead77dd44e8e4de19108ac88e17c2f54e0c308005b00", @ANYRES32=r3, @ANYBLOB="68112e000800310001000000a6a1860f40fb0912c51bed2037a7b580c58cb5fcf58f9058ec9a1ab162cc477a90987a035c502faf9c40daec29504377d89fdb6856234dd775353fbc7793fc0a6a20e91387333098f59dd9abc7fa0e07c285f82e8ff41194d0a659623828b5009021d398dfa65521dc49251c2fdb60b4cb7a97a3f3e647207c6d65c86bcb373c10b3f8430da8e89fb8497d5af3f4088b16f879414a651e3d5ef725fbeadbe8fe3385b4dfd7097926861aa9aa5d73d925885e169ef0e5ec4c1528c02a15aafa2e92ccd73d8d12b8f3dd6e8f03defec2b41e8c09ce06fe2ad7e164696bc01d4dcb21df79a8e56a9192ba211d7dd26f3fc44004a241d3ffdb6b4a534adb07923bd54ba8350a7e3b8058b3165418ceecf7997bf971256af94aa4c7580f91a08aeffe7eb8f130e70d994114d7445735c0f82af8390cc80acaeb39a0252d1913b593f94d62cedd15ca654e8cee5123d5079f5979fa6453ec7b6416edbbd84f2d4c8084f1520b75bd6364374ee9d7c867b9c3c154eeb11c05873b5a3f44116e5777d637fd3542fcd1b7a00056a8fed0f1a1202b3b6bc61c1401786cf7b48fad62ee6f654f0e32de1d80e2917a0642fbb936f3864479162109778d4422593c5ae4a3cbe10ef29574555fcd4889ca062de1438a2933de6ef96af0e50cec68dd274da521385e81710aff64f7985bfcf9d90522847e8de665a1454609febfe66d57b95cb2caeae657f6a3edd771e1e3649ffdcc931428a22cf1a30b4a45173338f279f1d7ce174f4800734b8b52504f398bc1f56ab2ee2eb50e64c3fef13ef06528fa07f2b113b0bda9458c1227e8230505bca1dc3fc5281af3756d8ba2123290d7331602a96c3f15517423221a96b3478e4c22dc10dddeed2626202fabb1de8151cbc409f270f02f8b082fd87fd118e4edd6ae9b240f726a81b9484b9c0ac1c9e8e478d450c33108a0c7dcfb8674b93a87dcf2e281f91fb58c4155a997920b27159399dd48a821c23b3d3852edf9edd3d4fed78912028b5ffb3dc12a05849a7efe70eeeb72c9eb28ec535de5ed9803605669980b4076bd799706ea3fdf978e81aeb8dd2cfda514010e4ca3b9e223484583f5aa419f17ff0e1721b897d29f73af3c09bb08d1a13a5a1fcf119a4e2315f6ed1106fba5d4157a20e1d7b5f6136d9d05ada16e139858c048c886e17bc4ae2f2a69ffa93485138c28f398d7ee2f7a5f9721227627e8fb33982ff5c53fb9674b5fc42aaf7da2dd657f4bbec7e972a544e7183c205ac9ce0ed433c0614382f536b612c4ef012b7db93956f36878a5fe31f8a36aa7e986dd50804c1e96d78b5be59eef83d24e4b2784f41b2cf3e8414d0967d35c76d4d3059472efa58cf7816ad38fce565a3136593dc7c3799292320a5c2a4bd40f8648448831b2ddc181ad836a6fa0911927de90073cedcbcadca227b0c245d8fd5a4ea89c9617e87cbae5d98a3be4ab637076bb350a85d9e8dc3b5fa22927c08c5091ac746477ef00219ca6a1907f94e53caf1034c410b41e87b6003d4492323e5a27461f7a84d87011f30c47a3283120fbf9fdf9058ed284a0623105e9871cc9941add092f15cb0ab8d1931a5c63b4379fc914edd6a47a3bdc73f159c4519bf9c6cdebddd8cbd6111839ac3106dd82ef0e897edc739732b1a033e81e31be047603b2e927fec5691b519caa04ee997fa96d11a0d1c5edd8c1a90a1c3318b4f12c3e8d6179f8183e468a9b89db5589af6c53b2c02cbb931e513ed603bb9f53d849cb2165e545f69cf963aa17f833d9e7f81ff9b2c54179fd7acb43766b4fe874e2dd58e730cf19e8523f96dcae8db4285af7790435ddebc1800ec50def1ed4c1f40b9238f77342d8c7e1c90e33a001b1d38edbf1a7b125a2f484bb1ba5127f6a07af27d7fc8722f5a2b68a1757a6dd9e72b417a0de2665c4b8079f74bbff80542ec50ffb0c45a947b4a8e8a8b5fb93c8bce09429f52ae8ac9da92c80cf24186c86d9d92434bce83ec85ef26ade6aca4c40cedb480bbfb080cc2486d6b1dea74b95876749c6a5f978ae754e631388306839fc163f111b979d574acbfb41261010a79168443900bbb2177a10557cf743646fcf1bf3e0c4b7e027b930e071f391a90a3522c1955f7bf462d4330cbacd6443d97549da9f3b395f149e62dc0f9b9e80d07ffc4a33116010d5062728155bd2bac32d05dddc4cfb0dd1938c9f4382e92bfc2dfd0e76248378b80178999cbe752ff22b65cf00bbecd56bfaec26397f7511381bd263225a8fe723a108268a45a39992e63f2f14ea53edd245de3bda9c7fdbf9c15db337f50ee17f9ee12ab09fabe4c5a5814505921f9123f0088ad2dcbb20194d8d088e6c1ae8cd394fcd114fb8fea836e90de8447106c67f5f2fae719d09a66814fbc290972091c031cd7ada10c8478f85614f54777e1911a7544c9aa4f9fd54d9206e27e6a10000dde658a5db47af70a6551bdd7bf78f8a6c6a19cd923c2b3cbaf9cbac9ac8f8606561e74e7681b894b4ff342d922d9495bd523e78d2da468c5e71d865a554b0b14867caa91b47ede220ce1020e921b9df225b41ca4cfff8508e7ed6f48a42976d1c67f5cd32567faeee29ca0943d5b68f043438f096befb14914a15f757e5391611e55913676e3031ce97a59b5709b36618737573b98576eacd6fff2ed3a62c68218cc88fc4d9d373c5939123b78fef44abd14885619ff057de78b8486ae673edff3b2bd48e8faef43f34bab30f0e6d8955f4e091bac0add00ee5950b3a13bd5196b6d68c0f10bebe09f221275450283134eccdfa2e3f8d578a92a7f99c2c2601b95c4fe06260d9917dcf4b57d4834a82a9ad0a711261208994da12041b435581f44ad5e41ad30b0784c5b87c2c67ec7f3717408f990c081fdd7ba52ea640a3e3f9d0da6ee10cd75dcb708c6f02fc9e7cac8a8ddbbac2d9562759ceccd3019cca359e52842ebbcf14436f438dd4b2fbc74e8e5b87773c8ca170838946fea5a9ea9cbe029c33703344ee30864f576c849bf22181f79337ed2d7c01a905ac2d0fdb8f2dcf482d7cb27bc8a9bcfb3ba43ab907650fb2bac007d0823cb7149b709068dd488fbdb454ca5527df33a41ed6e05f1439bba0e6c6ab8058628f499a33b075afdf39832a4ca6ec0022d0e9f90c589b8d7152566709d11c7140e83009d4ee0a5ce58c78def4e40e9c9024c68ac01d2e8c8b390b007bae669a0b3b653fa2bd994fbbfdc36fbb970a967d1f840be2c3b4b1a3bc72edc03b1f034755509dbe271d4cb1f15157e19b8e802dd01dacbf514a38456a7f67de60b17d3a97721157257c6204306822693380ac42364ac3628c08344f6ce4c15af88a0d0f1bde55cd13612936dcd1082fd041a0a4b11c74933b663dda37d5777afd92b5c7952ba3081dcc03bdca9c3f811a0dfb8c219327650d3236d0f81b4826cd41fa9e9e473dd2125721fd324109396ff5fa4c45fbea52ff959d1638267caf685ba03dd68a8a57ecf2456e4c220e16f87918fdfee7524d9ac8e92453f308a037735cff51a38f26757a285600162f3a7c97af03639fbff9189adba46aed17cf4cc38754d98fadfeae1c6ab860c89bae70ee9b54bf4a73ac2b128e2f4cb7831c8ca5f02c895997c8345a6a8730cc82ab7e4412246faaa0c5f05c091aac2090e438262027266d49d3c10ba78726cde04170de80c9916cf65bdace2a6d7542c943f3c85bbf46528e18e48153093386b8cc617c4fc58b4846424c4b796ac576dd114faebc46d3575c17763437184819e14fd8c802413797284284c9569198845f19d84166ca58f495c32f43d1885526d7173a11b03e2b72fa399a61e57c84a97e95dbe079849344a1933d9b549fb36c96b0f4578b278c2df70ef3de13c666e05afc44747bc203aa14622929f6b86d8170bb1cff1d19fa8c47cadf7de03808bbd7370bfed36618fe0f5061f6e26b621e41e22474a2bbf9f7658e5ec3552558468e462fc9502a9d5a7e2322daf2c8b376042a098cc8c0168266f064c1cbbddd97d554c7f084fb55787e8ed04d4295928b1575f3d4b745eeb12e66014e96e19327498fa80beabb2ed00eb4f529892830e5fe614d8a467a43523451cd95250f7c2147f3ec64c4a51628076e5f99fd6abb1c57799fd0dc8c637f16ae62ae7aa197b0f7420056039ab448ef4dbfe7ce87f9bbee939a85849d141c5721cb63923d6d1780cfa14821cc1c813f0d9bc497c14e8cd94fd67c8468a007d7dcfa7a768c752be79342a91f20522f3514dbf69cdd63a662740a40019c562a0f21945ff9eed4b5a73efd179dbb60385f5a21017a127912f4472c054b196202510fe5fe0c1b91dfceaa3dc5b17946844f5180a331a248675c87bf48c74f11f0a818ec0bff46bcbc173b9d658b1963a6a8dc6b8d17cbd30dd152eb76f3e79b14729729abf1ac83aa5a61397a2890d49bb0dc836c06f6a92ed6b97d445fa906a17d39c78359d5e0b3018a063db6d0d4db1a68ab381d55dbfeccc537ff893450b6eef8cb69b3a98b4c018f9fc0f802f9ac53d8b90a36a16e78f16820801f9406aba4c91bea5544cac3fee15cf544cbefa3343ba21e6dc6c325e4e24bf10ead1462c38c58142f5d372b9d29fd93c25881fd1e4d113192bfa5567ac05c45eb56b87a72badd32883462c3bf3ab5710a5a91ebed3f6465e74f15abcde250ad55c92d5a71fabc067efebcf8a8d027a68ade5e03968eab3a9ec0882790c202c9ec3da73d934230936a9782a263a1fc3a0acaf92652d141e3c46cc72c77343abb7e86a6ab7088594bc52087ab44dc50bfdd0be6ab65d38d0b1654cbc58c7fd5db3622883a290e9fd9925e3c38740583ce6efd0485c59f14ba4c0d4ce4dd0a16cefdcc523bcb7f2976f5fbecb15294b6bcfadeaccf45bf450dfe4535a0c1f4635605e6b42713542650ebc9c8b7079a730b3c4d65146099f3a5138529c8244c6ba270871d24f402d1c72ee9e70a18d046109724d61cd02226567fea798ea43df9d91f25d798ac81fc8cd32a6f9d997a165fdfa09fa7c832a2acb981ef505659bf390e1f76e80db9a2f7a35566967a6f2a717a724a6d680cbf53c8cc8b96477f4cacd02be535e0900921c613eb70bbd26c21ea3f6ddd516e39cc71cd3de4166de1fdd760f50947e6303bd298226f6b744bd776dfbe05059189d45e3f327bf371e29bd93f0e38ba4ad29a27a734996fca4487557ca6d78ba9b2d17bdac599bf344d4a1d80edac9db2ab130008c9631f7b70a2e76172fb17370d4142c909bd033e0aaaa495f31e676e6a37b981ef8f02fa6f8ce7da82640497c12c4794f89f7185ded3b443efe24e281d4d7bf3392b532b8a22734462388c9f3aee1c0ae8b4d050d0cf44e8dac5149b8bd9ff0a377b1e44fdf2dc19d12a71658b322e41a26106bafb35f3e54c4371e31cf7f08345ee32b24f0404fdc2ab24afd810bd677a4a78c660391f8fd50dfac121eeb1fff828bf45120e0452290483f2c29ce06c6a653018175778a2bae0982fa0c101d390fd1fccdeec57694ce348ac4c188ae743ef52bb22a1a0a4393000c19707d21a38db4c1b176d7a3742a4c76685705aafcfc45c719330c4fdb9391abc3d1c68fd7c293bbb6f581416a63f7dde956f80c83540985a36ef298e0ce3847182d361c9744d9a54fee8b68b4058f2f57a818b85467c0fd7d6a5ae6f14ac72a470538b83cd6da4f4534dd0b9c8b58263e36a5ac7d717366af988eec5802eb7b6162fea09bb3b48870dcaaef1b7208459a98a1f35abf870819a03d99041e57f97b576fcf7f9a9fb79c5378259faacdd6489307d194c6a3a9d55bf8c2221b7adf57706f9a572931bbed6f85df5aba5302017a0d92a8e9d65b91f3233dcebd5857f7e96c6500904e04677f6f8174a82123bdb5a43f024e757df06ed0cce51599ceba4ef6df07ebd5e7d2d9d14eb12a23dbf155fd45db17f5a98c7e8985f6d2335d0874c84461f8b97c8937e7032da0aa75489aeeaa6e293961db847b90a1fee26ae196807a337a0b5e331adcee89412740d45e012944568bf7df0d827c4c3fba3c58fa129c01eb646535e2c225447a0562475eb2d511d8ca2f23f70cdbe6565672d77e472232bf793a60de1e961c19865c5f859f8f3c6bf795332b160a1101e8fee90620c0fc4adf3df0ef5467c41c4fd0bf5966b2eda4c7a7b713c49d4fbb20523b7449f95c5bfc804ef5aae57e7e49410e15943e4eb8e1ae138babf41bcf916ab10a6ace162abfc4c05075c3a10b2add769b110bedb7b6bdc445bbc662f33cbde89df569a000090002b0056e83bf683bfb64c2ce9f90c635eadc65fcc8670c56da6cc3ac163f015f76d68b8efab50a3ae200b212a12733948168a827ba30260750910b005ed679b73c6a44f4b928a5cd885d251081894d30c1518fb4a6f9183d6ea6a106a688a612836ea51f9da842329db8d625c9341dee9aa7a5947114b538774fee344fd9df7aca764c351ca95366ff545450900000000"], 0x1254}, 0x1, 0x0, 0x0, 0x20008010}, 0x10) 02:06:14 executing program 3: write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227c, &(0x7f0000000200)) 02:06:14 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, &(0x7f00000000c0), 0x0, 0x2000000000002) openat$uhid(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uhid\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) getsockopt$XDP_STATISTICS(0xffffffffffffffff, 0x11b, 0x7, &(0x7f0000000300), &(0x7f0000000340)=0x18) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x80000, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000040)) syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000500)={&(0x7f0000000600)=ANY=[@ANYBLOB="60b533b39dd3e3c4d3a1560a1e0a424e70507cb8e1cd29e01099c95491f70179889c48653702e34b2d8ad765004cc874a1a64bec3fa0c686d7726859891a51464b348148f3dc99a3570f5d0c3b085bf8266b7296a58495e33c03bf0079cd5751e76f00c5d5a3aee671b0086f9dd43db78c3ddccb35efbd3b0d5fd26aec9e266ea59c9efd578aab216700508e28a733074c6c4da422010000000000000002784cf80e8024301cbea8f53b57c24d557bcf0a2c7a4e68521b099b86d15f1481867cc202475b0138fd5bd15d94cd31aa480d12e7f0c163a62a0de85bba4f37f4d4c5823afdbbf80ec93cdbd33d24de8c446f8d299d4dec0a4e1efc9b4c0000000000000000006aeb43ab1b65efd59cd2517ad172fe663cbee446a92f84fe6ea62cd20d045b0edce4676c66472d0d6c595b2e03f2047b1dcb273fd5645c671e82f821f614e8e1cedd11dcca90998c1750753637813f9ea415a077830746731f0b6ba12cbea7aae09444f32540bdfd6a76e70591edb3c1c6e0ff714417c570279ea6b0006baf849d4ad119df9c05c07841ebd6c2e0c612a3001eea5f28a169043cbf921cce46b5c1"], 0x1}}, 0x40800) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(r2, 0xc010640b, &(0x7f0000000400)={0x0, 0x0, 0x101}) fcntl$getownex(r0, 0x10, &(0x7f0000000280)) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000800)={{0x0, 0x5, 0x40, 0x9, 'syz0\x00', 0xeaaa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz1\x00', &(0x7f00000002c0), 0x0, [], [0x0, 0x0, 0x0, 0x6]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f0000000440)={0x0}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f00000003c0)={r4, r5, 0x1}) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1000, &(0x7f000040e000/0x1000)=nil}) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f00000002c0)) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000100)) socket$netlink(0x10, 0x3, 0x0) mremap(&(0x7f00008d6000/0x4000)=nil, 0x4000, 0x4000, 0x0, &(0x7f0000ffa000/0x4000)=nil) write(0xffffffffffffffff, &(0x7f0000fa8000)="27000000140007", 0x7) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f00009b2000/0x18000)=nil, &(0x7f0000001580)=[@text16={0x10, &(0x7f0000000140)="360f303e0f01df6766c7442400090000006766c7442404020000006766c744240600000000670f011c240f20c06635200000000f22c0263356470f0764f30f2a342e260f0f970a008e0f08660f5808", 0x4f}], 0x4, 0x0, &(0x7f0000001500), 0x57c) r7 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r7, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) write$binfmt_script(r7, &(0x7f0000002ec0)=ANY=[@ANYBLOB="8e4e3db930280c0a006f20"], 0xfdef) 02:06:14 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0400000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 283.160713] EXT4-fs: 15 callbacks suppressed [ 283.160728] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:14 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:14 executing program 3: write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227c, &(0x7f0000000200)) 02:06:14 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:14 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x14, 0x4, 0x4, 0x5, 0x0, 0x1}, 0x2c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x730000, 0x0, 0x10020000000, 0x0}, 0x2c) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000100)={0xffffffffffffffff, 0x10, &(0x7f00000000c0)={&(0x7f0000000040)=""/100, 0x64, 0xffffffffffffffff}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000140)=r0, 0x4) openat$vhci(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhci\x00', 0x40000, 0x0) r1 = epoll_create(0x80) epoll_wait(r1, &(0x7f0000000240)=[{}, {}, {}, {}], 0x1555572f, 0x100000000) 02:06:14 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000017000)=0xfffff7fffffffffd, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast2}, 0x10) syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x0, 0x0) listen(r0, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x14, &(0x7f0000000080)=0xffffffffffffff40, 0x4) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) listen(r1, 0x0) dup3(r0, r1, 0x0) 02:06:14 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="6c00000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:14 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x4, 0x18041) syncfs(r0) prctl$intptr(0xa, 0x80) pipe2(&(0x7f0000000100), 0x4000) openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x80000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r1, &(0x7f0000005c80)=[{{&(0x7f0000000000)=@nl=@proc, 0x80, &(0x7f00000000c0), 0x0, &(0x7f00000004c0)}}, {{0x0, 0x0, &(0x7f0000001980), 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="08040000000000000100000001000000dc6573e179d22e7ca4abc7e17251dc5c72dc277f683ca45b2b3482c18bc520b0bec22682010b5192ebe8a500a5563fafa135847e5ca27943cf994ca1869c6f5bef72af764288d6fe8e70011fc634d3f4bc2c5ba6ae7cbcb0dee1fa97af8aacaef9fd712fa8eeecc4c426d86ad0938daba269f9b24bb5a2975685cf465b9e09392cd286c28202b8d6bc5e96a13b4e809507e04602c1dfebf015a3473abb6a5bbd785f03cc5946e335629db31951dcb3414197791b9b7c8686ece753d616dae4391fe3b1adec5c5eb484ec7efec828082b2a5a0fc14269b524b2eb3fda2a116935231ea9b82e5f67d836319a9f2b61db82599aa54a2fde6a6dbdf71decc6c4192180220b1505a170a7e31bbaa96ba9a67ea0bbb70c1669be8235997bc2f5014a53d0b6c682d97301c8e08220e56452cbabe918a0f17fc1cd4cdc14771bd85fd1834bb7c46faea8ea4839a7688f8eea10c1a080d428e7f1f241e52e4dd4bf51eaf074d6a39ce00e4c37ed9d7bc2df4026dc5de98dd569f00f93d7c91b625e8dd5ac27fd4f84b3d5f231b9d1526fac0dffe33c2bade1b4b57ae93af860e7b437c041ca6f2d976f0046ae34785038b8ad255f32f3c15a131416986ecfa60691d63f5fd90aff82d45e1d43557dadeea8ae3ba9b1d76abb4e5b07ecb91f1f49febedbc1cef9a50e3cb6bb601a6b5faa31643ba396af9142aae23844beef612bbaf17c99f2e5b88cf9412e910feeab566de219e4b364a4f8b66f63424169e41a6721a3839eccfabe6f14a0f529f2ef3ecd3f951d9545499bbc188578ae5439119ca8fd240cd980c0875675ed9e6d05a9d36be4cc71fae1662e5e8cd814870488d600a9dedd63aca857fd658d6a2b22293a323363c3a3524847a7efbf88caf9ed9e07bf8f190244b909ecb29a59f77ada248410d6b7788f3a6c58d59888f880f4a5318c5b86b56f7c7a00560086aa544f5a64ae7c6e2516dc132bb125902f10ee94cd571a5da422694900d8dabe4639779a1f81e2c9d2bd4b38280acd8f24c3088cb2e7677c379aecbe0731c44b4fc05b977e54e3a215fc67ed27a7d10361a51b148d21b3029a7beb898e189be27209b3086e33be306c00540880c71a7962c4c231521b39c7651291541523e72fbf67ad43704ccedeae8e3d28253852e069cc1a4f3775b83c3efd78fb24f1bca949f35772772b56beb224b09ef1c433e5bb59cc6dec8d64ee7d10e7079f0670f3cf3070317c7f4a9a946fc212157f9b27e6ed172a8586031a89252cbb4970cf41a9af5e4069b3a9a7baf3c47ad7398eafd0135339f6075b8e7ce83ee257a00e40f1880fdfb6f32cdb5ade566e6c413b2fd37f13a14455225311c1f6ea5f639fc20bf2f03fbba9b504ea798c5a5994afa4d9a8970570cba9df185670202ba9af451c9470168c95249329184ea138f028"], 0x408}}], 0x2, 0x0) 02:06:14 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/wireless\x00') ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000040)=0x7) r1 = socket$l2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000080)='lo\x00') setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x0, 0x4) mkdir(&(0x7f00000000c0)='./file0\x00', 0x1) [ 283.527454] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 283.542694] netlink: 64 bytes leftover after parsing attributes in process `syz-executor5'. 02:06:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:14 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r0, r1, 0x80000) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x20000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001ff) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xf, 0x8, &(0x7f0000000200)=ANY=[@ANYBLOB="7a0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000bd120000000000008500000006000000b7000000000000009500000000000000"], &(0x7f00000000c0)='GPL\x00'}, 0x48) [ 283.630438] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:14 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) splice(r1, 0x0, r0, 0x0, 0x8, 0x0) epoll_create(0x6) [ 283.780048] [ 283.787914] ********************************************************** [ 283.796667] ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE ** [ 283.821194] ** ** [ 283.829094] ** trace_printk() being used. Allocating extra memory. ** [ 283.843675] ** ** [ 283.856277] ** This means that this is a DEBUG kernel and it is ** [ 283.864996] ** unsafe for production use. ** [ 283.871812] ** ** [ 283.878826] ** If you see this message and you are not debugging ** [ 283.885915] ** the kernel, report this immediately to your vendor! ** [ 283.892596] ** ** [ 283.899332] ** NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE ** [ 283.906066] ********************************************************** 02:06:15 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:15 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000006880", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:15 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:15 executing program 2: socketpair$unix(0x1, 0x20000000000005, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) close(r0) openat$cuse(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/cuse\x00', 0x121102, 0x0) preadv(r0, &(0x7f0000000480)=[{&(0x7f0000000100)=""/181, 0xb5}, {&(0x7f00000001c0)=""/221, 0xdd}, {&(0x7f00000002c0)=""/195, 0xc3}, {&(0x7f00000003c0)=""/179, 0xb3}], 0x4, 0x0) io_setup(0x8, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000000)="10000000020000000000000000000000", 0x10}]) 02:06:15 executing program 1: syz_mount_image$f2fs(&(0x7f0000000240)='f2fs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)="1020f5f2", 0x4, 0x1400}], 0x0, &(0x7f0000000280)) getresuid(&(0x7f0000000300)=0x0, &(0x7f0000000340), &(0x7f0000000380)) syz_mount_image$f2fs(&(0x7f0000000080)='f2fs\x00', &(0x7f0000000100)='./file0\x00', 0x4c, 0x2, &(0x7f00000002c0)=[{&(0x7f0000000140)="95266b6fb7ea7b03c59e0f30e5dfb8d81fcbf19dc535a6b4e489c77cf9f036e9eabf545c076f6b07769cc4aff431d196bfcc7e99e0c17d36a4d4192d6246ee7d9a214b241db158f402d651f9808132a43bb0bc2e40", 0x55, 0xe}, {&(0x7f00000001c0)="7ac93676c27fd2e637b0185c357a104b594eb74902b392c5acd774f1ec06369f5a6c7fe3e97943a88398287ae669d1197912e19c88b388a2ba21e74874d7a9bf20dc15de3724fc0bef9c685843717deae6cb8c26352127ec6b0923b005e996f00b69d5623cfb8d9883f81e752e", 0x6d, 0x3f}], 0x80000, &(0x7f0000000540)=ANY=[@ANYBLOB="6261636b67726f756e645f67633d6f66662c1fe49b6aa1901d6b89a37d10d552ddf964697361626c66792c7375626a5f726f6c653d66326673002c657569643cf9c38dac2b6ead707e5121cbfe0e4cf12fb62dc6af6375341aa6525004a4a23b3192df5475e76f9d36a23cb0860c6dbd240a2ac848771f2c1fa70ed00da53bb7a5cfcb7b25acef1a7110ba6f8a6473960b00717f1332df15e38af7d3f3105e9eea3cef4e31fe2eb012762174f3a0323308804c7914ec1df736faee776153a5a5709527164b8d32fe051a098ff86bbd5b021c1610e3c8c3195d1f3a556d301e54c3886ea2ae0e00788a9a76c14ed069caf3da690edee10816a30b476906c47678377c4983d1d3b0bfb5a9694885cf33050a49cb9b2541ed76fe0ad98e505ff4b98f92634cff", @ANYRESDEC=r0, @ANYBLOB=',dont_appraise,smackfsdef=f2fs\x00,\x00']) 02:06:15 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180), 0x8) [ 284.243338] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 284.251215] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 284.260770] F2FS-fs (loop1): Invalid blocksize (1), supports only 4KB [ 284.260770] [ 284.269032] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 284.277335] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) 02:06:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 284.304354] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 284.311983] F2FS-fs (loop1): Invalid blocksize (1), supports only 4KB [ 284.311983] [ 284.328764] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock 02:06:15 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}}}, &(0x7f0000000300)=0xe8) write$binfmt_elf64(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="7f454c4600061cff0300000000000000c7cc3f001f000000c202000000000000400000000000000049020000000000000900000007003800010000000100bf00050000706dc20000e1680000000000008000000000000000001000000000000007000000000000000800000000000000040000000000000001000000ff030000ff07000000000000040000000000000000010000000000000300000000000000000000000000000001000000000000002e3b206e2eff525f3105e11abfd1390fa1b3e5849c0e18f59039747a8ab4212c72e34b22a47839afeefaa38c0d76682cbdc115cedd770307a3a79ce25b67ab9303382ea9eded768d333f04a8f7828f1063781f915c65a5c4b73e4b5dc4b6b107d15658532136c8fc94b655b0aa1f75bdf62da87c9d5440b76fcd393d849d6e0b5d577ccfef00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffb40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d5eb782713b08ee04fbe303ecbae7d301c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x735) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000340)={@loopback, 0x46, r1}) r2 = open(&(0x7f0000000100)='./file0\x00', 0x80, 0x40) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x9, 0x3, 0x8000}, 0x4) r3 = memfd_create(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000040)=0x800, 0x4) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/nullb0\x00', 0x20000, 0x0) r5 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x80005, 0x8000181200) ioctl$DRM_IOCTL_AGP_RELEASE(r5, 0x6431) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$HDIO_GETGEO(r4, 0x1264, &(0x7f00000000c0)) [ 284.362252] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 284.390307] F2FS-fs (loop1): Magic Mismatch, valid(0xf2f52010) - read(0x0) 02:06:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 284.419708] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 284.457316] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:15 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180), 0x8) 02:06:15 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000380)={&(0x7f0000be1000/0x2000)=nil, 0x2000}) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f00000001c0), 0x4) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000480), &(0x7f0000000440)=0x8) ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000002c0)=""/55) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f0000000080)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000100), &(0x7f0000000140)=0x8) fsetxattr$security_capability(r1, &(0x7f0000000180)='security.capability\x00', &(0x7f0000000280)=@v3={0x3000000, [{0x8000, 0x8}, {0x800, 0x9da}], 0xffffffffffffffff}, 0x18, 0x2) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00010, 0x1, &(0x7f00000000c0)=0x37000000, 0x1, 0x2000000000002) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200), 0x0, 0x7}}, 0x20) 02:06:15 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000000200)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x80e85411, &(0x7f0000000380)={0x5, 0x0, 0xfffffffffffffffe}) 02:06:15 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000200080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:15 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:15 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180), 0x8) 02:06:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 284.619085] mmap: syz-executor1 (9036) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. 02:06:15 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x4401, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000140), &(0x7f0000000180)=0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000002900)}}], 0x1, 0x0, &(0x7f0000000040)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/unix\x00') preadv(r1, &(0x7f00000017c0), 0x1a5, 0x0) 02:06:15 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:16 executing program 1: add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000380)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a04e400000000000042e3", 0x31, 0xfffffffffffffffe) socket$inet6(0xa, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) recvmmsg(r0, &(0x7f0000000f80)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/19, 0x13}], 0x1, 0x0, 0x0, 0x200}}, {{&(0x7f0000000180)=@nl=@unspec, 0x80, &(0x7f0000000400)=[{&(0x7f0000000200)=""/246, 0xf6}, {&(0x7f0000000300)=""/93, 0x5d}, {&(0x7f00000003c0)=""/30, 0x1e}], 0x3, &(0x7f0000000440)=""/194, 0xc2, 0x9}, 0x9}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000540)=""/74, 0x4a}, {&(0x7f00000005c0)=""/76, 0x4c}, {&(0x7f0000000640)=""/88, 0x58}, {&(0x7f00000006c0)=""/155, 0x9b}, {&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f00000012c0)=""/4096, 0x1000}], 0x6, &(0x7f0000000900)=""/145, 0x91, 0x1}, 0xff}, {{&(0x7f00000009c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000a40)=[{&(0x7f0000004880)=""/4096, 0x1000}], 0x1, &(0x7f0000000a80)=""/192, 0xc0, 0x7}, 0x743}, {{&(0x7f0000000b40)=@hci, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000bc0)=""/185, 0xb9}], 0x1, &(0x7f0000000cc0), 0x0, 0x8001}, 0x8}, {{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000d00)=""/241, 0xf1}, {&(0x7f0000000e00)=""/5, 0x5}, {&(0x7f0000000e40)=""/231, 0xe7}], 0x3, 0x0, 0x0, 0x80000001}, 0x5}], 0x6, 0x100, &(0x7f0000001100)={0x0, 0x1c9c380}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="ab553fec94248c32e27d04000000288a", 0xfffffffffffffffc) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc4c85512, &(0x7f00000024c0)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'syz0\x00', &(0x7f00000000c0)}) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmmsg(r1, &(0x7f0000007e00)=[{{&(0x7f0000001240)=@alg, 0x80, &(0x7f0000004700)=[{&(0x7f00000023c0)=""/49, 0x34010}, {&(0x7f0000003580)=""/4096, 0x1000}], 0x2, &(0x7f0000004780)=""/245, 0xf5}}], 0x1, 0x0, &(0x7f0000008000)={0x0, 0x989680}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001200)="c6419903393d769d7b1f4dbb1aa9786de5615b8c24fce2b6b28d83a44722a04980363d3050b753fa62c63e0d75d8cb", 0x2f) r2 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000cc0)='/dev/qat_adf_ctl\x00', 0x2000, 0x0) ioctl$RTC_WKALM_SET(r3, 0x4028700f, &(0x7f0000001140)={0x0, 0x0, {0x2a, 0x6, 0x10, 0x1c, 0x3, 0x1, 0x5, 0x13f, 0x1}}) rename(&(0x7f0000001180)='./file0\x00', &(0x7f00000011c0)='./file0\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840", @ANYRES64=0x0, @ANYBLOB="0003000000000000"], 0x0, 0x0, &(0x7f0000000100)}) 02:06:16 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000013c0)=""/4096, 0x200023c0}], 0x1, &(0x7f0000000040)=""/16, 0x10}, 0x0) r2 = socket(0x3, 0x80007, 0xffffffff) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000200)=0x5, 0x4) [ 284.876201] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:16 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:16 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) [ 285.014717] QAT: Invalid ioctl 02:06:16 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fffffffd80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 285.076190] binder: 9069:9078 transaction failed 29189/-22, size 0-0 line 2855 02:06:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:16 executing program 1: r0 = socket$inet6(0xa, 0x8, 0x406) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000000040)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "ac41d1c45d71d3ed2a4182b9a6fdfebbf3550b2209895f348f8fc6716e08d1364ad5526c6e898cbb38c310d32b6a3217fa0cb9e4cafe0569942f46cde7188b"}, 0x60) getsockopt$nfc_llcp(r1, 0x118, 0x2, &(0x7f00000001c0)=""/149, 0xffffffffffffffa8) [ 285.119665] QAT: Invalid ioctl [ 285.120133] binder: undelivered TRANSACTION_ERROR: 29189 02:06:16 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f000051c000), 0x15c) r1 = dup2(r0, r0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x40}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={r2}, &(0x7f00000000c0)=0x8) sendmsg$unix(r1, &(0x7f0000000540)={&(0x7f0000000180)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f00000004c0)=[{&(0x7f0000000200)="7fb1bd", 0x3}, {&(0x7f0000000240)="16aeb636ff5fc2a38453241da4e96660478108d18a1ae4d53ce79792168d18a8d0b1eb749da83eba00c0c869c27a38adb60d4005db0f0ff433aa7b5cde5170a85f28e2bee646bc8a0ef041040132c03d1ad6ac1b428ca8f545fafaf6de48ce74905602a19d06c24ff56e16c23d1bc545220eccf792fa22e82fe93dc35c80ddfce5fef963792d97e9e0f22d95084cddc8ba7b59706b54579365776e4d844d28417e898006a290b54ac4768407066a359775eb182ff2b89f66c0d85b1f902f427087e36da511afc851cbc1268dc7fc31b2b0b6478ff1cf7a87887366c6c0e938422493ff7d2f7a462c3cd973200d1f150638e648f9", 0xf4}, {&(0x7f0000000340)="b5cf476af22f3c1f663dba63b7ce7549c6febf2a6703daab41a210f4714f4c34b5f131d42d910f1c33385fd483a13aed679e10e88f9adad25d8b17503ce73a7b82591661c59b89ed90f9bdbed3fefc9b74fa35f825489cf972193e283cf80610680ec609d8a6a104fa1286b6b9f3c62d0bdd531f157c81878c79d9dca8cdbffc2ce6c78f5f9114c92dcbbd19ae953abd101deb0831e2cc6867219904be9d33032e58e0e0e13db7f674545a84f8a43605b50d077b0ec6433b18818f7033ef781e8abb36eec8b7a3eb48851d7e2cd1b6edcb59d1182f5866fa03a96f84f75eff", 0xdf}, {&(0x7f0000000440)="7fd204196205312ff3d40fa838c5fcffa5a27834ccbacbb5b712c6da423ad735c175c922eceb1cefa1976795749e417474b74c79861a8b66fd69b8f3fc432936daf9a3f46f69c13fb1cb86bb871d5421542b7f585e5ae49cebc70bb9ccde8b977f75d34f08596596f597301e1c4386cb16b05f6f06", 0x75}], 0x4, &(0x7f0000000500)=[@rights={0x20, 0x1, 0x1, [r1, r0, r1, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r1, r1]}], 0x40, 0x14}, 0x1) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000005c0)={r2, 0x1}, &(0x7f0000000600)=0x8) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000580)={0x6, 0x80000001, 0x9, 0xfffffffffffffff9}, 0x10) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x2, 0x9900, 0xfffffffffffffffb, 0x1, 0x10001, 0x4, 0x9, 0x0, 0x3, 0x7, 0x6, 0xfffffffffffffc00, 0x4}, {0xb01, 0x5, 0x9, 0x8, 0x9, 0x0, 0x3, 0x8, 0x8, 0x3ff, 0x4, 0x7994, 0x14}, {0x100000000, 0x2, 0x1, 0xff000000000, 0xffffffffffffff0f, 0x7f, 0x1, 0x4, 0x8, 0xff, 0xae1, 0xdf, 0x80000000}], 0x1068}) 02:06:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 285.275868] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:16 executing program 1: socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x100000000001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r3, 0x0, 0x8ec3, 0x0) read(r2, &(0x7f0000000280)=""/112, 0x70) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000040)={0x0, 0xfff}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f00000000c0)={r4, 0x8, 0x2, 0xa9, 0x1f, 0x7d75}, &(0x7f0000000100)=0x14) write$binfmt_elf64(r1, &(0x7f0000000340)=ANY=[@ANYPTR=&(0x7f00000001c0)=ANY=[]], 0x8) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000180)={{{@in=@multicast1, @in6}}, {{@in6=@mcast1}, 0x0, @in=@local}}, &(0x7f0000000300)=0xe8) 02:06:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 285.352712] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:16 executing program 2: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x8, &(0x7f00000001c0)=ANY=[@ANYBLOB="7a0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000bd120000000000008500000006000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0xa}, 0x48) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r1, r0, 0xa}, 0x10) msync(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x5) 02:06:16 executing program 0: r0 = socket$inet6(0xa, 0x401000000000002, 0x0) ioctl(r0, 0x5, &(0x7f0000000080)="153f6234488dd25d766070") clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) 02:06:16 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:16 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="7d0c000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:16 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000040)=0xff, &(0x7f0000000080)=0x4) syz_read_part_table(0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000480)="0301000000000000000000000000000000000000000000ed793afe10000008020082012600010000006400000000012700fd030c006500000064003100c900000064000000000432000520fb06448189b8be34a820002d010000d306000055aa", 0x60, 0x5}]) write$P9_RXATTRWALK(r0, &(0x7f00000000c0)={0xf, 0x1f, 0x2, 0x8}, 0xf) [ 285.808587] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:17 executing program 2: r0 = msgget$private(0x0, 0x22) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@loopback, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@loopback}}, &(0x7f0000000140)=0xe8) stat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000380)={{{@in=@loopback, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast1}}, &(0x7f0000000480)=0xe8) r5 = getgid() r6 = getpgrp(0xffffffffffffffff) r7 = getpid() msgctl$IPC_SET(r0, 0x1, &(0x7f00000004c0)={{0x8, r1, r3, r4, r5, 0x80, 0x4}, 0x46, 0x8, 0x6, 0x68, 0xffffffff, 0x6, r6, r7}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = openat(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x100, 0x38) r10 = socket$packet(0x11, 0x3, 0x300) sendmmsg$unix(r9, &(0x7f0000003700)=[{&(0x7f0000000580)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000a80)=[{&(0x7f0000000600)="f3bc9395488948a682c929d0243a8e4b2604aa95c3ac2865d9209a404f4a70a7005db13d2342f85d81bf33bd01dc19588251961275dd4884390e446fc23f96d78d6b58384f8a198e703558cc7d14cb59fe0b8f2f2e4aad43a09327ad7d8a094ebd8b73b39853a073360e97e335b31bfb98b9800474cbc733b9930c0cb7ed6f9b63c41a3b595846f644184271f70da50e2b9444cb0ced54e61f220976476cd13c2032298d0d076387043d80e8475076c5e50d8db32c32a5e07acd1b70d27e60969b6d41", 0xc3}, {&(0x7f0000000700)="fc797e728be70f32562b6ba45955c5fe64feb8fd53720618afca732d03a56d4955cb0fe14bb1a64fa2df21d8175e4d73a8f57c6d71", 0x35}, {&(0x7f0000000740)="d8214dd6eefdc1efaa939897017d08b6a78d7323fa5f44c6ba65b21539ecc6b21add0abf8dd882d50bb86611c02d9960fe0718884b4ee80df55f756bee735d55536aee787c4df3f110e32e6f911cada5e219a4e5a0f2196362519a248ea296bd4e4ad558afcd2993d26facda01585e5351585e47c9310fe7bc6a16ba9cf972d9154120c7e33ba880cc26892eb2bf961911af36dafed67770c574ab68f975e1e9611e9a2294e48c62165adb8d9beb8912994c4c5aabecd11c97ad66a827d73f8d3728749329055a28233c57d0", 0xcc}, {&(0x7f0000000840)="4d6c67baa91f1d4e3b3a5e4c22305b0980efe011e03377bbe4a968a89faa412a43e046d4fb64fc753f295b93531033639230ee62c2", 0x35}, {&(0x7f0000000880)="bf06ce5af10322d1875c36c6f47462339f294ae04f763ab4470242ed790374a03ef87b3d7ddf7380d57041be1a7a7660109b1a9007e9683c95d76dd1bc0af4a00c1aa83096c5a89dc1cde97b8374def7102cabb7d58dcf9c2869d5d5377ae97b620ae51bc3f5b3dd2408754f7fee727a51f8ac90471b51a2cffb51b61084ed7408453e2a49789ed68c329793b6d95918f1040534cd9e74ff2cf19f1a8f134d6091fe36aa0335778aac435f292a52c22e39a5b6ed023b1975936057d7bf0e44407290cebcfd8b5c8a5b88cfe2f4989dd1215cdccf63dce745a5e9d02cd5e57976", 0xe0}, {&(0x7f0000000980)="778f932869af8f1a7455ac40640fcbc98bb115f1adfb7f0079fd887204d8c62d98143c5883d95716fbf07647a8869f809c7561d6a0311df7a407990d973018a7bd6c37856c0a726ee646cfc973053cb07891f0e58c309fe36ec2c0e8c0b5dbaafcdbb98fb7df75f846e91a586748029716a2fe6c7576e31abf6a8136cea1", 0x7e}, {&(0x7f0000000a00)="b952968543b6dcf9d096bfaf35c7bcfa54afbb66f8021234dc58704885095fbd5075b5b1a0d614d9025f6cfa6a67bbaa18bcd5f32af621100f04cd4a29d43275c5ea4c", 0x43}], 0x7, &(0x7f0000000b00)=[@cred={0x20, 0x1, 0x2, r7, r2, r5}], 0x20}, {&(0x7f0000000b40)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000ec0)=[{&(0x7f0000000bc0)="35a09ca996c630411e9d47e50a81237301565420ab2aab5de93b09dde771047512cacd2a3c083938a27b69a656279d9e044748cc5b25ea5a8e9c862dd6bfeb7be5ba02cbaa24f6d070ccc2f751cccd96240d99d8a1c325e849d18e64c9eec740065beb834e1abe8aad1d6ee44f23d21a296c7774dfd3be3528e9116ffe0c0e1c22e8ced7ba615ffb186e175c881ac4cff3d1aca90f33ccb5d5f7ec8414b9f307dd8886a355fc4537fda7b1053adac83091d639c02daf53b880e3a09a66a6b8b24a890da8d0e4f6ff791413985170c05a97c01372a484eefbdd76d48c080294867483b71ccdfea4fd8fbba7fe5c50ec83f03d4e4699a74b72cd4ead399aad", 0xfe}, {&(0x7f0000000cc0)="6817a1cf228e6526723b06ef01f6ce8a67382f5f701f483223a27cb3a9f6229ff2f66fafbe780cefe872b4e01ce88e22562af7548fcb6872483257a991401232649e1f8c6a692acc1e6a432b611c76d76e89e4c043c2c7f1cca8915b2eb4123c0dddc5ad873c9b7d7b", 0x69}, {&(0x7f0000000d40)="5d1630f0967660d8fb5b229979e6f99665158016a86df0726746c30eef17aa843b6492f67afec9c731a90881b8eeb4d2e9f0650111c950b1a94163e5ed9fa9f04b3f5f114ff66dea24c6b93d39582a962ac0546131baa882ee97136e5c8e9c7620367091c0815391eb3d5d487bab293b4fdc36d17adbd3dc25babd9d803b17455b991ac92a5fb0ed64bd54335777a2530c0b527bf24f8322f11793f7d7ad6a891062f29d3f7cf1a32f8f88cf8e2de61eacd7eaf88188483f643d6972065618419df51004e6887a2a31ec2acfd281cdee86e81d67196fe2cf4d0b21691b9bc446042baed81d233dc17d889527a9c5f49c23605116", 0xf4}, {&(0x7f0000000e40)="aaf085e16539b2b3137fa1b669902d88f059e426d787593877f8d328fabec0b3", 0x20}, {&(0x7f0000000e80)="fd9e031f3d20330419c75e75c8155cc2d55f951dee6a6fb7494cf845a9eebe011ad444b040809f8015729ae96a14d7918a3574", 0x33}], 0x5, 0x0, 0x0, 0x840}, {&(0x7f0000000f40)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000001580)=[{&(0x7f0000000fc0)="7c4123c0fd80cb8da9853d59585f983cb5f1e755cb60d73344001fd0077d24eb07a8db8fb489054fd1386276a250ceb4ac329bbbfce45db17c1b3d9d29b5b37d3275aa98779772141142c2ad7babe74dd69a2e089de2277f56df076fab0cf42dcd2d601ae046925f1bd6236993bb035579cf2f7be577d1dd1dda0ad85ab56008891bbfd96f1755367187019417f0bff3604fe3ae0763b0b4f6", 0x99}, {&(0x7f0000001080)="b94ea47790c939b70408b5665d09a141a85f00dd476966d40f493b3a555f87f57e24b51542347ba546d05ac8ce6145367e667d02327f878ff4c9d8484f86e68eb8d6dc06ecb185f2e77dd50b6e35b1bc22506096f151720f06867a46c5aee87cdc315dab41e2cb48edbda4b40d63e95a922ec91801c20432af142a50c80d1733d356295f6d5ef9680eba14a91d346520e1d0ced695480cc07d5433f59b109874c699bdb8d973ecd8f4540ef4dc3c709ecee45e366bca8918f50634e83548b2546dfdff793913f77784480c62cf3316d8ea87dfd15387eafd9b1c5ed8bab4f0ed94f36bf0b9372462d35d", 0xea}, {&(0x7f0000001180)="292d85caaa3983faa1afb7b01d81de46d37a9fd493e26322efd8b33c354acf61cd7dea6c4297e3dbce33abbe5b20f6035219a52730d92b0f339335a6911629c03e7dee0fee0784624d55e5c1e295a0cdfa0f1e54a1a33f7fbb15af38b9bd746cafd8fd02cff787f67192ea2b9931e98b0feb1b4d4fd951f0d6784a965fbef23e99d7e33a9de4c5be74e0694b0cfac4e8117db1b807f7df75c39863c7cc0295bf7f57632b1900171e6e78ceacbefa95499d49d8bbcb3be3ad26d34235cfbccbad2756537199df456188e7c28312fd5c5d20253177747ddb778e8b8698c194dd6d72a10ab4053ab46a2069", 0xea}, {&(0x7f0000001280)="7c5062ee041d560e72e7792e179f86a16c30101d2b933d62a7182355f22046300f964027c6573b7e276cf9a43a264f223293210880f64bbce1b8fd51f8759564b4a1af683d28f6616f64113be814f251ba3bcd27bcad612b8652fa3e", 0x5c}, {&(0x7f0000001300)="776f3404ca16d7a46ff691a02226c5fc16180628cf8f260e1395038e63691d13e96eb3075d9a914ca6468751302997f3e1ff8ef32c50947a4d2d21ba56aa8793d1991451c68e5608f0b226fa391a273aa5d5c9252e48fb1836092a5efc528c2d9f15521ba60e0f3a081fecc8a3615f4b82ca69cafb5a6c291b622d342035d9c8af16827a96a43385ce4420272dd0d47f28c70ac0477bb75f418c7f9e7cc03a9bc3115dea84a57561dd65a81364", 0xad}, {&(0x7f00000013c0)="ec069985c80fe5ee25e5072f86ef95f3ba970741a992f12cfa1b818b0f2ee6755524ebd3b1c5953b99b4923682bd2f2d830a67dcd35ceef34a361acbf5c87cbda2c683d4c54127afd632c3ebfc388430512975efbe1551a0cc1b408a1ea083d6c79c595e3250e181ddf2f1324fd9d7e37ef55edaa26e64baf077b7f36616", 0x7e}, {&(0x7f0000001440)="b9cf81844707d3e38a225584dbe8f213d803e00cd278c554783c554d8c5118aafb5a52ceb49e440f7415744f1fdc09cf46a2c3354c9c9dbc7589e573ac8b45eb148102f3a310df318f165e5b8e8df97c6c5578b616a7bc026d5204ac6a", 0x5d}, {&(0x7f00000014c0)="a1551b5279dfd06994039508971ce07aedaf1c3df933bf5720014236e088069d58d0dc42e7d18e61f583178b32363679814f37cea0cab12908932e02c82464b086452f97fd048a0b3f7d0972d2b2f972b1820cf9e23d09b9742b20c20856f0c16078da7ede11f42effa03b35b9a0d939f22972d8e3973622bdacf1039cbf259c813a921b5152b4", 0x87}], 0x8, &(0x7f0000001600)=[@cred={0x20, 0x1, 0x2, r7, r2, r5}, @cred={0x20, 0x1, 0x2, r7, r4, r3}, @rights={0x30, 0x1, 0x1, [r8, r8, r8, r8, r8, r8, r8]}, @rights={0x28, 0x1, 0x1, [r8, r8, r8, r8, r8]}, @cred={0x20, 0x1, 0x2, r6, r1, r5}, @rights={0x18, 0x1, 0x1, [r8]}], 0xd0, 0x80}, {&(0x7f0000001700)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001b80)=[{&(0x7f0000001780)="7eb801e24c4b913bc9e513563cb464dc90d47b3201dbd3cb82d3cf2c67aada4752dac07d71ca87b1427e963812a8e1fca319011e4bfc7ff340ee59d61204c4ad378ddfd277f181bed1bc1b2aed32e098907abda3c2e4250c7e4dcfc9704ec363b43cd9d1328e46bac526133a806e529ba3ab047dedeac4498c0456b6756ad168984ed18ad32e79e65d149a06339896c3c81f63213e643fee5b00bf8c31911b889c0065e13d32764a2736002cd3641171f899e780b011e0b7154c27eab36a03f5e31d2e8320a026a458d342470e65226fe49547fcec6c55420fe56d25797535004da9992deec2cf48ed9144", 0xeb}, {&(0x7f0000001880)="5c8b3aa1085907472a01d6cee05366f2aa2107f83c9df3681bfc315368c4ac19b606e4fb25575b036139f7cc53665ae91f30151875d04e5355b39beb67d2c17041f628ccc77099aec3bb71999f977b49886a034172d2fb8ee45182a2e4dded9e37fae4b10f2e0a46914b70fbc4af59f0fa05fd400002d25ae12997898d4dd3e320765c26ee5bdd2b7184c47e9b3f5b4276a98c650c7c586cc9d53dba04f7f2aa237242d241fafdac11101c7fd246f8373556e965a19eb45ab592a2a3e5fe21add0033c825f436262bb02a9d080ecc240da3a6b0dabfee70baa9ad7b1f59c", 0xde}, {&(0x7f0000001980)="b000ea1c96bbdf4d650d9b1adea54dfef0a991e4ec26892688e65b8de0a07e3b6ec9d588995357692856283259d19ff3777e5c7777cb5aa385b2088ee440b4836996bb97587c", 0x46}, {&(0x7f0000001a00)="b3570c490b340c3775dd06", 0xb}, {&(0x7f0000001a40)="4df32ee0f07a0f091e1dcee8b469ebf9fcd7831e7cf61071a013b8de0fda4efee7d5263a", 0x24}, {&(0x7f0000001a80)="100b96921f32e749e6e0062a30f1a204668ab5b3e5935b799b815b3184520163becc8bd9787302dda62563fc66b5f5f7ae2a72501da3602665ddb3025ab7aee73d3f19c28d845779d85f0ac4979017fcb6585b0021a5b9eb7e6be3cd38aac079d8cfc5d0a6086382da6633e0726d554ce511853f155491d1a81c8128bd0b015a15dc7de6708b99e9ab54379f2e686b07c408dfffd175", 0x96}, {&(0x7f0000001b40)="c5aa79a7a14e773c11c7100db3235066778188a6e7be72bb06d86f2fb7c6cbcaa2915f575506bee211eb1166dc2889ab11b8d2da", 0x34}], 0x7, &(0x7f0000001c00)=[@rights={0x30, 0x1, 0x1, [r8, r8, r8, r8, r8, r8, r8, r8]}, @cred={0x20, 0x1, 0x2, r7, r1, r3}, @rights={0x18, 0x1, 0x1, [r8, r8]}, @rights={0x38, 0x1, 0x1, [r8, r8, r8, r8, r8, r8, r8, r8, r8]}, @cred={0x20, 0x1, 0x2, r7, r2, r3}], 0xc0, 0x4000}, {&(0x7f0000001cc0)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000002000)=[{&(0x7f0000001d40)="a4255a162b374ab141cb729cd745e22a4cee9985ac92fa2cb1ac687d06f91a256ea4096c43be435bce72192886cd4c61e0431746981d7cf9bc64c4333446e96ac876e6e194f5aa50a35bfa97470742e1f9d44569ac1f4d83b1a9007b17b74db9667ca6e72bb3d3414f016afa95e498129b228820c9e47b372d380371c5feb2c631eace3594aac8ce262738b63c6f966a65dc01d2c9f2e24cb75d1713acce035917fffab709a0beca58b834bb520adddfcb5b49e8064c5d314ef2dc3cf6bf468968c0884302063a628d1ca966c66353129d4b79e440e86422a06aca4b81d7fb5f31944bc27effb64679d38682e3c7006473", 0xf1}, {&(0x7f0000001e40)="64dfac8b4e8e97979af72f3bb771e5a483ea81f5674a67bb65bc452a82bb21116e87376c57fab7f008ba131bd50d6872547163a135152e42e33ad98d93c3f1ef7dc8fe59af5f44c14508f6096ce19e2d221603ed85564d70886be617d3337eabe974f47bc593202e5df181ea82474b817a742f5b36d4fa67f39940f3a025ef61ee042202f816cc349c2643ef67a1e06b31b4f5e11455c2af827dd08cb9733912dffb308c0cdf21dbeb814e8c09818b2f76bac09f25a94e467a0aa89f5f81ee3fc1756726e1fae4effd3c73a6964c31b6e5e1011e696514543cb4624d17e8d1c8741595091eb26b0d49d9bde6083b07", 0xef}, {&(0x7f0000001f40)="993d5f8fc9a620faff804adf7fcdb160a3058f3c29b9dda416659eebc8f094b61ec4198c9d81b8e944d12de969554cc546b655e730c4e54769ed9e007255c2ab9447bc06fa34bbe39aa602d9bedc502277344a10d39246e1f8464dd4fd5e4aeb742ccae11d87ee2607b907d4256feb8af9f6db695b00f21b5d8b3d2d49a9e234253547382ff774401cced91cccf71375a0e1079e5201600ebfae97aa923320315ff174113e5301e98823337fe778", 0xae}], 0x3, &(0x7f0000002040)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYBLOB="0000000020000900000000000100000002000000", @ANYRES32=r6, @ANYRES32=r4, @ANYRES32=r5, @ANYBLOB="0000000038000000000000000100000001000000", @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYBLOB="0000000038000000000000000100000001000000", @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r10, @ANYRES32=r8, @ANYRES32=r8, @ANYRES32=r8, @ANYBLOB='\x00\x00\x00\x00'], 0xb8, 0x40}, {&(0x7f0000002100)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f00000035c0)=[{&(0x7f0000002180)="bd3745df465f3fb8311aa07c2ffe2937b2885bf2db418f21697616d5f636e1363c399b5272889910fc1e8a0f51b8d3845bf7f2f405d1ad098f8b9b340893491162dc84bbcd824a3d42fc0611670835d45a6518e58eacd065ac7e1e7446438d19003eba64340b67571e1596afcdf48092a01784b7b0a88a9daf90412d84191b5957237c350671f8fe61a3caf09b5233542acc6c4da44f39848be6d220fae9bd1c811dc2b4976d8357ffd5960cf6a3b3f4b936611a2ff29eb8b03f1051d1cb4a04", 0xc0}, {&(0x7f0000002240)="8995647ea181f18f46863f0c97d0e61f6243404b3561d7642dc47b2d72760b368dabba1b4e9c800df82d3189705b70ace45771f558185bbc914f59e331a0c3f08fa89441c56da024d5487107", 0x4c}, {&(0x7f00000022c0)="24e4e0b9b40263c5615d832932e41b4d2e5ecc991ddf44e1ab60e6cac827173480e8266fe6e4", 0x26}, {&(0x7f0000002300)="55f06e40c2ab63b1f9c92a4099948882779d64933b2cbf67c1e9162b2d7268314d499600aa157734f1025ba3e3da4c6026129944ed27bfec520fc63f87897d060ac00c48817b283bb73698", 0x4b}, {&(0x7f0000002380)="5e4386060d1011c53fbd7fd45b3fff88ad77b2f712ba17828d13cd9c8f878848c9581b461f4fbae4452cdeba008776ebb58dbe57ec1d8789084529399bec3918c96e68bda8a59df4c53684", 0x4b}, {&(0x7f0000002400)="f0de64aec09eefe78a781409e36c511172685c28ffa466f2a295ca22b6d142448abdc77ccbbc25ae4c2bde536dcc2a40334a00c8738717ee233013708245d4009e4c9573f7d496693042612d5dfbc46bf22931fa13e4d6a53f9a5e1968ac68d6f9e7acd2b3317980226e5da12aedead024db733307b76926bee00d22dde642d29a0614e9c2b9c2245073729fae2128cf5c4812e5614c73ceb33270690f33927d0d5af122565cf3cf8027c2115fdba8d63ba6148c57c39491a3796e1d4088e4a2b09fe7924b1a501e72ed", 0xca}, {&(0x7f0000002500)="011f9882fc8ebfdebb2de7147c9a73a2796df43406673d9f5ed4394ff89fa960ea2158a68b81645ab2d77ebe9f0ebff6d1c4399cc959f6f282d801fcc170fa3df567b22c94a8554912d1431156e562ae32a5d69d593b7d23e8618373bf587fba245599436054d4726e701967838df9825f6ae2f0725b51993fd21c38c67c9d06e7c3758190dcdcfa36e02d3a1662c4709e47f9ccca8e5fbe8f11481c4ad1ebc523c8b6727af4a500e5baeadb931b41f89be343e97f970482619b9bc782d19dca722707403b2ae93134c1cd2c7798567f67d52b3222a96f698b7f57ea0061cf35a95171c1ee05520820251be6b5a8ab38cec28cd2abf2697dc603563c072b68e66ac97d3638215e2fb0ae8c4b32550be4a12d4d0aea2ddc0975bbd7fc8cb08c75fe1d51cf80668d4f38a3c1600ee5f1b82729a9e123928c2567fb59fae7dac5f68ff2d784fa0de0fcff92e9c63c7ff0cf9835673ad90b5b4c5ccde9c69f6ab2ff3eb92d1e66b256c443381c68b8eb3639bbaccc85f9ed122b5f8cf7a36fc9b6321d4ca3fbb9e0c40f42e47010fdfd000cbab1b354e63e9c7ae91e6ba64e204530c2afba6229f38d032582b3dee66c88bd076752743af6bf6125930716bae6880d23dc168ee9480b8b994fbfcbdaf254e29f72c654d5af21bdc79df10f8ea4f55244d2c854641cbd533f31bef24819c97b9e7f4b596ec1b98382a1488a4456d299229fe66845dff921e7ecc1374a29084e293c64844b21e418f2d4ffffbdd2032c0d708a951dcf8f287c446f0a6df5c0c0087b2babc0a3bde9430824e9232044cd61fe6550f6b0ea4fb9f89ed368051a4eda32a2766c8c59fb4c1d05d70f3709f2ef31b763c999ea167a43e26561120c2c6c32ee3485a352b5987c871507624c215b135258075e48c503de4b97b12ebf88f757e86d55afd246e843e13280f83bf6746cde47fd3c88af4c2d30c18bb1cf77d6984c149da6167565a8f673366626ac13a1aab2c80e692ed13ffb8aa3b368e77806cd88ea3be24a5db588854877f83ba515f45630b2a9589ef5d708725315949a3e9f93e2c3da4d65874d09c334dfed4354f2c54d13c19e3e6c7ddba5864f6d7c668866ff4a615bbc82b34408e7f47b76307c9fae355318dabf01769714516b0238a3ac3e8d381ba8d32e6f6b3c2b6a11793c19b113abde0f5feed991cf58138fedd11042602db0521034a6fed1ec85185769db98cabb09a9d869372c1a1cab1f3c3ca191a5a25fd251406e16ee880a4abe026e9b13f38a595adc96faf91b734a04f575ea9483afc05dd8327176244f7bcfdce27b35acd2d8d2091db171c8d42bdba7b7535888e47d36f3cf2b3eb00d3104b6b3c6f46b5aae8210af5f6d9fe158df27a3a0db3ac8bac9e26a535ae686341c018669ae4a242ecec685834984b2ed5969da94cc2d9376099b2629b884d74454a0c98670c7ffcf186634754cf2e65495c82dbb0d75e632458338c22d94724a92f472ae0bd5fbaa7c4e8e365cca93ed3c84524fd0f21ab6cbcf901a8d66963eca8d08c9fce0784d67c5768935b7c9ea5cd3abda6a972e8057e9333063687bb2765617f03c81159d14477fd0071f15c17cdcb4fd7ce3aedda8d7270a3047291baad1597121ce1fa3415cad64d7ae9086766ac31258fd36927d4300b63ec67c72b055eb26d5e33da75f3041388cc5ff811d46486ed430f8efdea91955bb63b705e23f70513d6e02285f9c55e2386a1d401f393c5618aa03d635971811ab8efaf5aa382e02e8a03ea70560939913e2dddd1c8a56363cf433670f00477ebe3ff91fcba066161c7c7ac1a6cb27d7f8305a6f91683e6f9de62da8c58b9c9a9cf80587ff48913c243b47252dd026eb2b150c79171bdfae905533b1320196062f976fa8e192b404f82891108dd441e3302100d4dd5e70cba34946ff9a7089ab6923fb1edc2120be9c09d59bfd338eb97fd1e4e13bdd566151973e9750584f67c58295463e1c8ae95095bd6ddf1e6f3b5c9b4962bf5710e7aa3c76f2d1b1c8ea8f41bf0ac28f1bd6bd370c968157d4cf0f51556a43c1974b5386364ddc062f122411dd57eaf9de122adddad05916d633716683f34284d015f39c405468ceb2436a42b5db438ed44f49a3045db3cc91112d1fd9ffea2023c28598619b8038d20abe625dacb9ff058ce20ecd05702db2b846926bd4c683f4be9f01f9b0b576f7658806625f26442f33daf894afb974ea0a3a7e50e5aea3e86c77edf61108982481d1b249297b9e858df9b5830177b885e08ae284c812bc2781328c9f9bacb4fdfa6708665474a7e4e093a3195e66cfe5d59d4f7790e70adc2d34823b1a1e35f5bc4df21b77d6ae8c61364d42bae5de8fac315970d1cb906b5bdc6b4b893c6f39fca1f2d914f0c7200cc7228addb8483bfea2592b1bdd6e6a866debb7637fb58738378a04ccc15ab1d4cd68234a955cd637323ad359339ef65af6d9ba82a88020067b9b822dc49bf5f1e3124082b116328af1fbc92b4606a12c4c803681a1b483d0d7aa918954d646f8a6c340c0ccc1705ed0bde37bf2026ed9bddbfeacae8a826d1cfd984d1337d4312ca229594c0a582fd0a6478298629a48dddececa46d18696983473fb1ddda5d10db594fc729c313763af8f66b3d1d4c1822c1c9302bf37442083014f6978d344feac4d4667d38cf52ac177f7bdb31782c6c04bdeea036982cea3d776d9784601697ba869eb452121d25a6c3393b65c1cb66afe75bc7ce4be43a0025264809564846d7cd95d7e52691ea1c6b7726093c4560d22244d42f3a4219d77083dfe2d06904287b4960e6e070a1c6c40a917bb036c0b0074a3e4c39bb9c7801176be8747f0b3469aa017bc7ca1c4fe4185d5829f2e5a0512337901c2ccb1068bbb61dc5e645816b8d8768392222d15d54aec229a7edd111dc6fcd49570ad15ce74d11498b697ac57c284bef4d39ff1dad2e44cc7ce6df79127ff4dc37285818a106cb2e3ece23c8296d8e2b4b572345e1c41a02b6a6e51143544a6f09ac15c4965b95eb7d050318dc0b4787dd78b58c8d25d377245f75c02bc5e3814fc8c219e3bede6f17a5a700453d50da3001f88851ac2e5bdee608db0010fc6f3d31c83e7d1184355d23a6c762d415d6fa0c869140e8b01c7f12309288d5a78b97184f63b5e574126676f6c88f4331891f3982e5e121a2c6189cc5da5ea8ccbbcfa259443ee3578f250aec6e6533290f4f42a994ba2e21964b23c3c8309da145d6e7ad8ee09a5e14ac2b837bd5a6f77a31cf8cde4fa26e84a4a1bbc966d60aebb1d27f9d630fbc0ef03a128a6799d3306cf4307486c6b2c0b72711954d8e38b399055cdb676c7d530da0eefa8a85a893ebf3bb1c790b299ff642363dd361aa9b95f47fb8835623947eeab2f1ed6a5a376ae7e3c4f4bd3921b93cefde0174321947b6fd96cffa68e64156e50a90d158d08ba430eb901d636c4d04924b7d6da6ba6d8741aa663bf94f273825cff4c33462aa2638236b9a5dac681eece6e3665867df3a217d28de2cfff743e6a70fb1a50a37be97bb4ef75da07e7b34e578b5eb5e634cb0f07d7591b96dd313548eb0bad9d16665927f94a522f5c4f23826337f0d494f67cfdcb38469dd12e1599025b4332ff35324b4f9c6a3858e4dd85004e13984094000ae2272c798dd1cf52a5dc67b8d88967a2edebfe2cfb0316cb8b3c38edce50557d07f4b21cbeb80bba6c945f2cfd8e97528bf967048ae0202321a91d56efc5c76d296d10fd587adc3c53baaccce6741d467557fcb82400c8f61aaa3b1324c34cb120606c49b33f26bf64d538f5336c4aab504c6e5cd10c0078a85ad8008e3cce1f25b3ba22a60cccbb8fb88f21180cd336e703eafe61c5969144f324e1ebffade8f0175daa17b27b8f23aee25d084c6aea2fc45415f7d04126ce342e4d2f9c87b7a2d567556257b8a12c9901b505bc512ac9bc1609f66ae23757b1fe81b9994d2a403da02469c8c551c4c0a7919cfd0b8b89cd0037c1db57a3f47b15b5b7f67190a391c3d2a7c56cd2b818df07316ff313240f88b545ea77badf709862de6ccd56d866de4fdbc1ea69fe1b312d17679cf85f20586558fa3c159481f2cea7d67da0f86d4429bdc29d7b92994c394ebda9c19312b75b1814114a9c0176caf3e04b4d413546ff5a4ca642934db10b572b0cb91c4c6bdfbacc94fea2f00ec84a0122c073267c496bc1b4a8d23299973b40045ed1bfb31e460ae903d53972ee6913950899214ad9a990e36c37e76ad25f274ef8bc8233f179149293d244425ecce2b86a91be296a8448794f3b5c3ce9903d56898dd89a379f860e8e7c983fda2a2063b4e95eaf8a8c52692f6b9edba1e43cd006d01b0421123737fcb64a3d9b33b4d0986e59cd74762b4b53bd451e919f33ab60067d98aa85f51cf8306efe13d24176ca6c40a565e77b3362c58c0eaec83794c6a12a953a9efe444da1eff0c62394656730a6be2a946e943f71d8b3f203d922cd3c62a59d0d9b479ec9a5318dcd4fc78ce8bf8b442de867b62604ba4f545b833938406242037017317fcc3a7f5bada913aece692a97c6870193021c0c57e154adb9da2b07298be4d652ef88895d03ad2ecce2bc0b9922463cbe82055962865a0a6096d96fd97287fe1773fb8e96acd86e5929cce6309fd4f7680a3976cb168d08b6ff1bfa7684c022a9145ccb255f5c7c3d48fb41446b429e470bba57e7fd574bb8d45c114f22e4ad228f80c6a09125c01e2dc61bd48ec65aaa99a846e79e9e005dc26fc445b8521a87ec924d2e27ea4d356dd2fb013e974991312403d0236b408783499bcfc9b28b14c30dc8471661d503414eff036450080d48808cc42e20ef3530de8006eb1289ba868e6be8746ac55e00354d627a6d00b6a9ad63fdc062ec9b7175d12fa4a24627be6699bc21b15b9f178f3d03edd9164db0f952e7f7a509340633c125d4db1c8286d0c3e2d5824c1bfe04e8c9c707766f9f28d74606c44041833ed520aa6ce33e354cf939aed49b40a79633bb80b41a4cc97e53baa365f4bbc50887b3c59e77e777d38477edd7002f334986bb2b2d935442ac980b2abd2e3bf066424b2d6f17d8b9f9246b7c05f06d03ae06a1328f1c958d61dfeeee8ae142511e3f306722999fecf874289f082fbe862cf30dbe078e76c4d5238b84b07825d0a5718210cc13e2d10c4e2434d8549e370dd5ee39f81d29ef64f205171d31f1076261373b6007534ae3b44094c78e4902a554ab513ed0ced8182e9e93d47042f7aaba427f739d6eb4bd7fa4738bcf2c40d65c4c620767d2356d2fd050e8538535512d3c473a7a053d761de64d5fd5aff231c730b9134cf53678d39d05a2beafc09b12831165d01ba12df6260d92ad00cdc86bbd876093e8f984a155bce70ddca3e999a4d3b134e68748da0063b613c324efa04d3ac6317904832a66cb9b91db5a3a7211a0018082ddcb099bb9598910f8fcff64926a2d99de125caac5876687467288792831a790901bf88bc75de30b0f384fde055e8ba4d963c38bb5a8bf2fd981a378cde0b1a2d38ffb82e800edc02111e9ddc4af141f9c28f34b7b7f9029fb485df8d3e71bada9b605832ad73b5fb72336f0fd960aa0fb90ca52df942451b8c7ea0dfe6bc6bc6026465589e00add15f2acf8dac904cf92b88da30fb4125376dca626ffee1b2be0feb4453226eb94d43455918d5047c385ca3a4c073c94068d7237b34242ced384a1604807ca01bfe40dfe8df1111b7ac9042ab789fa2e1e769ef81060cd87524f9240c20717", 0x1000}, {&(0x7f0000003500)="e1ec877de9ffe4e0d930d2a56ceb1af7e61475295748b74ac866ffe818b78fe043043a1816711fabb4120f5ffa9a0d4ecd1ca9d175a862e6d74c0a7e61c70d1d7a2e082e437d700ee4d69bf1bc18a91396eb147c7c4602775ddbb163b6d7f2795f3dcea66035f34f6b9b26", 0x6b}, {&(0x7f0000003580)="de27635c164cdb87cd18c09470516cec93d702ea9088ef7ca80e89a5f30e0c1a8d7ef6549d129735f79970b96a5a0f53ab7dabd4a8158ce28a9283b2", 0x3c}], 0x9, &(0x7f0000003680)=[@rights={0x20, 0x1, 0x1, [r8, r8, r8, r8]}, @rights={0x38, 0x1, 0x1, [r8, r8, 0xffffffffffffff9c, r8, r8, r8, r8, r8, r8]}, @cred={0x20, 0x1, 0x2, r7, r4}], 0x78}], 0x6, 0x80) sendmsg$nl_generic(r8, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000080)={0x1c, 0x2f, 0x119, 0x0, 0x0, {0x3}, [@nested={0x8, 0x0, [@typed={0x4, 0x8, @binary}]}]}, 0x1c}}, 0x0) r11 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x2000, 0x0) setsockopt$inet6_tcp_TLS_TX(r11, 0x6, 0x1, &(0x7f0000000100), 0x4) [ 285.863794] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:17 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000480", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(0xffffffffffffffff, 0x8917, &(0x7f00000000c0)={'bond_slave_1\x00', {0x2, 0x4e22, @local}}) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x100, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(0xffffffffffffffff, 0x80045301, &(0x7f0000000080)) sendfile(r1, r1, &(0x7f0000000040), 0xffffffff) dup3(r0, r2, 0x80000) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000000)) sendmmsg(r2, &(0x7f0000005fc0), 0x800000000000059, 0x0) open_by_handle_at(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="4e74cddbc75bbb3df9dfc1f159192926b3be8f827dc58e05b94050f115c1ccd828728a8318f8079700ba698db258099dcf1d7adcdf2131a54b2c"], 0x1) 02:06:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:17 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:17 executing program 0: socket$inet6(0xa, 0x401000000000002, 0x0) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:17 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:17 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="ffffff9780", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:17 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:17 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:17 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(0xffffffffffffffff, 0x8917, &(0x7f00000000c0)={'bond_slave_1\x00', {0x2, 0x4e22, @local}}) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x100, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(0xffffffffffffffff, 0x80045301, &(0x7f0000000080)) sendfile(r1, r1, &(0x7f0000000040), 0xffffffff) dup3(r0, r2, 0x80000) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000000)) sendmmsg(r2, &(0x7f0000005fc0), 0x800000000000059, 0x0) open_by_handle_at(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="4e74cddbc75bbb3df9dfc1f159192926b3be8f827dc58e05b94050f115c1ccd828728a8318f8079700ba698db258099dcf1d7adcdf2131a54b2c"], 0x1) 02:06:18 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="007a000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:18 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0x6) r2 = fcntl$dupfd(r1, 0x0, r1) write$FUSE_NOTIFY_DELETE(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="29000000860000000000000000000400040006000000f0ff0300000000000000005574049800000000"], 0x29) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={@mcast1, @empty, @dev={0xfe, 0x80, [], 0x19}, 0x8, 0xfd, 0xffffffffffffffff, 0x0, 0x8, 0x40, r3}) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f0000000200)={'syz_tun\x00', {0x2, 0x4e20, @dev}}) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp={0x18, 0x1a03, {0x0, @rand_addr}}, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) 02:06:18 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:18 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:18 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0074000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:18 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:18 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0800000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:18 executing program 0: clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(0xffffffffffffffff, 0x8917, &(0x7f00000000c0)={'bond_slave_1\x00', {0x2, 0x4e22, @local}}) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x100, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(0xffffffffffffffff, 0x80045301, &(0x7f0000000080)) sendfile(r1, r1, &(0x7f0000000040), 0xffffffff) dup3(r0, r2, 0x80000) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000000)) sendmmsg(r2, &(0x7f0000005fc0), 0x800000000000059, 0x0) open_by_handle_at(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="4e74cddbc75bbb3df9dfc1f159192926b3be8f827dc58e05b94050f115c1ccd828728a8318f8079700ba698db258099dcf1d7adcdf2131a54b2c"], 0x1) 02:06:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:19 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0x6) r2 = fcntl$dupfd(r1, 0x0, r1) write$FUSE_NOTIFY_DELETE(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="29000000860000000000000000000400040006000000f0ff0300000000000000005574049800000000"], 0x29) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={@mcast1, @empty, @dev={0xfe, 0x80, [], 0x19}, 0x8, 0xfd, 0xffffffffffffffff, 0x0, 0x8, 0x40, r3}) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f0000000200)={'syz_tun\x00', {0x2, 0x4e20, @dev}}) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp={0x18, 0x1a03, {0x0, @rand_addr}}, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) 02:06:19 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:19 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="002d000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 288.172261] EXT4-fs: 10 callbacks suppressed [ 288.172272] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:19 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0x6) r2 = fcntl$dupfd(r1, 0x0, r1) write$FUSE_NOTIFY_DELETE(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="29000000860000000000000000000400040006000000f0ff0300000000000000005574049800000000"], 0x29) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={@mcast1, @empty, @dev={0xfe, 0x80, [], 0x19}, 0x8, 0xfd, 0xffffffffffffffff, 0x0, 0x8, 0x40, r3}) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f0000000200)={'syz_tun\x00', {0x2, 0x4e20, @dev}}) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp={0x18, 0x1a03, {0x0, @rand_addr}}, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) 02:06:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 288.268177] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:19 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100), 0x0, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:19 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="f8f73f0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227c, &(0x7f0000000200)) 02:06:19 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 288.743466] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:20 executing program 1 (fault-call:7 fault-nth:0): r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:20 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(0xffffffffffffffff, 0x8917, &(0x7f00000000c0)={'bond_slave_1\x00', {0x2, 0x4e22, @local}}) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x100, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(0xffffffffffffffff, 0x80045301, &(0x7f0000000080)) sendfile(r1, r1, &(0x7f0000000040), 0xffffffff) dup3(r0, r2, 0x80000) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000000)) sendmmsg(r2, &(0x7f0000005fc0), 0x800000000000059, 0x0) open_by_handle_at(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="4e74cddbc75bbb3df9dfc1f159192926b3be8f827dc58e05b94050f115c1ccd828728a8318f8079700ba698db258099dcf1d7adcdf2131a54b2c"], 0x1) 02:06:20 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100), 0x0, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 288.810759] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:20 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000004c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:20 executing program 2: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) ioctl$int_in(r1, 0x5452, &(0x7f0000000180)=0x6) r2 = fcntl$dupfd(r1, 0x0, r1) write$FUSE_NOTIFY_DELETE(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="29000000860000000000000000000400040006000000f0ff0300000000000000005574049800000000"], 0x29) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={@mcast1, @empty, @dev={0xfe, 0x80, [], 0x19}, 0x8, 0xfd, 0xffffffffffffffff, 0x0, 0x8, 0x40, r3}) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f0000000200)={'syz_tun\x00', {0x2, 0x4e20, @dev}}) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp={0x18, 0x1a03, {0x0, @rand_addr}}, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) 02:06:20 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100), 0x0, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:20 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 289.173907] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 289.228721] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:20 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fffffdfc80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:20 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2279, &(0x7f0000000200)) 02:06:20 executing program 2: socket(0x10, 0x2, 0xc) r0 = socket(0x10, 0x2, 0xc) write(r0, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f3e9000008000100010423dcffdf00", 0x1f) socket$xdp(0x2c, 0x3, 0x0) write(r0, &(0x7f0000594000)="1f0000000104ff00fd4354c0070000f305030008000100010423dcffdf0000", 0x1f) r1 = socket(0x10, 0x2, 0xc) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f00000001c0)=0x5) write(r1, &(0x7f00000000c0)="1f000000060000000000000000010001756b5af7b7f30423dcff0844000000000000000000ced559fc9d3b0e5a5cfc6f121a3f2c2d2123a189c62fb51a8d069accf3c227eb6c63396cda0d48fecf2c58410c8e4f92be449dc7c195572ea49ec4cf162d266926fc359f23718ceb6438e63d5e95ef1cf5b7cf71ce3207c9d5275521eb16982b46055d1388c5ecb85255ac9c4a9cf9ea4933f381bc74c495b796ee71f1cb2baa8409bb7407964ac7bac681aa5083", 0xb3) r2 = msgget(0x2, 0x40) getsockopt$inet_mreq(r1, 0x0, 0x27, &(0x7f0000000000)={@empty, @broadcast}, &(0x7f0000000180)=0x8) msgctl$IPC_INFO(r2, 0x3, &(0x7f0000000080)=""/45) 02:06:20 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{0xffffffffffffffff, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:20 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 289.571773] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:20 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2276, &(0x7f0000000200)) [ 289.614531] netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'. [ 289.633971] netlink: 11 bytes leftover after parsing attributes in process `syz-executor2'. [ 289.646096] netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'. [ 289.655099] netlink: 11 bytes leftover after parsing attributes in process `syz-executor2'. 02:06:21 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2201, &(0x7f0000000200)) 02:06:21 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="4800000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:21 executing program 3: getitimer(0x1, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0xfffffff0}, 0xc, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="2000cf49c428060e908f94d7d6e6a72ffa2300000c0009000000000000000000"], 0x20}}, 0x0) 02:06:21 executing program 2: socket(0x10, 0x2, 0xc) r0 = socket(0x10, 0x2, 0xc) write(r0, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f3e9000008000100010423dcffdf00", 0x1f) socket$xdp(0x2c, 0x3, 0x0) write(r0, &(0x7f0000594000)="1f0000000104ff00fd4354c0070000f305030008000100010423dcffdf0000", 0x1f) r1 = socket(0x10, 0x2, 0xc) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f00000001c0)=0x5) write(r1, &(0x7f00000000c0)="1f000000060000000000000000010001756b5af7b7f30423dcff0844000000000000000000ced559fc9d3b0e5a5cfc6f121a3f2c2d2123a189c62fb51a8d069accf3c227eb6c63396cda0d48fecf2c58410c8e4f92be449dc7c195572ea49ec4cf162d266926fc359f23718ceb6438e63d5e95ef1cf5b7cf71ce3207c9d5275521eb16982b46055d1388c5ecb85255ac9c4a9cf9ea4933f381bc74c495b796ee71f1cb2baa8409bb7407964ac7bac681aa5083", 0xb3) r2 = msgget(0x2, 0x40) getsockopt$inet_mreq(r1, 0x0, 0x27, &(0x7f0000000000)={@empty, @broadcast}, &(0x7f0000000180)=0x8) msgctl$IPC_INFO(r2, 0x3, &(0x7f0000000080)=""/45) [ 289.905096] netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'. [ 289.929828] netlink: 11 bytes leftover after parsing attributes in process `syz-executor2'. 02:06:21 executing program 3: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x400000, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000240)={{{@in=@broadcast}}, {{@in=@rand_addr}, 0x0, @in6=@loopback}}, &(0x7f0000000080)=0xe8) socket$pppoe(0x18, 0x1, 0x0) ioctl$NBD_CLEAR_QUE(r0, 0xab05) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup2(r1, 0xffffffffffffffff) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="2c002787b76f4bd096c2a4d5e4f900deb27d553cf2e1ea097e7009f8ffe14b2065d835a5943a0af4772f862f144c8d220f1a73a87011335b5dc0621bfeff59d1494807d3ab4d8a045cf9c3867e305e4bafbd0a5d65e097c00b0ca004a7730f90154b3bd5f2a7c04958abf04a5963ce485eb72e175d623f18b6b46b0e23e400000000003ef17bc1a2273611205ee52b44a3ccd202bb61fb2dfc"]) 02:06:21 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 289.965888] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:21 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{0xffffffffffffffff, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2282, &(0x7f0000000200)) 02:06:21 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 290.069263] 9pnet: Insufficient options for proto=fd [ 290.075002] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:21 executing program 2: clone(0x79804100, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) seccomp(0xb6a1ae75b39de3e9, 0x1, &(0x7f0000000080)={0x3, &(0x7f0000000000)=[{0x9, 0x4, 0x100, 0x7}, {0x7fffffff, 0xffff, 0x5, 0x1}, {0x1000, 0x7c77, 0x1, 0x6}]}) 02:06:21 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="ebffffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:21 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x210000, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000004ff0)={0x2, &(0x7f0000002fe8)=[{0x4d}, {0x6}]}, 0x10) fstat(r1, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r0, 0x80045300, &(0x7f00000000c0)) ftruncate(r1, 0x101) 02:06:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000080)) gettid() fcntl$getownex(r0, 0x10, &(0x7f0000000200)={0x0, 0x0}) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000340)={[0x0, 0x30030000, 0x0, 0xec020000, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff], 0x6, 0x3, 0x5, 0x5, 0xffffffffffffffff, r1}) setsockopt$RDS_GET_MR(0xffffffffffffffff, 0x114, 0x2, &(0x7f0000000180)={{&(0x7f0000000100)=""/22, 0x16}, &(0x7f0000000140)}, 0x20) r2 = creat(&(0x7f0000000240)='./file0\x00', 0x1a1) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000280)) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ppp\x00', 0x0, 0x0) mremap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9000, 0x0, &(0x7f0000ff4000/0x9000)=nil) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) ioctl$LOOP_SET_CAPACITY(r3, 0x4c07) syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x87, 0x480002) 02:06:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x4020940d, &(0x7f0000000200)) 02:06:21 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:21 executing program 2: perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x1c, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e02e2be389de133945a385bd81e9bdeeee03000000000000005b540745df4b1dee483b157624c5bc719a099e6a3509000000398c34", 0x2761, 0x0) socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="e2"], 0x1) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) 02:06:21 executing program 3: keyctl$instantiate_iov(0xa, 0x0, &(0x7f0000000580)=[{&(0x7f0000000280)}], 0x1, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x40, 0x8000) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f00000000c0)) r1 = add_key(&(0x7f0000000000)='encrypted\x00', &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0x0) keyctl$describe(0x6, r1, &(0x7f00000005c0)=""/4096, 0x1000) 02:06:21 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{0xffffffffffffffff, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 290.378063] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:21 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2285, &(0x7f0000000200)) 02:06:21 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="003ff80080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:21 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0x4008ae89, &(0x7f0000000280)={0x77, 0x0, [0x4b564d03, 0x1]}) r4 = accept(r0, &(0x7f0000001440)=@ethernet={0x0, @dev}, &(0x7f00000014c0)=0x80) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000001500)=0xf, 0x4) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4008ae8a, &(0x7f0000000000)) 02:06:21 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f0000000000)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000000c0)={0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000580)=""/181, &(0x7f0000000440)=""/141}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001900)=ANY=[]) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)=""/236, &(0x7f0000000540)=""/57, &(0x7f0000000040)=""/70}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000006c0)=0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/route\x00') bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e21, 0x400, @remote, 0xfffffffeffffffff}, 0x1c) r2 = socket$inet6(0xa, 0x1000000000002, 0x8c2) ioctl(r2, 0x1000000000008912, &(0x7f0000000280)="153f6234488dd25d766070") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_int(r3, 0x1, 0x4000000003d, &(0x7f000059dffc), &(0x7f00000000c0)=0x4) 02:06:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x5450, &(0x7f0000000200)) 02:06:21 executing program 2: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000040)=':pddp0\x00') 02:06:21 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:21 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001800)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) r1 = accept$alg(r0, 0x0, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x0) openat$cgroup_ro(r2, &(0x7f0000000100)='memory.events\x00', 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000000)=0x0) move_pages(r3, 0x0, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], 0x6) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x0, &(0x7f0000000140)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) readv(r1, &(0x7f00000007c0)=[{&(0x7f0000001d80)=""/4096, 0x1000}], 0x1) 02:06:21 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2271, &(0x7f0000000200)) 02:06:22 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000580", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0x61) ioctl$TCXONC(r0, 0x540a, 0x2) r1 = socket$bt_rfcomm(0x1f, 0x3, 0x3) bind(r1, &(0x7f0000000000)=@ipx={0x4, 0x10001, 0x7fffffff, "d98c5ceffb1a", 0x26e}, 0x80) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000000c0)={0x8001, 0xfffffffffffffffc, 0x5}) r2 = syz_open_pts(r0, 0x2000) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000100)={'IDLETIMER\x00'}, &(0x7f0000000140)=0x1e) ioctl$TCXONC(r2, 0x540a, 0x3) rt_sigtimedwait(&(0x7f0000000180)={0x8}, &(0x7f00000001c0), &(0x7f0000000200)={0x0, 0x1c9c380}, 0x8) 02:06:22 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:22 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0xc0045878, &(0x7f0000000200)) 02:06:22 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r1, 0x410, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x50}, 0xbffc) sendmsg$nl_route(r0, &(0x7f0000000780)={&(0x7f0000000040), 0xc, &(0x7f0000000740)={&(0x7f0000000600)=@newlink={0x28, 0x10, 0x703, 0x0, 0x0, {}, [@IFLA_MTU={0x8}]}, 0x28}}, 0x0) 02:06:22 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000780", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:22 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b80)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x6dae, 0x100) r1 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0xffffffffd07ebfa0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x3) memfd_create(&(0x7f00000001c0)='selinuxproctrustedeth1*mime_type\x00', 0x7) r2 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000680)=0x0) kcmp(r3, r4, 0x5, r1, r0) r5 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000200)="b2836b3fe4582edb453221c312334454fdc4cdb83ca6a6cac64956324b397cfcaaf21fc17db7672158c799e440d8a872d6477cbec9eb5b24dfd0c50b3d1b94455e57b315b3b0048dd6787f251451f3043d259962756e0e18e74995d882d3a815e3b45a2ccd6be132f6c9cfd4b5ea472a17e95f975fb2c5fc71cf6db8003c3eb886e7", 0x82, 0xfffffffffffffffb) request_key(&(0x7f00000009c0)='cifs.idmap\x00', &(0x7f0000000a00)={'syz', 0x1}, &(0x7f0000000a40)='{@\x00', 0xfffffffffffffffa) ioctl$sock_SIOCGSKNS(r2, 0x894c, &(0x7f0000000140)=0x9) r6 = add_key$user(&(0x7f0000000980)='user\x00', &(0x7f0000001c00)={'syz', 0x1}, &(0x7f0000000a80)="4f9ea7d81467d2cbccef1eb4198b47531271ed1202c2c20efa03511fc3193cb7213048cb964d8630b1e9d2517326d045542a189e34881e7013a5ed858daadc23da27953abc99e1bf18f7e1b1fdcc3cb88c1679becf489a8e8ea7b7441c67c2535559dd8166daea8cf20201686e18c76614d6b244834fbf7c625cb56a8f9b676e9fab151ac2e3ca93d97b80fbe652ea8ab4141dabb35b46fc00472a4ed88b32af9addecc6600327b1597ab950a8cded0ee113291588c05c716488f6a2fd789ba234799a0be562a4cdec", 0xffffffffffffffcd, 0xfffffffffffffff8) keyctl$instantiate_iov(0x14, r5, &(0x7f0000000600)=[{&(0x7f0000000bc0)="e4581848e134beb24536542b59f8012c921c843945b2a4f8940dfd542681fd7026053c42a3762c800bc7e20bf61962f9cb3b74b422c0dddad4372c93eddbee797522c57e3ac69c0591fe4bfeb8250a4d8068149e18fd77e6a4b3d79e9bc0d66132b89454fc0e49df7965971013961011912a06f1ce9abe165513b39906c38a46ee70075d686ee9dc8030b9157004333a8be69b050da975578c4c7cab5c3acdfb9f1aac3b039ba9c62c548342a3e886474e21abc5f18872b5c19e0bc952558ca0673f7af8a7d0399a7d0728747666dd473f9d5e4df12ed5e3d7970bfe96d0faae33522dd286c409e967af08558b781edc11d19d784d6a5cc38789217866153db5844930c6a92c724366420709cfe069f01c52c4625fed04bfe3d9756c39e71595726e7e63ffaf27c8cb794622c465c11a7fe49a21a8c42f2a85fb97ef518aa0175dc6315aaa4276e11aa6748349b79b51e8c927bc4c704a3032864523a1ff8ce12feddbc387ae9656e77be54b2c949e8b1f8a7517bed094255c4b6c729cf0a8e970758c6685cb80ddd4d585a366f3fa28bc6014636dbe7cd34b84dd2cb1a72e7a936ef7f458b0dd24125878b9c8ea47f1bdcc1959a7cc87ddde380489016332282c77183af18e7611ac1751fcaad4c759221ac3e5378c296775c2394a378899219b3c622b062ed57bae9de16230e10977abdd444d94047c700abf76a23acb50c74fe7181a361756b7e86759e684a330d1fae2a1e3dc5ddc76d03dba872fe4325df459775ec5d55c13d7cb230b44bcbabdaa5622d98fcc1b08fbc24315f67a50094497cefab90777f527f7cb05a851c6ded0e3ae5588aa2beb5a48bc66c77ef37fa9001109f00b228f6787b19f1ba32b1efdb42721752ca62b64e4d00bcd2a04c4915ccd188eea51a0ed3e57628cfeea7425e42aae2662a654150169737f546c6f4a82de4e2909c30ed196839651bcf5afe3a70c0ff2d09682d8eaf7137a9e4c79a952211668f1ac0043764818201275c3523368e6d5b0a4cc255fb157bf341ab5c929772c542168a9972ed8a94e6ac3250837426fd57b8561c82a483d9cfedda891581848e83dcaa9c58e011a8bc1129fe9fbad0aa3a9cc1856f430ac3c1144981174db48b415f75a7df9b131ed0c2b71fb52a7698c9ab933aae2cab9db3e6aee10d828a99d98b682b70317ce8d155761dae20f1c6415cbfe7e486f311ae5074b2700aa5782faed922e62528b47316e0fd26e6271f7f5ca0669dcf3ea8731389d8c7c1726d19df472a4aa0695708e4484a92b7d75ddbe15d69b842ea8ed2c16473a563fd4f09d44c1fb8984b22a1aa65439723e2abe743af59417ba2595dd9d249cbf6b93be88277dfebd3624a7192a6c031e69dfe6fc17084bafe8e409c9fce538df99eeb1558d78a2aa02174ab95dd715de8ce5ead0f5b32e755a8a517de45693002c9b20b3a098ba40e41128e3ef9b75abb1c015701ba9e1ca17037ebdea3f1701369e9819bb782fa7f0da80036a66b2d55a12d4de7c6c1db743e9ba872ec6ae5d7eae98611567d18c45fa9be5b516cb5425bcad1909c1412ea5529adedca749f3fc4533bacdb366d82ff4d54ab7012ec9e486b45f71becfe9e98170798e63694acc28465408a1d28ce837a741eee3f3af56a6f3eda5f034e8bffd0fc197891b7825377c54b33ccd6789d6f9b40be62be9acc77e1b889e0ab7f04c311e9a50544b7c2f36e104a17c45b7d6c8c0fc9bd8c3e0e1c065b38b62cfc8034eacddbbc8d137f7ca389c0446a21275e3f33d21ca628dbf5157a9a27a0b1d816cb629a759f42db6efaddec64ab10bac46462dc7fe9f101e6bb7367883b2535eaf755d98ed97c119b2c1715f1f29e23816f3803d727fe80b4e3de6e0d8e0ffb00f9bb834902a01ae343c88149bf56092547dac36fef1cd542a1ec3dd911ac9e2f8788e476ee49d0efa77c3ce4f43493013ac7ec6a2f6fe9fef00d223a796846b0519e2c8760a11989cacb9eeb7811ad68e9beb8ab611b458c20088b2849c46c4761230febb1c58f33fa96f5cf34cb64d126623726b2a958a4c475331853d99a3bb000032e7d5412ec26cadb7015c43377ea02e6cbeb7bc742400e76d7e70303e07015e8918efeab27eb5d7583568643991933187e7464615b6e00e3889754affa1fa3b787809377d5c9518a52cfebe479c120a621a981feb2b2aa372de05d6a189e46bc9876933cea792343435b9d6fb77d9e161b75677a816c9c9bc0e070eeb0112d8b91c0b6d9a60dcb6888bdaf74a6a6c72ce121d0fec7f29f0b68af57fb11039d33f362a8ced07cab77e1e762bf1c5e81304f21fa5b27e1620a4996747c7eefdec95c7d89596b9aa7902cb9771046e6f80959dd01ce6761918d6a6fb6ad45ebc629ae734bf4cbad867593fc996e2a92c28fc53e0d9060d486bb18b999e502cef0d6d666870c84519faba0ab4316eee72022efccb5bf68d332a7da0eadeb3b00c0397b68adf03c82ca1b9fa67a8d780f6e551386e96dd9f23a50b40f56573fa291c4d000d7dc369691cdca0124b44b3ace1666124d0b599e534225c1c4bef6636625fad96c755cd2fcb20b895db9f618580438d674bf3335a1d9603febc25a85595aa32ee4e41e0b2cd105f207cf2df3f34a21ca9cbbef10a7e3093a85c64009314ccc23fd3ff995df03b6796a1c5f83d01d2df4648f8a43d433a3071d5db672281019bb3385773ef753fce7b9f5dba6e3b5e15b0e4e3d49f8a51e3ca4881a027a410bf9f7f5023fe2eb4cb068ebf520af3608bb488ea6b7eb6f97408ab8f5b387396e0f0eed37dd017baf5d4cab2fdaab5b06365085fc9183da2508e203688d13b78380d64f7a24722e2ffbac16c4e9b97b9a96be3a10350df2555412b1eeab0f5a06e9162d6870f809958f74378da1e9c88789597c90bbd9ba21a39b60745b3dfc93ba3539321479c357f9f53c98f94a321166a0aeb55b59c4a90e8d4e2a0c00e9833771ac9a80bb353ff68374eb8d9dd7cf079030422efeb5785aa201eed1bb7adab532727540aafaa2f51f0f8760bf62e64e12bfe293dd0ce403d372ba96307883c1315ef8ad97279f4066d4cb448843857125b4f203dac8447dd67a1709328576a824a45bf8a27162cdb15b2ed12f5b72dcf8bfe7a14b4b8a94bb89ff8264a298a18a290b422fcd46f9ffa71776f3c66b685a26dea9e75b0213c9cb8b0ea407d89f8fcc10a421a093ac2938fa60866d94955f4da11bb1dc8dd698f1f28b0357eee68b89e796baa1eefec23d54a12ac48814797701ff3c00b32f6486f67e88b03f1e85edde30677a5574ba8a57947e2db949799e1c64cc53d1f5d5204d6932b5aabf56ed317f76e97b138c055d985124707ca55baec4e17f44965dc3277d527dd8a6d3c6d6e3fcb8c69d1efd3cbce8119d27c09c00d882d0cc77a40562fd96ba4c52b36f92df55d89641cdc99b12aa794f08707494aa8707677b02c15a24af3b627a6543b02ee4d0ca4c4cf46e1a436450035413c503ebababe893f154602deb7f601ce255c6a4f1c4e4b10b0dcf9f82a70d31046cdf75d2d45447a6194f970d819efdc165c5fdd432cc1995627eb48552d6ddcd0609594fed4824333b64a192578c9a617d93f6fe9ce6c29e1291c11c1337752231d2f641e279a7b7e0dbea98d396f1b154136adb5e0fda946191c99ef68f94827f521a8c83377823076b4c01be9f98f3c29e82ec4f7e0caa0a06d4cd4c58f977223f71dc4d9dd57aa05ce2680d96aa0ddc96de76feb8cddb651145d9f732137472b09e1e6c520d83587ab98bdbc260f2b08aabdadab1b44d0ead2fa810fd0178caeca3fed7139ff7d59c0c2db0c0a50af54fdfc6fdeaffee4ef80c7e32f2bab762bed45d3b6c4e3bd619852e299285d9647ffe8e90caf81b5213c30439922fff8622d38905a8677ba13e481343d86c39b2040705134b3912faa1831c8ea753efd5309e32520936309ea5042b2d877b29c5b88abc0d9e9343145ac0246f504c8202b8ef71935870b210874469cd9d50707461a04d3be210bf3ee4a246013dcdd05b3b6e7cff17cb65930599922e864bb5269102ae28ac7062839dd8e0a71ddd3a0f746b00c2e8700f351d6ec3b3d7d2d11ddcd150cb0fdb2a2bdb217a7c770dbbfd08a79196634fb459fdc174e87d1ff1b4da2af38316dc5517c6a862c555607d677cde7dd0afe1f1b63162ca6777da32f831c62f126328ed8036b07caa562c53dfe6bf145d5bae276b9165d51516b9919b6f779afa4a698ae8ce3b2245fa2e96a1e740cb0644c06b18e8ce1f66fcf1b2dedbfb79dac371f28e5bb7971bb44cf0d4390b6e80260c8337a9dce596e3fb140eba01588e9f0da44ae209543e71ab302db15426a4a18ff7a332464f848c329258a7bab46654638e71b009eb66fe91cd5ffa3474a183983a0ec5e223e4feff2396591f914918bd3de4579afc790c4351ce7fd0ffe65cefabd73520306d417f5addf67307f7857682a0f63971fb290a04a4141eb3ca72c7cc06066405017e2861cf67e405a170f7a156139cb7f48d0f8f53cf66be3afb39e3b063d857025e49230bea691debed49ec088b0ebf1350fefc726a0e13bce7edc94a629ece03546408eaae5dbddd1b371338a17b5d17388b3c42397dd3fcf7cdb205924a16f4a6ecef114dc22b7cba91df183890ef0c7865bc9f82dad29d7abb479e8a796867c0cf4240b3f0094970145b7b34181fe841ab6dc2e3174cc4dccad3cdd00022f6b44b0fb02c4ff4f19ccce20b76368fd1b48bc8b52c30b05ccdc014ccc9c35db3d33843c1570f57bfda9692eb81e260db38eed454248b61aa8f495bd2f882b873e436190a492bee8e799ff3f6a7599f80a9c37203cd78165078378719e55ff71f5b998e7644515aa5eb31f6a0a85c6532cf4e839d3de4d32d6ce69ab6ffb5cb4e40323620667d9f6aab6dcd8189448f64ef9848a776fb2c066bec7f09675eb296e6320cc943bad923881209a46bed1b3511006101924ff4111ccf81110a1653da272a30167d3cf0ead94cd588ae051f6c5524546bffbba2cb5eac48007af2f866d6ab5dfe65b1fd45b6584b8e4f0723be84149f290fd85d64f7978fece1193d2691e336cd3a8e01872e67b391f902561d254afcf700e74649c1f7d5dad985ad7cd3775aa4b0a61b83cec05e607450ef1200c40c8cdcc58f8dcc5dde3cc8777954c65ced8e658d19f0a823943dec5cb13a1f2463ca6e7fd0900e6143264ce6ee1bc34c1c29be71de6ab3f6b94723d0b6f5b118f978bac8f2de3e1530cc82cc416431f2e4dcacdf3dfbdaaadae241ec2ec79191f0a6015653ec4a474502b1c9b1c0e43a764f1a8ef2b17cee9d7542e949eba0fae620e807754beb4418100870fe896d72cfd8e597e16508ce25a4adc21ad0d9a67e0f7d3b67fc24cd0d496105176da588203ec51da780154aa4d31f3a064955d31db7fc896ee5238f92be2d1d1a78228d0f4d76bdb5689c0ad021583e2065b1de25703b0e7af944e07d45dc0ff6fd0a046c4ab92c63f0eb91000e6bb88215e29016ed7f8333863f165ee8e9dcb8bfd14314c08cd60f0fa217d91254d85fcaf0241fd0a5a241e6cb8be1644e1f4375852ed4900a63616d5ce07cc96cccb8a2978bf1485a7eceac3ad8b3831a71849a2e04ea40881288cd64c100c2aef3978a43064719680e79bd35268dc364fa60130daaac39d1efd4dd7c4e4dec5c414a6b84564e33c720ef6af9040872c539f8a5852f612a7232ad507de1e4b07c7da3bdd7e1100dcdc8b54e5ba375156a69006", 0x1000}, {&(0x7f00000003c0)="6d47d0c960369e24e969de079f705fe2fa739f114037c94541c21d1c0fc7b62ac6172c5acf6f72d240e9b38422b78839e918d6acec2381d1bda47bc18479ff1e4a2ad3bf944362a691b5aeb6c5c116e705bf65bf7b29d23a18af1542f68c1308e8c9f7cd8e9de7a94adf00d9b3cd4706c1498da3b06a72204ba3b81fef1ae36e14a5ea729705e7f1dea66943c68c07215d57750bd236522bb564f0a499c19f220a1ee75f28d6c893927d40983855e3a81b7160790452b42fdc93a18486dd73094bc96720f21d0c9646a1026347f3761750aa9a28fd34ecf649ad34a6d0da7a08ffcb5a59ba361b24b2c438c3fa9be7ea81bf37500db75aeae778cbde", 0xfc}, {&(0x7f0000000140)}, {&(0x7f0000000180)}, {&(0x7f00000004c0)="ff92685c6f18920920d03b5c83ad0e8e05abee4f0505fa15e218c4d4a263cb290f20a0996f57bbd71f751838468f811884b1f4d3c7f89c1bfae485c84297edfd7905dc1c99c529cf1f", 0x49}, {&(0x7f0000000540)="1de05381e013373ca20625911e441ad4569adec1d0d4", 0x16}, {&(0x7f0000000580)="507ad753bdef88b060e51f", 0xb}, {&(0x7f00000005c0)="8b1bb0a85bdc9d3bde2d24e42d70177436cf", 0x12}], 0x8, r6) fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f0000000000)=0x3) read(r0, &(0x7f00000002c0)=""/233, 0xffaa) sendmsg(r2, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000006000)="1b0000005200030f07fffd946fa283bc04eee6d87986c497271d85", 0x1b}], 0x1}, 0x0) 02:06:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:22 executing program 2: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r1, 0x29, 0x16, &(0x7f0000000000), 0x4) r2 = socket$inet6(0xa, 0x80003, 0xff) socket$inet6(0xa, 0x0, 0x47) close(r2) 02:06:22 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1275, &(0x7f0000000200)) 02:06:22 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227a, &(0x7f0000000200)) 02:06:22 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0500000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:22 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{}]}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1}, 0x0, 0x0, 0x1}, {{@in=@rand_addr, 0x0, 0x33}, 0x0, @in6=@mcast2}}, 0xe8) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00'}, 0x10) sendmmsg(r2, &(0x7f0000005fc0), 0x800000000000059, 0x0) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0x41) r3 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) mlock2(&(0x7f0000bbd000/0x1000)=nil, 0x1000, 0x0) sendfile(0xffffffffffffffff, r3, &(0x7f0000b58000)=0x200000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000440)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f00000006c0), 0x0, &(0x7f00000019c0)=""/4096, 0x1000, 0x20}, 0x0) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200), 0x4) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000040)='memory.high\x00', 0x2, 0x0) writev(r5, &(0x7f0000000700), 0x1000000000000110) 02:06:22 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0xc0481273, &(0x7f0000000200)) 02:06:22 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:22 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2284, &(0x7f0000000200)) 02:06:22 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0009000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x111, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) socketpair(0x1b, 0x8000f, 0x4, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r0, &(0x7f0000000140)={0xb, 0x10, 0xfa00, {&(0x7f00000002c0), r1, 0x80000001}}, 0x18) 02:06:23 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0xc0189436, &(0x7f0000000200)) 02:06:23 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0200000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:23 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:23 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{}]}) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {0x0, 0x1}, 0x0, 0x0, 0x1}, {{@in=@rand_addr, 0x0, 0x33}, 0x0, @in6=@mcast2}}, 0xe8) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00'}, 0x10) sendmmsg(r2, &(0x7f0000005fc0), 0x800000000000059, 0x0) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0x41) r3 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) mlock2(&(0x7f0000bbd000/0x1000)=nil, 0x1000, 0x0) sendfile(0xffffffffffffffff, r3, &(0x7f0000b58000)=0x200000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000440)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f00000006c0), 0x0, &(0x7f00000019c0)=""/4096, 0x1000, 0x20}, 0x0) setsockopt$inet_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200), 0x4) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000040)='memory.high\x00', 0x2, 0x0) writev(r5, &(0x7f0000000700), 0x1000000000000110) 02:06:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0x0) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:23 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x5421, &(0x7f0000000200)) [ 292.154550] kernel msg: ebtables bug: please report to author: bad policy 02:06:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0x0) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0xc0189436, &(0x7f0000000200)) 02:06:23 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="6000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:23 executing program 3: mkdir(&(0x7f0000001a00)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) renameat2(r0, &(0x7f0000000140)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", r0, &(0x7f0000000080)='./file0\x00', 0x2) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f00000000c0)={{0x2, 0x4e23, @local}, {0x306, @dev={[], 0x18}}, 0x28, {0x2, 0x4e24, @broadcast}, 'bpq0\x00'}) 02:06:23 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x5452, &(0x7f0000000200)) 02:06:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0x0) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:23 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:23 executing program 3: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fcntl$getflags(r0, 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xfffffffffffffcc6) ioctl$FICLONE(r0, 0x40049409, r0) clone(0x100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) mount(&(0x7f00000003c0)=ANY=[@ANYRESOCT=r0, @ANYRESHEX=0x0, @ANYPTR64=&(0x7f0000000280)=ANY=[@ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=0x0], @ANYRESOCT=r0, @ANYRESHEX, @ANYRES64=r0, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRESDEC=r0], @ANYBLOB="e722dece135490c140686cb0344f0a5264c00d", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYRESDEC, @ANYRES16=r0, @ANYRESHEX=r0]], @ANYRESHEX=r0, @ANYBLOB="bdf1ed7e9fbcd252e9345c4b8617e46887069a30bcd4d9e449f661280bfd104f", @ANYRESDEC=r0, @ANYPTR64, @ANYPTR=&(0x7f0000000480)=ANY=[@ANYRES16=r0, @ANYRES64=r0, @ANYRESOCT=r0, @ANYPTR=&(0x7f0000000540)=ANY=[@ANYPTR, @ANYBLOB="be1a5603810842295555d929cc8397d8748f3c63be2099aab660466781294c87232407ee41e3ea1ebbd88b1dd296970227fb80c7f0bb94b4e418b4e00d0866672d82412cba8d42192a49efbe6de74fb02a6a35a8732e7c79033f41fcb8b07cc47588f535a4eaafddb7aa12711cbaded01f070590a63216ed2ed49fee555779e05174bdde323d8f14fa66b8a5f4737d5160d65a030beb181b0da8b9747e6ac8b9da7fef1e8a514102a28fb12f10a115d30df2435fa85304c327f99dc56a66f45fbba1cda7b9ca4e625d61676e855a171cd3b1638843adbc612df469594891c010248ce500e361c839735112d17d8a98d101af1065f7aa2205d7f77e", @ANYRESDEC=r0, @ANYRESHEX=r0, @ANYRESHEX, @ANYBLOB="543d2c895fbfbb17a1fce079488203b8dabcc0dcfde3aec3d9af492a0976cc96609cbf3a561fc1cf59325cf0e6f9a9a66a8e61ffc2d428ed5f27304b2b0094339cbe6baba43e8a1b3308aecbae69fee76fb3cd875989263c37f593175209dca41c988362fe4a82c76629be751d0f966795ee34a042cc4e3ad11437fcfad4a0248bdaf1498d2f6988a6320c817807f4ed317eea1b939638443330", @ANYRES16=r0]], @ANYRES16=0x0], &(0x7f0000000500)='./file0\x00', &(0x7f0000000080)='sockfs\x00', 0x0, &(0x7f0000000000)='\x00') getsockopt$inet_dccp_int(r0, 0x21, 0x1, &(0x7f0000000040), &(0x7f0000000140)=0x4) 02:06:23 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000004880", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 292.675359] kernel msg: ebtables bug: please report to author: bad policy 02:06:23 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000c97ff8)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x0, 0x0) close(r1) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") syz_init_net_socket$llc(0x1a, 0x0, 0x0) fstat(r2, &(0x7f0000000240)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000b04000)={0x4000, 0x0, &(0x7f0000000080)=""/188, &(0x7f00000001c0)=""/95, &(0x7f0000ce1f30)=""/208, 0xf000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001400)=ANY=[]) r4 = socket$inet6(0xa, 0x400000000001, 0x0) sendto$inet6(r4, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000d7c000)={0x0, r1}) 02:06:23 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(0xffffffffffffffff, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:23 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:23 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x6, 0x2040) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={"066d380008000000008000", 0x601}) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000000)=ANY=[@ANYBLOB="0100010001560280e2000000"]) 02:06:23 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2288, &(0x7f0000000200)) 02:06:24 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000280", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0xc0045878, &(0x7f0000000200)) 02:06:24 executing program 3: r0 = socket$inet6(0xa, 0x80002, 0x100000000000088) bind$inet6(r0, &(0x7f0000d85fe4)={0xa, 0x4e23}, 0x1c) r1 = socket$inet6(0xa, 0x802, 0x88) setsockopt$inet6_udp_int(r1, 0x11, 0x100000000a, &(0x7f00005b1ffc)=0x1, 0x4) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100)={0x9}, &(0x7f0000000180)={0x0, r2+30000000}, &(0x7f0000000200)={&(0x7f00000001c0), 0x8}) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e23, 0x2, @remote, 0xffffffffffffffff}, 0x1c) sendto$inet6(r1, &(0x7f0000000080)='\x00', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @mcast2}, 0x1c) [ 292.908878] kernel msg: ebtables bug: please report to author: bad policy 02:06:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227e, &(0x7f0000000200)) 02:06:24 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:24 executing program 2: unshare(0x10800) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x86e, 0x400400) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000080)={0x0, 0xf7, "141146ad1bfa408738aa6e67a1112aa5f101660cde05c8df0c42d79cb021f8817aa767eeff8135d95d9d884d6798f637ab140de9b9431be060ddaf79e898970e9077c6a03956e2d45529e7cc2b19263f1763d5854d8b53c5a5b1fb109fb0c26111b1fadafc0bffae08051c21ac47ccd1868982d87d673c170c73652c1f27c14c1bbffd77a7df2c1cbe2c9e97a2252e13224ce7dfb705fcfad2f694beac21643e4c9755055ebb351b82fc6c1c6c3c3025d98592cfb591fc6256c9a73a3d4900a1cd977ecd3dbdeb5efacbccffeb8dd6a420b790dc104f826690f91518177673a5eb285e4d77b2ef689b9c46086192bf2af749986ec435c8"}, &(0x7f0000000180)=0xff) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000001c0)={r2, 0x9e}, 0x8) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000200)={0x0, 0x0, 0x4, 0x0, [], [{0x8000, 0x1, 0x5, 0x6, 0x0, 0x5}, {0x9, 0x8, 0x6, 0x100, 0x9, 0x1}], [[], [], [], []]}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) ptrace$getsig(0x4202, r3, 0x3, &(0x7f0000000440)) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vcs\x00', 0x2000, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f00000004c0)={r2, @in6={{0xa, 0x4e22, 0x1, @local, 0xea5d}}, 0x258, 0x2, 0x4, 0x1ff, 0x40}, &(0x7f0000000580)=0x98) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f00000005c0)={0x80, 0x3}) setsockopt$sock_int(r6, 0x1, 0x2a, &(0x7f0000000600)=0xf48, 0x4) getgroups(0x5, &(0x7f0000000640)=[r5, r5, r5, r5, r5]) write$FUSE_DIRENTPLUS(r6, &(0x7f0000000680)={0x338, 0x0, 0x7, [{{0x6, 0x2, 0x8, 0x3c, 0xe43d, 0x3, {0x3, 0x50000000000000, 0x1000000000000000, 0x9, 0x6, 0x7ff, 0x7ff, 0xfa6, 0x1, 0x7fffffff, 0x3, r4, r5, 0xffff, 0x8000}}, {0x6, 0x8, 0x13, 0x800, 'cpusetsecurity\\ppp1'}}, {{0x6, 0x3, 0x5, 0x7, 0x6, 0x7, {0x6, 0x7ef279e1, 0x1f, 0x0, 0xffffffff, 0x9, 0x7, 0x4, 0x7041, 0xaa, 0x3ff, r4, r5, 0x400, 0x1}}, {0x2, 0x6, 0x7, 0x9, 'vmnet0\x00'}}, {{0x4, 0x2, 0x7, 0x43fd, 0x1, 0x7, {0x0, 0x2, 0x2, 0xfffffffffffffffc, 0xc5a, 0x1, 0x1, 0x1, 0x4, 0x101, 0x5, r4, r5, 0x8, 0x4}}, {0x3, 0x400, 0x0, 0x3f}}, {{0x0, 0x0, 0xffffffffffffff01, 0x6, 0x7, 0x40, {0x1, 0x9, 0x800, 0x9, 0x0, 0x6, 0x1, 0x400, 0x3ff, 0x100000000, 0xf1b, r4, r5, 0xdb}}, {0x2, 0x81, 0x0, 0x2}}, {{0x5, 0x1, 0xb07, 0x200, 0x401, 0x1f, {0x4, 0x5, 0xfffffffffffffffe, 0x9, 0x0, 0x89, 0x100, 0x2, 0x8, 0x5db007c8, 0x4ffb, r4, r7, 0xc9, 0x6}}, {0x0, 0x4, 0x9, 0xae, '/dev/vcs\x00'}}]}, 0x338) r8 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000009c0)='/proc/self/net/pfkey\x00', 0x8000, 0x0) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000a00)) vmsplice(r1, &(0x7f0000000bc0)=[{&(0x7f0000000a80)="97547182139757b5aea5c54db8f41606f447b20bf283911aa091d8d8aed30f1bcdb02d922556c69b41ac4b27a941be9e8aaeb51465b27c608ab6adca0477e8286321413f20f0efb5426ebe458b2de34a715d5954401fcd260fcf3f8d686d681c60cb11a342d60e3e29a683ca0b8ca0a43624a4eec5cd007dae0129b8b4889d2081bc20fae5b8ad64872de5b8f42662f1c2c5549e162f309ddb64c7a4baab711e2736", 0xa2}, {&(0x7f0000000b40)="34a9df6979f9ee0c1fb5baa48ab31583f5580d0acd2d2578190dcaf1bb0134bd", 0x20}, {&(0x7f0000000b80)}], 0x3, 0xc) fcntl$setpipe(r1, 0x407, 0x3) clock_gettime(0x0, &(0x7f0000000c00)={0x0, 0x0}) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r8, 0x28, 0x6, &(0x7f0000000c40)={r9, r10/1000+10000}, 0x10) getpeername$packet(r1, &(0x7f0000000c80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000cc0)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000d00)={'ipddp0\x00', r11}) r12 = inotify_add_watch(r1, &(0x7f0000000d40)='./file0\x00', 0x4) inotify_rm_watch(r1, r12) ioctl$EVIOCGKEYCODE_V2(r8, 0x80284504, &(0x7f0000000d80)=""/36) accept4$llc(r1, &(0x7f0000000dc0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000e00)=0x10, 0x80000) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000e40), &(0x7f0000000e80)=0x4) splice(r0, &(0x7f0000000ec0), r8, &(0x7f0000000f00), 0x4, 0xb) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r8, 0x84, 0x23, &(0x7f0000000f40)={r2, 0x1}, 0x8) 02:06:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2, &(0x7f0000000200)) 02:06:24 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0c7d000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 293.100021] kernel msg: ebtables bug: please report to author: bad policy 02:06:24 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0), 0x0) 02:06:24 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x804000000000006) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket(0x10, 0x2, 0x0) creat(&(0x7f0000000180)='./file0\x00', 0x28) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r2, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 02:06:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000200)={0xc0, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x14}}}}, 0x88) sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x18, 0x32, 0x829, 0x0, 0x0, {0x3}, [@nested={0x4}]}, 0x18}}, 0x0) [ 293.300246] audit: type=1804 audit(1540001184.431:52): pid=9746 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor2" name="/root/syzkaller-testdir588334715/syzkaller.jPohSq/106/file0" dev="sda1" ino=16813 res=1 02:06:24 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000180), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000140)={&(0x7f0000000000), 0x10, &(0x7f0000000040)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x8, @can={{}, 0x0, 0x0, 0x0, 0x0, "c4d981ae211e6951"}}, 0x20000108}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000580)={&(0x7f00000002c0)={0x1d, r1}, 0x10, &(0x7f0000000240)={&(0x7f00000001c0)={0x20000000007, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "c61f2323d752075b"}}, 0x48}}, 0x0) prctl$setendian(0x14, 0x0) 02:06:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x5382, &(0x7f0000000200)) [ 293.340125] audit: type=1804 audit(1540001184.431:53): pid=9748 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor2" name="/root/syzkaller-testdir588334715/syzkaller.jPohSq/106/file0" dev="sda1" ino=16813 res=1 [ 293.340726] EXT4-fs: 18 callbacks suppressed [ 293.340738] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:24 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:24 executing program 2: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x100, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000007c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0x1, &(0x7f0000000080)={&(0x7f0000000700)=@bridge_newneigh={0x30, 0x1c, 0x429, 0x0, 0x0, {0xa, 0x0, 0x0, r2}, [@NDA_DST_IPV6={0x14, 0x1, @remote}]}, 0x30}}, 0x40040) sendmsg$rds(r0, &(0x7f0000001b80)={&(0x7f00000000c0)={0x2, 0x4e20, @local}, 0x10, &(0x7f0000000480)=[{&(0x7f00000001c0)=""/137, 0x89}, {&(0x7f0000000280)=""/238, 0xee}, {&(0x7f0000000100)=""/70, 0x46}, {&(0x7f0000000380)=""/231, 0xe7}], 0x4, &(0x7f0000001940)=[@cswp={0x58, 0x114, 0x7, {{0x20, 0x83}, &(0x7f00000004c0)=0x8, &(0x7f0000000500)=0x5, 0x80, 0x5, 0x6d, 0xfffffffffffff5cc, 0x40, 0xffffffff}}, @fadd={0x58, 0x114, 0x6, {{0x4, 0x1f}, &(0x7f0000000540)=0x7d067aad, &(0x7f0000000580)=0x3, 0x1, 0xff, 0x6, 0xa00, 0x30, 0x4}}, @rdma_dest={0x18, 0x114, 0x2, {0xffff, 0x8}}, @rdma_args={0x48, 0x114, 0x1, {{0x8e34, 0x20}, {&(0x7f0000000800)=""/4096, 0x1000}, &(0x7f0000000740)=[{&(0x7f00000005c0)=""/179, 0xb3}, {&(0x7f0000000680)=""/117, 0x75}], 0x2, 0x40, 0x3}}, @cswp={0x58, 0x114, 0x7, {{0x100, 0xbf96}, &(0x7f0000000780)=0xfffffffffffffe01, &(0x7f0000001800)=0x3, 0x0, 0x1, 0x1000, 0x2, 0x40, 0xe652}}, @mask_cswp={0x58, 0x114, 0x9, {{0x3dc, 0x5}, &(0x7f0000001840)=0x8001, &(0x7f0000001880)=0x6, 0x81, 0x4, 0xfffffffffffff52b, 0xfff, 0x1, 0x4}}, @zcopy_cookie={0x18, 0x114, 0xc, 0xfffffffffffffff7}, @mask_fadd={0x58, 0x114, 0x8, {{0x3f, 0x9}, &(0x7f00000018c0)=0xffffffffffffffff, &(0x7f0000001900), 0x0, 0x67, 0x0, 0x731d, 0x40, 0x3}}], 0x230, 0x4004880}, 0x4f8ba38d6cd9718f) 02:06:24 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:24 executing program 3: getresgid(&(0x7f00000000c0), &(0x7f0000000180), &(0x7f00000001c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, &(0x7f00000001c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0xa}, 0x48) syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0x101, 0x2400) syz_mount_image$xfs(&(0x7f0000000140)='xfs\x00', &(0x7f0000000100)='./file0\x00', 0xffffffff, 0x1, &(0x7f0000000080)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000001000000000800000000000000081000000000000008200000001000010000000000100000000000006c0b4a40200010000100000000000000000000000000c0908040c", 0x7d}], 0x0, &(0x7f0000000040)) [ 293.472067] kernel msg: ebtables bug: please report to author: bad policy 02:06:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2272, &(0x7f0000000200)) [ 293.531108] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:24 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0), 0x0) 02:06:24 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000e80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x3ff, 0xa200) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000180)) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, &(0x7f0000000980)=ANY=[]) mkdir(&(0x7f00000000c0)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0x100000, &(0x7f0000000480)=ANY=[]) mount$bpf(0x20000000, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001002, &(0x7f0000001900)=ANY=[]) mount$bpf(0x0, &(0x7f0000000480)='./file0/file0\x00', &(0x7f0000000580)='bpf\x00', 0x80000, &(0x7f0000000540)=ANY=[]) mount$bpf(0x20000000, &(0x7f0000000300)='./file0/file0\x00', &(0x7f0000001a00)='bpf\x00', 0x5004, &(0x7f0000000900)=ANY=[]) mount$bpf(0x20000000, &(0x7f00000004c0)='./file0/file0\x00', &(0x7f0000000400)='bpf\x00', 0x588e, &(0x7f0000000c00)=ANY=[]) mount$bpf(0x20000000, &(0x7f0000000380)='./file0\x00', &(0x7f0000000080)='bpf\x00', 0x0, &(0x7f0000000d80)={[{@mode={'mode'}}]}) 02:06:24 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fdffffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2202, &(0x7f0000000200)) [ 293.688721] kernel msg: ebtables bug: please report to author: bad policy 02:06:24 executing program 2: setsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000580), 0x4) r0 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) write$sndseq(0xffffffffffffffff, &(0x7f0000000140)=[{0xfff, 0x40000, 0x0, 0x0, @tick, {0x0, 0x1}, {}, @ext}], 0xffffffffffffff96) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000740)=ANY=[@ANYRES32=r0, @ANYRES16=r0, @ANYBLOB="e4d72c7592dba83234010bb53907b6490ea72bf4d94fa6c72c2edc4e4d114400779ac4eb665fcb3142ad00c2b1a9922541c5cc2f2ff32dd38eb2e753a6ad014d95802870d137ef7ed1c81bfddca24fb9aef1d7dc2e0a1ee6809558dd379d464fb179aab4fa81a712c316e84371469abc3753777e5cd40fda7acbc178e7c45777e3b45ca95c744452aaa43d1dbbf706541b2cfef56f95691981a5463ddc22fd2b57003e984ae3263ce4757dc6d076a2e22d191f4e69b5b0901879ef33454339bf5b6f4af9156b94f8386f79ba09a5997767acc00c50abe19cfefe19a52e2651dd10d1ef936d52ec067e51", @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYBLOB="1916c41b5d23e4ba5d219ddd919c4a1bcb1f564aa37bf7f63f5195bd72c69b497a41599c334ae63530aa23ab9fe0e818942e6c213521e5fd7c4bd1ccdff783d3875b92bc4b89c4a5b5e05adf64e4a2a4352d0bb164abaa175b2499323eecf2dffe1225b3d81d1b82ac69fab1ea51c56a10af0290e890728cefdb3298796bd2c32b859635815698a18f78770758b3e8399a", @ANYRES64=r1, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYRESHEX=0x0, @ANYPTR64, @ANYRES32, @ANYBLOB="d3d9f711d3fc096586100f82cb28437ab344384ad13a9ca72038ea0922ed78858f6332848213330b30715e9e27d3d4e56521e816120bd163e9432a9f9ec4716769b5e887a6173a16795cf6ee79b2933b717ba497b4c91cb04f24c6d7ebf6a9d90f6ffaa3", @ANYRES64=r1, @ANYPTR64, @ANYRESOCT=r0], @ANYRESHEX=r0], @ANYRESHEX, @ANYPTR64=&(0x7f00000004c0)=ANY=[@ANYRESHEX, @ANYRES64, @ANYRESOCT=r0, @ANYRES16=r0, @ANYRES32=r0, @ANYRES32, @ANYRES64, @ANYRESOCT, @ANYRES64], @ANYRES16=0x0, @ANYRESHEX=r1], &(0x7f0000000180)=0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'gretap0\x00'}) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, &(0x7f0000000700)={@mcast1, 0x3b}) mbind(&(0x7f0000ff4000/0xb000)=nil, 0xb000, 0x0, &(0x7f0000000280), 0x5, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000680)={0x3, 0x0, 0x80, 0x3d1}) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfd, 0x800}, 0xc) fcntl$setsig(r0, 0xa, 0xc) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000002c0)=ANY=[], &(0x7f00000003c0)) set_mempolicy(0x0, &(0x7f0000000380), 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f00000005c0)={0x3, 0xa00000, {0x57, 0x9, 0x7, {0x6}, {0xcc, 0x7ffe}, @cond=[{0x4, 0x100, 0x0, 0x3, 0x101, 0xf8}, {0x2, 0x1, 0x10001, 0x9, 0x10000, 0x3f}]}, {0x56, 0x4, 0x4, {0x9, 0x80000001}, {0xc00000000000, 0xff}, @ramp={0x100000001, 0x1, {0x20, 0x2, 0x1, 0x4}}}}) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000040), 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x0, 0x0) seccomp(0x1, 0x2, &(0x7f0000007ff0)={0x1, &(0x7f0000004fe8)=[{0x6, 0x0, 0x0, 0x50000}]}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f00000001c0)={0x0, 0x0, 0x3}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000200)={0x0, 0x0, 0x6}) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000240)={0x0, 0x80, 0x6, [0x4, 0x4, 0x6, 0x3ff, 0x3, 0x100000001]}, &(0x7f0000000540)=0x14) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000640)={0x0, 0x5}, &(0x7f0000000880)=0x8) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000008c0)={r3, 0x100000000, 0x10001, 0x0, 0x7, 0x4, 0x400000, 0x2, {r4, @in={{0x2, 0x4e22, @remote}}, 0x6e, 0x0, 0x4, 0x10001, 0x5}}, &(0x7f0000000980)=0xb0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000000c0)="c744240020000000c74424024f000000c7442406000000000f011c24c4427d180508000000c4c245ae08c4e2850108b9800000c00f3235004000000f30d3559e67470f224205c814000066b89d000f00d0c423a95f2518410000e1", 0x5b}], 0x1, 0x0, &(0x7f0000000040), 0x4000) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000009c0)) [ 293.731651] XFS (loop3): Mounting V4 Filesystem [ 293.739588] XFS (loop3): totally zeroed log [ 293.745641] XFS (loop3): Failed to read root inode 0x100000000080, error 22 02:06:24 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2289, &(0x7f0000000200)) [ 293.819330] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:25 executing program 3: set_mempolicy(0x4002, &(0x7f0000000000)=0x3, 0x9) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0xa, 0x44031, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') fcntl$getownex(r0, 0x10, &(0x7f00000010c0)={0x0, 0x0}) syz_open_procfs(r1, &(0x7f0000001100)='net/raw\x00') creat(&(0x7f0000000080)='./file0\x00', 0x42) r2 = dup3(r0, r0, 0x80000) write(r2, &(0x7f00000000c0)="bb4951a7d743168ae024e2925bc9f96fbd2b60cee339b46c79a6d6bd1fd6f7506b1b9ed4f228e8fae1c8e871619fded6f045f8842f9ffe0381747c612515c454bd5f47168fd1cc3fe3e0f61f1c3c4b5d29ab9966109fe8110fba428a87553a91e8dc9d668c1e1c7ce3adfbf566853da4b79fa053b0d33a1190991081757d34cdf4d766c2c5be2b7c9420d8a9be70cc7055c7da2b45519a0ae234fd54b3839f60325370ece530f324e2547844178c383a108ff4789e9c03c17aa1f1aa77455b9180f8980ef2f70f4697d8b5f521b21e6caddf99d71c72d5bd40ba590c4d7ec08a51d54c4fc9375479c49d7129a1598a51d2f3662373e92eb0d558bc697c65a514eb920e61ad58e54da3d1f1004efc43ba592cfa2c1fd2b1d7501b441cf0a1ac2a82fbc1ae90951c7704e31dd92b89d2b5a97f598701c454c0c09ca484cfb69ee506ab1839db86a24b26eed1526ba2f68eb746ac39eb180e606f472b1d03b9eb847a98e67f16b9f1954a076fb28c7905b4621615fb0024a282fce68a3fbc1fa2d139b38a93945327ba2597769485ba16072f0a84d5c5cb2db960e1c08a5c4b97c8fa57e0cff052885dcf584a41d146912dd35b9290bac4784ce2ab319ec2ff2c35df82c67f30ac74c2153a3a70fb96765a47f9944cc2a2f5cf83825ccfa2d0398c137c3403797cae9f2d336e1ad784c3b4d40d6e51425ae60d329e095a23524ee63d9cc553be367b60edb248a83be6a966b6656db366184ba06a1590a5d438e2bb2a72d34ff246abd64228c880102db7b06299c9fe2e68352f0e3b3be93413d41fe9c071c9adbdac7bfd3ffd7593aa5dfdc39069f7674bf8b14103d0ac933ed8b1d808ed837d02a3ee8552d986e6fd28a9b0da66c9b8ca256a3b20c48f8984c971d001eb0723e91f844ae557ebde9bf592173137b9339356a82ea2f99ca9490fd467762113a6910b119a5701dcc6a8a9c07493bdf16fd964981812e2d2970cd87a0a71c21eaed7405cfadda09824ffa3e3d47fd677526abd045b25bcb0ed2f646b31aebc590aed1f89ef5b2b1b406e418f53eda87a54148791d42a87229d76e5f60844f95381357fc862aae320e75b8c5f75311564efc1f8f501de5dc0ee97772a5f4e7360aa755ee379200bb258f2a58f9ac34aefc1c804eb919b3516ffd1b80885afe9933683e1facc8064dd42be64a61250e4e5b2db6d81d3baa879db38bf4890d1f1174f4c989c8232041fa8d7f831ded3350c562fdaf30aca6eca279327aaa57288f65fd442294e59faf0185b3a73f12988eccb77a9e020ef6926a27d80fc3d306b1340d5df7d97fff4653ea0d8c61a13b00c2cb5f27a58c5740495b22d23585a12d3aa606eae9f88c46f4b9cc13b901f6cc24351593d42841d5db7c6d1dc965f136bca7924e39cd2b9416a04379476b683822538a7806bafe68867d8363be634bc99ccdd7156e91e6c59692ea3b8519ad5b417fa8262749448a62013916be23cb1451064840e303c4f585765f1bf24f39b36039f44e265d6f0ad83917fb80ccfc7c36c7068311f00b50c9bc3868c15f3012bee1c911398d5da882f91a5a142d8a3a21c2e3c5b341c63e460859f75aefd84582f9bed03b213d8d8588a9222a4b122285201061c1cd34b7ff8de438a446e71b75e9403506589422e03ec7a233463f335a977f2a71f1e65fcd1ff7a438da727d25f3886208168ab88a31651b0cf07972e0fcfa478cd324b5b01be5cddfebf24ca9ecfcbaace63174ef3140e913c7b268fab62d5a4229a70fcf8ad58e90ece1946fe21225385966e638a79d89f0a98c92a13304941d76c8cac301099abcfa3262b7230758a68cbf0046641a8ae2a13b9838b58567d3f142c6da6c4f766ebb8b403b0ce68df33ecec3d88bcd1236de04da6242229343d91f1301bc520d3a5b5491bd8f4013c5ca722538280b98ed10f4683616de5f3be7cf6c2e3bbf01ad3583c936414243d3a91dd517cd7afffc4225d2fcd8e7e6623bdc630cbfd1a2de6efa1e4f056ed97b851e94b50b0e7c8392e02a73b408fd0d0ca6785ed68938d731848a61117f9c661c897403590480a157ebe761ff7d509538588545f9b482f830414ed5ee9c3ae423bfd73ee2969015087b5839fe1f91a03c8532fa92d87ffbbc467f2075543f5948bc0127979a9961979e2591bdd9eb9537afbac046240f2b3bba4f5df06aba2074c71225f5d34f206e277d08ce0df15122d3a3ba1277c39cd96d6fcd4e59599025d72e43377a18ec5fe237f7dd4b105b1ed2d5741c05048d9f16273decba395e4231a590852000707624e16f9494aea5bc9008b8226380b29a6c35e7de4cf5a87072217d67527d257849d4df7e823547a89ea35b66d97d4f25f5960ce1270e43d136a4ac24bb627fdadb30e5558880c986d5d840ed63cfcbb3b59f0c4cc5427a6ab529716920ad66617bb64d54d722de3c5adf7c5d406f60899d7ee120dfb871d2b5ee0def2beede1a62c66ef6406df828dbaf55131b3ae70c13f1418a3315ea445f7571c2451bb62aff9116af9fc6213f9879211f4bd363e414c4192a2fe2022ff029ec356130ffa4ae9b4c5847e78d453a773e0bb3b33b12aad16a0588bae79297b2e50afb8b8b4f426815faa8ab73373596a918c60af5cdf4521a09f28369b2051b8d0195f5be0a31c76a4280d7a0271d04a69a1fdd0ab2d8ec0476ed4b3b54bcd67cd2bd5631fe22a4eb6d4610f6eb474c8dccddb128a0c884d1b60c8564166c673f1889105b440057d83f847ad752e44850fe31e5cdc46c88b025695e4b3bac1e004c8650e0c02bebb5eaac012a49d6d355206addd2ea2ab1f79f98bacbec01629cf75d3ca1966c8a57c90741e44e45c2adef920a4dc828b1dbddcfcbe306cd80ba539faecdc72687b54a77401280bcbe5bfb0b1c5d4ab550b2963c05e2bab3abd235affd2b5fdb86b3967ab51a5aa53623a0c8697130e37479e8833c1b4d2c6959c4abc8bba66ae4cf799728e77cc59255cd8af747c1ce62ed7a29f1e43f485d2e43b237a293e3860ff3f597bb096cd551a100c12178599fc7d4fca15c6749330a89e9303b222fe1aa12684e6e0f0876e8e4964a2f9f5deff344b6e646de098a8407d5ba111ad8b0522cd667a446fbd083342d06bf617b3e449278d2bd18f884cd80fea25be2a5dc1d54c40f0adb44643073dd48eb4cf603c9f2e04471ac7b444ab7ad80562ccf0a3089c4e0536a9f5cd97674ac62a73c797b7ec75b132af2e1f7594201d519090e07545e9942c8ef1e7e1e236b52736622c47a9cf1aad7aa2e177c98617dd8f102b589c91a323d8a300922a51076c8debca7934efc87d048b3154f8f9673e407527aca467b54e6fc818c750f82d4cfa7ac6f029f716d46e247649ae941223762e5027d305b318cb8797c7a17261bb7580ca02fd5f7b7ab33590ab2e1f075c00395e80fcc89f686de774ebe3d2442e5f399e732dd5fd105c1fd81e4702199620773ea9be03a1d7c64b2a34a12db88056cf2ca54a03019a95278e21939db00e128e570c57a1909ca2daf2eed6e095534deba430a900f63c7b1b136edca0f370df1e1611013d73fb8f8f9112868c6211ea190b04d1f38f6cfd1ce755286cff0730f04b90ff9aebe076353d0293f1fc64191b93360a2a9d4fed6ff5b047f042b7e6f1c0d708bc73b81bb0f5e725a7b5ba88af8a24e34950643a02727666f46a6e3532675bed5334acd92e6a2b749cd6eac95d3203a8629821277b6d51c13cd49fb475cf6d642a20229f53e426fb7468bd798258b4e832315f5288aaf1c673285e73e1b932ae4f0526cd156f9d31c533159448d7e6b3bd7d722e0384bea86f8cabdcac3138e5bb4cca69817cb0cdbb7f357c4e4ee049dc47965c992f66571b56f7b9b6cf6cfec6b49868eb429f2ea5b435a80e0ba7d76c680430d2839081da92b852678dcbb490e0e7c4e9aa5dd27f9ae94fdf52627f65ab539437d00e6e289d109df03bd86a4c38fe2905502925936316bb143a721e2b6c7a68c20d4dedb9af27c1dbf1e077fbd7529530763384d5a512182291eedb4fd63a6d5f5b6fbf2a0a81aa2cb82772e97ff9590899d9c02c1fde35ccea54d09e85e3dbf8a3ff4b92ee677baad378ed3c8e26120e5d508777640b02e1bd783c7fd89ac480cbaead1351f8cea4daf4458b550902521ad542cee0b5493d5aee2177cd09b1ff6a67979904748bbcf47c4e690ced3a46cbd4b7d5bb8726a29c5a2ffc90baeedfcb2a45dfdff564cd7622e6fdf4121df460d0d8b9d7cb7783b9cdcc7a4068cdf99770bf3502b56f068f087077d4d6eba4bd6762c608f2f2f0dbbaa0b1a13c069c07f15fec16bb618d891166213c729fbe6c713b26a8f4dfca9686dc6ce7cd26b827e3c6d6a275a513219114aec80e555ab1e42d820cfc13660c9be06e37536ea99f53d4784585312f33922c4e4b65cafe71e1fc223cf59ab6308a1a02557c15405ec146bf344fce815de9efbb7efc1818fb37f048f608820ee1dea28b8b7c9508bfa441c92f4bfdc3b9c534af37f34aba68f05562cddaa858c8be3d95ef900c75c980c9ad3c15e8b19847415524a6371b2bde046e83ced2bec09ddee68b3468a8978c118c7570fcf5100185501e2f0ed206c69eae9d5877bc815e54175c479ac8e6264401174aac31b6681cd2a10e7e3d96c936f24b97fe46ed42c5ede902da706366d6ef72e59e2328c176ec7b0abe834dd5adde21920ab06ed2edadb7990bce24c38d911e62aaae37954c91044fb9685755887b0b4a84b0baf9fe7db3f8e1d8eb32bebf3b5e64a032c02bc055fb3c180672d26f6295648392b3f8d8a2df9c9a0cdf0a9a33d9e6d68f9bd652017f8265698455a9d6ef6409f37b145b36e6be2565e8f09f70b7e374ee58da7add21ad0c3c4379e7dc476e8eb294150beaa452a52a271b60e37807607f3ba7bd8e4998a54e89ade98b72e2d20668e5c738ff9fdb1a7670f2d5fe78a636adda6d0d9d43c5f81f0476977752b96e4c815deae3b0da80b3d9f0a66bfc52b0c6eaaa215e9ab59d28f525b76188061fd7dfe9db520ee8a42d623a66d753f3c33cabd2db2349a5441a3c927698883b7d58bd06a76aea89ad92b48cd4866080d254d0e2c0d58e6c9ffd7c645d96e5647b030f8df9d24850d9168b8b317a5113b82b70d2539f9d9f3f4ef9c7b12d4f3f5ad272cdfd5c98440a665ee82ac323ee95f8d4354a419e080b4805b38e12a47c5d6b07bd202737a948305af81f7b02869b082adc6a8b417009926bfd9c831eef0fcec711cd4bcb4c5f10bbbf6c0d77a121dee36070b4a2c387264a57557e2f37eb9a3efd3aa48af7679448e1395af33fbcf52464c351179b120abf67fa580c5984d93966eaa3a6026939e833c1943a0b7ea3fcb850359e18cbd615a7ca4fc4c511ee5bd93a2dd4633667d6313a9f13204e612d0390136e39c7a99ce50839951390a122360643cbe13256a6b103738d983d02a9dc35b63cf04f4c4052e44c42e1df276c2c2a5a9d7493e4ff94ae0ac79ccc98d6b19c780fde1a1008d7222fc13f567e195ad52e0f0105163d6bac50507801d0bfeed8bcdfe519b745807b357391c082a68cce5510c2cc99d9241539c1db11aafd0c0cda908effd1ac6643a32cbd7f9985ddd54b642ca2c852a65c012350b03b8f1c0d0a64d2bf32801e54d19009551ab685400d4fafa392c17d303c55bed2c1ed3f7cbc09f37bbd3e1ed19d63e7bbd1515a4a82767d8403aa2f1edeccfbb25f53168897afe245e220c47b2f23eca093aee65da2dbc840e637f920", 0x1000) 02:06:25 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x5385, &(0x7f0000000200)) [ 293.946698] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:25 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0), 0x0) [ 294.171343] audit: type=1326 audit(1540001185.301:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9806 comm="syz-executor2" exe="/root/syz-executor2" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45a3ca code=0x50000 [ 294.209315] audit: type=1326 audit(1540001185.301:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9806 comm="syz-executor2" exe="/root/syz-executor2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457569 code=0x50000 [ 294.233482] audit: type=1326 audit(1540001185.301:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9806 comm="syz-executor2" exe="/root/syz-executor2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457569 code=0x50000 [ 294.269220] audit: type=1326 audit(1540001185.301:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9806 comm="syz-executor2" exe="/root/syz-executor2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457569 code=0x50000 [ 294.289683] audit: type=1326 audit(1540001185.331:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9806 comm="syz-executor2" exe="/root/syz-executor2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457569 code=0x50000 [ 294.310678] audit: type=1326 audit(1540001185.331:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9806 comm="syz-executor2" exe="/root/syz-executor2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457569 code=0x50000 [ 294.330993] audit: type=1326 audit(1540001185.331:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9806 comm="syz-executor2" exe="/root/syz-executor2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457569 code=0x50000 [ 294.351341] audit: type=1326 audit(1540001185.331:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9806 comm="syz-executor2" exe="/root/syz-executor2" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457569 code=0x50000 02:06:25 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x90, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x108) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:25 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:25 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000007a80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:25 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x5451, &(0x7f0000000200)) 02:06:25 executing program 2: setsockopt$inet_sctp6_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000580), 0x4) r0 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) write$sndseq(0xffffffffffffffff, &(0x7f0000000140)=[{0xfff, 0x40000, 0x0, 0x0, @tick, {0x0, 0x1}, {}, @ext}], 0xffffffffffffff96) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000740)=ANY=[@ANYRES32=r0, @ANYRES16=r0, @ANYBLOB="e4d72c7592dba83234010bb53907b6490ea72bf4d94fa6c72c2edc4e4d114400779ac4eb665fcb3142ad00c2b1a9922541c5cc2f2ff32dd38eb2e753a6ad014d95802870d137ef7ed1c81bfddca24fb9aef1d7dc2e0a1ee6809558dd379d464fb179aab4fa81a712c316e84371469abc3753777e5cd40fda7acbc178e7c45777e3b45ca95c744452aaa43d1dbbf706541b2cfef56f95691981a5463ddc22fd2b57003e984ae3263ce4757dc6d076a2e22d191f4e69b5b0901879ef33454339bf5b6f4af9156b94f8386f79ba09a5997767acc00c50abe19cfefe19a52e2651dd10d1ef936d52ec067e51", @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYBLOB="1916c41b5d23e4ba5d219ddd919c4a1bcb1f564aa37bf7f63f5195bd72c69b497a41599c334ae63530aa23ab9fe0e818942e6c213521e5fd7c4bd1ccdff783d3875b92bc4b89c4a5b5e05adf64e4a2a4352d0bb164abaa175b2499323eecf2dffe1225b3d81d1b82ac69fab1ea51c56a10af0290e890728cefdb3298796bd2c32b859635815698a18f78770758b3e8399a", @ANYRES64=r1, @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYRESHEX=0x0, @ANYPTR64, @ANYRES32, @ANYBLOB="d3d9f711d3fc096586100f82cb28437ab344384ad13a9ca72038ea0922ed78858f6332848213330b30715e9e27d3d4e56521e816120bd163e9432a9f9ec4716769b5e887a6173a16795cf6ee79b2933b717ba497b4c91cb04f24c6d7ebf6a9d90f6ffaa3", @ANYRES64=r1, @ANYPTR64, @ANYRESOCT=r0], @ANYRESHEX=r0], @ANYRESHEX, @ANYPTR64=&(0x7f00000004c0)=ANY=[@ANYRESHEX, @ANYRES64, @ANYRESOCT=r0, @ANYRES16=r0, @ANYRES32=r0, @ANYRES32, @ANYRES64, @ANYRESOCT, @ANYRES64], @ANYRES16=0x0, @ANYRESHEX=r1], &(0x7f0000000180)=0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KDDISABIO(0xffffffffffffffff, 0x4b37) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'gretap0\x00'}) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, &(0x7f0000000700)={@mcast1, 0x3b}) mbind(&(0x7f0000ff4000/0xb000)=nil, 0xb000, 0x0, &(0x7f0000000280), 0x5, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000680)={0x3, 0x0, 0x80, 0x3d1}) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfd, 0x800}, 0xc) fcntl$setsig(r0, 0xa, 0xc) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000002c0)=ANY=[], &(0x7f00000003c0)) set_mempolicy(0x0, &(0x7f0000000380), 0x0) ioctl$UI_END_FF_UPLOAD(0xffffffffffffffff, 0x406855c9, &(0x7f00000005c0)={0x3, 0xa00000, {0x57, 0x9, 0x7, {0x6}, {0xcc, 0x7ffe}, @cond=[{0x4, 0x100, 0x0, 0x3, 0x101, 0xf8}, {0x2, 0x1, 0x10001, 0x9, 0x10000, 0x3f}]}, {0x56, 0x4, 0x4, {0x9, 0x80000001}, {0xc00000000000, 0xff}, @ramp={0x100000001, 0x1, {0x20, 0x2, 0x1, 0x4}}}}) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000040), 0x4) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x0, 0x0) seccomp(0x1, 0x2, &(0x7f0000007ff0)={0x1, &(0x7f0000004fe8)=[{0x6, 0x0, 0x0, 0x50000}]}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f00000001c0)={0x0, 0x0, 0x3}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000200)={0x0, 0x0, 0x6}) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000240)={0x0, 0x80, 0x6, [0x4, 0x4, 0x6, 0x3ff, 0x3, 0x100000001]}, &(0x7f0000000540)=0x14) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000640)={0x0, 0x5}, &(0x7f0000000880)=0x8) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000008c0)={r3, 0x100000000, 0x10001, 0x0, 0x7, 0x4, 0x400000, 0x2, {r4, @in={{0x2, 0x4e22, @remote}}, 0x6e, 0x0, 0x4, 0x10001, 0x5}}, &(0x7f0000000980)=0xb0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000000c0)="c744240020000000c74424024f000000c7442406000000000f011c24c4427d180508000000c4c245ae08c4e2850108b9800000c00f3235004000000f30d3559e67470f224205c814000066b89d000f00d0c423a95f2518410000e1", 0x5b}], 0x1, 0x0, &(0x7f0000000040), 0x4000) ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000009c0)) 02:06:25 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)}], 0x1) [ 294.528557] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 294.567301] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:25 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0xc020660b, &(0x7f0000000200)) [ 294.627359] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:25 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:25 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000001f80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:25 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000200)) 02:06:26 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)}], 0x1) 02:06:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2286, &(0x7f0000000200)) [ 294.888013] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 294.969234] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:26 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x90, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x108) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:26 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1267, &(0x7f0000000200)) 02:06:26 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fffffff680", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2286, &(0x7f0000000200)) 02:06:26 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)}], 0x1) 02:06:26 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227f, &(0x7f0000000200)) [ 295.431365] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 295.448243] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:26 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x90, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x108) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 295.497840] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:26 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:26 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2283, &(0x7f0000000200)) 02:06:26 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000380", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 295.585104] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x5460, &(0x7f0000000200)) 02:06:26 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f640094000500", 0x2c}], 0x1) 02:06:26 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:26 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) close(r0) 02:06:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x5385, &(0x7f0000000200)) 02:06:26 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2203, &(0x7f0000000200)) 02:06:27 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000006080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:27 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:27 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000000000), &(0x7f0000000340)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x1, 0x208200) getdents64(r0, &(0x7f0000000380)=""/238, 0xee) r1 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) mknodat(r1, &(0x7f00000001c0)='./file2\x00', 0x0, 0x0) getdents64(r1, &(0x7f00000002c0)=""/91, 0x5b) 02:06:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1274, &(0x7f0000000200)) 02:06:27 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) close(r0) 02:06:27 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f640094000500", 0x2c}], 0x1) 02:06:27 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="001f000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:27 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) close(r0) 02:06:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227b, &(0x7f0000000200)) [ 296.448171] tmpfs: No value for mount option '/dev/vcsa#' [ 296.473683] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 02:06:27 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) close(r0) 02:06:27 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0068000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:27 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2270, &(0x7f0000000200)) 02:06:27 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:28 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) close(r0) 02:06:28 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:28 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f640094000500", 0x2c}], 0x1) 02:06:28 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fdfdffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2287, &(0x7f0000000200)) 02:06:28 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000240), 0xc) close(r0) 02:06:28 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000240), 0xc) close(r0) 02:06:28 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) accept$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0x14) close(r0) 02:06:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2275, &(0x7f0000000200)) [ 297.213972] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 02:06:28 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000006c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:28 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000240), 0xc) close(r0) 02:06:28 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x5386, &(0x7f0000000200)) 02:06:28 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:28 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:28 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000", 0x42}], 0x1) 02:06:28 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x40049409, &(0x7f0000000200)) 02:06:28 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="004c000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:28 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:28 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1d8, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xa0, 0x110, 0x148, [@pkttype={'pkttype\x00', 0x8}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x250) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 297.686539] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 02:06:28 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:28 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x1276, &(0x7f0000000200)) 02:06:29 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="6800000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:29 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) mount$9p_virtio(&(0x7f0000000040)='vboxnet1wlan0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x8, &(0x7f0000000400)={'trans=virtio,', {[{@posixacl='posixacl'}, {@access_uid={'access', 0x3d, r1}}, {@posixacl='posixacl'}, {@cachetag={'cachetag', 0x3d, '{%cpuset@.[mime_type'}}, {@fscache='fscache'}, {@cache_mmap='cache=mmap'}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@access_client='access=client'}, {@posixacl='posixacl'}], [{@dont_appraise='dont_appraise'}, {@smackfsfloor={'smackfsfloor', 0x3d, '&][keyring'}}, {@uid_lt={'uid<', r2}}, {@rootcontext={'rootcontext', 0x3d, 'unconfined_u'}}, {@obj_user={'obj_user', 0x3d, "2d25261b637075736574"}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@fscontext={'fscontext', 0x3d, 'root'}}]}}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) [ 297.840851] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x2205, &(0x7f0000000200)) 02:06:29 executing program 2: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000002}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="a36030c157000000000000000000000000070000"], 0x1}}, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) listen(r0, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000140)={0xffff, 0x81, 0x3ff}) r2 = socket$inet(0x10, 0x80803, 0x4000000000000004) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f00000003c0)="4c0000001300ff09fffd956fa283b70000725b00000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d4c1cbc882b07988100", 0x4c}], 0x1}, 0x0) 02:06:29 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000", 0x42}], 0x1) 02:06:29 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x200002, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e23, 0x477e7c5f, @remote, 0x7fff}}}, &(0x7f0000000240)=0x84) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000280)={0x10001, 0xff, 0x8000, 0x4, 0x100000000, 0x40, 0x3, 0xdb6, r1}, &(0x7f0000000400)=0x20) r2 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r2, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000500)) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) write$binfmt_elf64(r2, &(0x7f0000000300)=ANY=[], 0xf6) r5 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x43, 0x0) bind$pptp(r5, &(0x7f0000000080)={0x18, 0x2, {0x1, @local}}, 0x1e) ioctl$sock_inet_SIOCGIFPFLAGS(r3, 0x8935, &(0x7f00000000c0)={'veth1_to_bridge\x00', 0x3}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000440)={0x0, 0x0}) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000480)=0x0) kcmp$KCMP_EPOLL_TFD(r6, r7, 0x7, r2, &(0x7f00000004c0)={r5, r0, 0x5f4a}) ioctl$SG_GET_NUM_WAITING(r2, 0x227c, &(0x7f0000000200)) 02:06:29 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@remote, @in=@remote}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f00000003c0)=0xe8) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:29 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="97ffffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:29 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_sctp(0xa, 0x200000000000005, 0x84) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000180)=0xc) syz_open_procfs(r2, &(0x7f00000001c0)='oom_score\x00') getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x76, &(0x7f0000000000), &(0x7f0000000080)=0x4) r3 = creat(&(0x7f00000000c0)='./file0\x00', 0x8) ioctl$TUNGETFEATURES(r3, 0x800454cf, &(0x7f0000000140)) 02:06:29 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @broadcast}, @in6=@ipv4={[], [], @loopback}}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000000280)=0xe8) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xfffffe9f) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getownex(r1, 0x10, &(0x7f0000000000)={0x0, 0x0}) capget(&(0x7f0000000080)={0x20071026, r2}, &(0x7f00000000c0)={0xfffffffffffffff9, 0xffffffff, 0x20, 0x7f, 0x800, 0x7}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:29 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1d8, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xa0, 0x110, 0x148, [@pkttype={'pkttype\x00', 0x8}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x250) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:29 executing program 2: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = socket(0x10, 0x1, 0x0) syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f) open(&(0x7f0000000e00)='./file1\x00', 0x0, 0x0) mount(&(0x7f0000000280)=ANY=[], &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, &(0x7f00000002c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='mountstats\x00') sendfile(r0, r1, &(0x7f0000000000), 0x800000080000002) accept4$packet(r1, 0x0, &(0x7f0000000040), 0x800) socket$inet6_sctp(0xa, 0x5, 0x84) 02:06:29 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0300000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:29 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000", 0x42}], 0x1) 02:06:29 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) fcntl$notify(r0, 0x402, 0xa) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffbf) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000000)=0x1) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:29 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 298.684291] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 298.713547] EXT4-fs: 17 callbacks suppressed [ 298.713559] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 298.830012] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) r1 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x0, 0x0) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, &(0x7f0000000140)=r2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, r0, 0x0) r4 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x2, 0x2001) r5 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:30 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000003f80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:30 executing program 3: write$P9_RLERRORu(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000240), 0xc) close(0xffffffffffffffff) 02:06:30 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd0000001000010009", 0x4d}], 0x1) 02:06:30 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0xffffff20, 0x1, @buffer={0x0, 0x0, &(0x7f0000000400)=""/4096}, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000000)=0x3) [ 299.112864] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 299.202368] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:30 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:30 executing program 2: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$9p_xen(&(0x7f0000000000)='msdos\x00', &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x2000, &(0x7f0000000240)=ANY=[@ANYBLOB="8a72616e733d0101000000"]) 02:06:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000000)='/dev/sg#\x00'}, 0x30) sched_rr_get_interval(r1, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x8082, 0x0) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:30 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1d8, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xa0, 0x110, 0x148, [@pkttype={'pkttype\x00', 0x8}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x250) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:30 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="ffffff8c80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:30 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd0000001000010009", 0x4d}], 0x1) 02:06:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000cfd000/0x4000)=nil, 0x4000, 0x0, 0x31, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) socket$unix(0x1, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000140)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000200)={r1}) fchdir(r0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x5) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r2 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) mknod(&(0x7f0000000440)='./file0/file1\x00', 0x0, 0x1) truncate(&(0x7f00000000c0)='./file0\x00', 0x6) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x10, &(0x7f0000000500)={0x1}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c832, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) [ 299.549190] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 299.572712] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000240)=ANY=[], 0xfffffffffffffc70) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:30 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x0, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:30 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 299.613347] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:30 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:30 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="003f000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xb91, 0x444200) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e24, 0x6, @ipv4={[], [], @loopback}, 0x17}}, 0x9, 0x80000001, 0xfffffffffffffff8, "ed8a10788a67afadf67a709cf2060ac7b5ae90ef6bd92671a6e029d2ba4708dc19cd3a5877a160c9a52c802609bbcd4382353413beb1dcf7ca3caed6f72bd43bc0b92deacfea66f4be02ea0e07027376"}, 0xd8) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000080)) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:30 executing program 2: r0 = semget(0x1, 0x0, 0x48) semctl$IPC_RMID(r0, 0x0, 0x0) r1 = open(&(0x7f00000007c0)='./file0\x00', 0x8004, 0x0) r2 = openat$random(0xffffffffffffff9c, &(0x7f0000000300)='/dev/urandom\x00', 0x0, 0x0) r3 = fcntl$getown(0xffffffffffffffff, 0x9) ptrace(0x4208, r3) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000800)='/dev/ppp\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f00000005c0)=@assoc_id=0x0, &(0x7f0000000600)=0x4) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000640)={r5, 0x10001, 0x1, 0x4}, &(0x7f0000000680)=0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setgroups(0x0, &(0x7f0000000500)=[0x0, 0x0]) socketpair$inet(0x2, 0x2, 0x1, &(0x7f0000000280)={0xffffffffffffffff}) getrandom(&(0x7f0000000180)=""/40, 0xffffffffffffff56, 0x2) socket$packet(0x11, 0x0, 0x300) write$UHID_SET_REPORT_REPLY(r4, &(0x7f0000000100)=ANY=[@ANYBLOB="f80000000500000000ff1c005281e91991f7ae0ec2e94630663b"], 0x1) setsockopt$netlink_NETLINK_CAP_ACK(r4, 0x10e, 0xa, &(0x7f00000002c0)=0x6, 0x1000001b5) setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000140)={@empty, @empty, 0x1, 0x6, [@loopback, @local, @local, @loopback, @multicast2, @loopback]}, 0x28) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000400)={{{@in6=@dev, @in6=@remote}}, {{@in=@rand_addr}}}, &(0x7f0000000340)=0xe8) getsockopt$inet6_dccp_int(r1, 0x21, 0x6, &(0x7f00000001c0), &(0x7f0000000200)=0x4) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000000280)=0x1f) syz_genetlink_get_family_id$fou(&(0x7f0000002d00)='fou\x00') sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x18, 0x0, 0x310, 0x70bd2a, 0x25dfdbfb, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000}, 0x20000010) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f00000000c0)) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) sendmsg$nl_netfilter(r4, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000840)={0x20, 0x13, 0x6, 0x300, 0x70bd25, 0x25dfdbfd, {0x3, 0x0, 0x9}, [@nested={0xc, 0x16, [@typed={0x8, 0x61, @ipv4=@loopback}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x44000}, 0x4000000) 02:06:30 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd0000001000010009", 0x4d}], 0x1) 02:06:30 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:31 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:31 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) r1 = timerfd_create(0x5, 0x80000) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x31, r1, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) r4 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000000, 0x100010, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x110, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x60, 0x30, &(0x7f00000000c0)=[@ptr={0x70742a85, 0x1, &(0x7f0000000080), 0x1, 0x3, 0x15}, @flat={0x73682a85, 0xa, r4, 0x4}, @fda={0x66646185, 0x8, 0x3, 0xf}], &(0x7f0000000140)=[0x38, 0x40, 0x28, 0x78, 0x78, 0x48]}}, @reply={0x40406301, {0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000180), &(0x7f00000001c0)=[0x0]}}, @reply={0x40406301, {0x4, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x0, 0x30, &(0x7f0000000240), &(0x7f0000000280)=[0x0, 0x20, 0x48, 0x78, 0x38, 0x48]}}, @transaction={0x40406300, {0x2, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x48, 0x28, &(0x7f0000000440)=[@ptr={0x70742a85, 0x1, &(0x7f0000000400), 0x1, 0x2, 0x3a}, @fda={0x66646185, 0x1, 0x3, 0x36}], &(0x7f00000004c0)=[0x68, 0x38, 0x20, 0x28, 0x68]}}], 0xc, 0x0, &(0x7f0000000640)="64966db810b402f6c2e14582"}) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) [ 299.977752] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000080), &(0x7f0000000100)=0x20) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000340)={0xfffffffffffffc8f}, 0x7) mkdir(&(0x7f0000000780)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@noextend='noextend'}]}}) write$P9_RREADDIR(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2a000000290100000000000000000000000000000000000000000000000000000007002e2f66696c6530"], 0x2a) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000040)=0x3) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWALK(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="160000006f0100010000000000751c00000000000000"], 0x16) write$P9_RGETATTR(r1, &(0x7f0000000540)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RGETATTR(r1, &(0x7f0000000640)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000008c0)='9p\x00', 0x0, &(0x7f0000000a80)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose='cache=loose'}]}}) socketpair$inet6(0xa, 0x802, 0x0, &(0x7f0000000400)) syz_extract_tcp_res$synack(&(0x7f00000000c0), 0x1, 0x0) utime(&(0x7f0000000440)='./file0/file0\x00', &(0x7f0000000480)={0x401, 0xc72}) 02:06:31 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 300.043874] xt_connbytes: cannot load conntrack support for proto=7 [ 300.057514] xt_connbytes: Forcing CT accounting to be enabled [ 300.081360] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:31 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0xfffffffffffffffe, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) r1 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x3, 0x0) write$P9_RSTATFS(r1, &(0x7f00000000c0)={0x43, 0x9, 0x2, {0x3, 0x9, 0x8, 0x40, 0x8, 0x8001, 0x3, 0x3, 0x2}}, 0x43) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80000, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:31 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:31 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400", 0x53}], 0x1) 02:06:31 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="006c000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:31 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:31 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[], 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 300.360045] xt_connbytes: cannot load conntrack support for proto=7 02:06:31 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[], 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:31 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000000)='./file0\x00') ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000080), &(0x7f0000000100)=0x20) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000340)={0xfffffffffffffc8f}, 0x7) mkdir(&(0x7f0000000780)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@noextend='noextend'}]}}) write$P9_RREADDIR(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2a000000290100000000000000000000000000000000000000000000000000000007002e2f66696c6530"], 0x2a) fcntl$F_SET_RW_HINT(r1, 0x40c, &(0x7f0000000040)=0x3) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWALK(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="160000006f0100010000000000751c00000000000000"], 0x16) write$P9_RGETATTR(r1, &(0x7f0000000540)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RGETATTR(r1, &(0x7f0000000640)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000008c0)='9p\x00', 0x0, &(0x7f0000000a80)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose='cache=loose'}]}}) socketpair$inet6(0xa, 0x802, 0x0, &(0x7f0000000400)) syz_extract_tcp_res$synack(&(0x7f00000000c0), 0x1, 0x0) utime(&(0x7f0000000440)='./file0/file0\x00', &(0x7f0000000480)={0x401, 0xc72}) [ 300.428947] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:31 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[], 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 300.506544] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:31 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0600000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:31 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400", 0x53}], 0x1) 02:06:31 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x220902, 0x0) 02:06:32 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1e8, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xb0, 0x120, 0x158, [@connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x260) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:32 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:32 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000380)={&(0x7f0000be1000/0x2000)=nil, 0x2000}) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r1, 0x4008ae48, &(0x7f0000000180)=0x6000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000003c0), 0x111}}, 0x1b) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000001c0)={0x0, 0x5, 0x30, 0x10000}, &(0x7f00000004c0)=0x18) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000580)={r3, 0x58, &(0x7f0000000500)=[@in={0x2, 0x4e23, @local}, @in6={0xa, 0x4e22, 0x7ff, @remote, 0x3ff}, @in={0x2, 0x4e20, @remote}, @in6={0xa, 0x4e22, 0x2, @empty, 0x5}]}, &(0x7f00000005c0)=0x10) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x3e) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000340)={0x0, r0, 0x7, 0x6, 0x0, 0xfc000000000}) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000280)={0x0, 0x4}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000480)={r5, 0x8000}, &(0x7f0000000440)=0x8) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000080)=r4) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2000003, 0x401, 0x0) fcntl$setstatus(r2, 0x4, 0x2000) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000000100)={0x0, 0xffffffffffffffc0}, &(0x7f0000000140)=0x8) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r4, 0x80045530, &(0x7f0000000300)=""/7) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00010, 0x1, &(0x7f00000000c0)=0x37000000, 0x1, 0x2000000000002) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200), 0x0, 0x7}}, 0x20) socket$inet6_sctp(0xa, 0x1, 0x84) 02:06:32 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000080)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:32 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="f6ffffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:32 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:32 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1e8, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xb0, 0x120, 0x158, [@connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x260) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 300.939516] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:32 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x2480, 0x0) ioctl$NBD_SET_FLAGS(r2, 0xab0a, 0x4) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:32 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400", 0x53}], 0x1) 02:06:32 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="f5ffffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 301.123983] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:32 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:32 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227c, &(0x7f0000000200)) 02:06:32 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff"], 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:32 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1e8, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xb0, 0x120, 0x158, [@connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x260) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 301.571779] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:33 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:33 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000", 0x56}], 0x1) 02:06:33 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fffffff580", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:33 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1e0, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x118, 0x150, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x258) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socket$netlink(0x10, 0x3, 0x1f) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0x7f}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000100)={r3, 0x2, 0x4}, 0x8) 02:06:33 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff"], 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:33 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff"], 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 302.523267] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 302.548935] xt_connbytes: cannot load conntrack support for proto=7 [ 302.557505] xt_connbytes: Forcing CT accounting to be enabled 02:06:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x4) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x1) 02:06:33 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000240), 0xc) close(r0) 02:06:33 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0007000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:33 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x111000, 0x0) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00') sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x40, r2, 0x2, 0x70bd2c, 0x25dfdbfb, {}, [@FOU_ATTR_IPPROTO={0x8, 0x3, 0x1d}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x37}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x16}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x40}}, 0x1) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x5) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x400000, 0x0) write$P9_RUNLINKAT(r4, &(0x7f0000000080)={0x7, 0x4d, 0x1}, 0x7) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) 02:06:33 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000", 0x56}], 0x1) 02:06:34 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = dup3(r0, r0, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000340)={[{0x2, 0x4, 0x6, 0x1, 0x11e7, 0x8, 0xf99e, 0x7, 0x1, 0x1000, 0x7fff, 0xe69, 0x8166}, {0x0, 0x4, 0x6, 0x3f, 0x3, 0x3, 0x1, 0x6, 0x800, 0x0, 0x2d80000000000, 0x4, 0xf3}, {0x9, 0x3032, 0x11d0, 0x2000000000000, 0x571a, 0x3ff, 0xac, 0x3, 0x1, 0x0, 0x3059, 0xfffffffffffffffd, 0x81}], 0x8}) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000002ec0)={0x7a7, 0xfffffffffffffffe}) perf_event_open(&(0x7f0000000400)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x4}, 0x0, 0xffffffffffffffff, r1, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @empty, 0xaf98}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000003c0)='ip6_vti0\x00', 0x10) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200), &(0x7f0000000240)=0x6) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x80000000000004, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000002c0)={@mcast1, @local, @empty, 0x1, 0x0, 0x0, 0x400, 0xffffffffffffffff}) connect$l2tp(r3, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000080)=0x7fffffff, 0x279) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000002dc0)={@mcast1, 0x0, 0x2, 0x0, 0x0, 0xc9d, 0x0, 0x7fff}, 0x20) ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2) sendmmsg(r3, &(0x7f0000005fc0), 0x800000000000059, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000000)={0x20000000}) 02:06:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$int_in(r0, 0x5421, &(0x7f00000000c0)=0x9) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000100)={&(0x7f000032a000/0x4000)=nil, 0x4000}, &(0x7f0000000140)=0x10) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:34 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000240), 0xc) close(r0) 02:06:34 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000", 0x56}], 0x1) 02:06:34 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0005000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:34 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1e0, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x118, 0x150, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x258) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:34 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1e0, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x118, 0x150, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x258) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 303.307437] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:34 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000240), 0xc) close(r0) 02:06:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) ftruncate(r1, 0x7f) [ 303.430475] Dead loop on virtual device ip6_vti0, fix it urgently! 02:06:34 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="2d00000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 303.473834] Dead loop on virtual device ip6_vti0, fix it urgently! [ 303.482696] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 303.488570] Dead loop on virtual device ip6_vti0, fix it urgently! 02:06:34 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = accept(r1, &(0x7f0000000080)=@rc, &(0x7f0000000000)=0x80) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000100)=[{0xa, 0x8}], 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:34 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(0xffffffffffffffff) [ 303.527972] Dead loop on virtual device ip6_vti0, fix it urgently! [ 303.540755] Dead loop on virtual device ip6_vti0, fix it urgently! [ 303.611194] Dead loop on virtual device ip6_vti0, fix it urgently! 02:06:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x4, 0x10000) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:35 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fc", 0x57}], 0x1) 02:06:35 executing program 3 (fault-call:4 fault-nth:0): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:35 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = dup3(r0, r0, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000340)={[{0x2, 0x4, 0x6, 0x1, 0x11e7, 0x8, 0xf99e, 0x7, 0x1, 0x1000, 0x7fff, 0xe69, 0x8166}, {0x0, 0x4, 0x6, 0x3f, 0x3, 0x3, 0x1, 0x6, 0x800, 0x0, 0x2d80000000000, 0x4, 0xf3}, {0x9, 0x3032, 0x11d0, 0x2000000000000, 0x571a, 0x3ff, 0xac, 0x3, 0x1, 0x0, 0x3059, 0xfffffffffffffffd, 0x81}], 0x8}) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000002ec0)={0x7a7, 0xfffffffffffffffe}) perf_event_open(&(0x7f0000000400)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x4}, 0x0, 0xffffffffffffffff, r1, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @empty, 0xaf98}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000003c0)='ip6_vti0\x00', 0x10) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000200), &(0x7f0000000240)=0x6) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x80000000000004, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f00000002c0)={@mcast1, @local, @empty, 0x1, 0x0, 0x0, 0x400, 0xffffffffffffffff}) connect$l2tp(r3, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000080)=0x7fffffff, 0x279) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000002dc0)={@mcast1, 0x0, 0x2, 0x0, 0x0, 0xc9d, 0x0, 0x7fff}, 0x20) ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2) sendmmsg(r3, &(0x7f0000005fc0), 0x800000000000059, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000000)={0x20000000}) 02:06:35 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0900000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 304.051544] FAULT_INJECTION: forcing a failure. [ 304.051544] name failslab, interval 1, probability 0, space 0, times 0 [ 304.067629] EXT4-fs: 14 callbacks suppressed [ 304.067653] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 304.112185] CPU: 0 PID: 10522 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 304.119507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 304.128878] Call Trace: [ 304.131521] dump_stack+0x1c4/0x2b4 [ 304.135175] ? dump_stack_print_info.cold.2+0x52/0x52 [ 304.140396] should_fail.cold.4+0xa/0x17 [ 304.144480] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 304.149598] ? graph_lock+0x170/0x170 [ 304.153427] ? mark_held_locks+0xc7/0x130 [ 304.157594] ? lock_acquire+0x1ed/0x520 [ 304.161656] ? hci_unregister_dev+0x7cc/0x990 [ 304.166176] ? lock_release+0x970/0x970 [ 304.170168] ? arch_local_save_flags+0x40/0x40 [ 304.174769] ? hci_dev_do_close+0xee7/0x1180 [ 304.179215] ? lock_downgrade+0x900/0x900 [ 304.183389] ? graph_lock+0x170/0x170 [ 304.187204] ? __mutex_lock+0x85e/0x1700 [ 304.191294] ? hci_unregister_dev+0x7cc/0x990 [ 304.195801] ? cancel_delayed_work+0x20a/0x3e0 [ 304.200410] __should_failslab+0x124/0x180 [ 304.204670] should_failslab+0x9/0x14 [ 304.208514] kmem_cache_alloc_node+0x56/0x730 [ 304.213096] __alloc_skb+0x119/0x770 [ 304.216834] ? skb_scrub_packet+0x490/0x490 [ 304.221187] ? kasan_check_write+0x14/0x20 [ 304.225438] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 304.230387] ? wait_for_completion+0x8a0/0x8a0 [ 304.235053] hci_sock_dev_event+0x1ee/0x740 [ 304.239390] ? mgmt_index_removed+0x16d/0x410 [ 304.243923] ? hci_send_monitor_ctrl_event+0x520/0x520 [ 304.249230] ? do_raw_write_trylock+0x1c0/0x1c0 [ 304.253935] hci_unregister_dev+0x335/0x990 [ 304.258273] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 304.263098] ? ima_file_check+0x130/0x130 [ 304.267308] ? vhci_close_dev+0x50/0x50 [ 304.271316] vhci_release+0x76/0xf0 [ 304.274962] __fput+0x385/0xa30 [ 304.278266] ? get_max_files+0x20/0x20 [ 304.282167] ? trace_hardirqs_on+0xbd/0x310 [ 304.286515] ? kasan_check_read+0x11/0x20 [ 304.290682] ? task_work_run+0x1af/0x2a0 [ 304.294761] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 304.300228] ? kasan_check_write+0x14/0x20 [ 304.304480] ? do_raw_spin_lock+0xc1/0x200 [ 304.308741] ____fput+0x15/0x20 [ 304.312042] task_work_run+0x1e8/0x2a0 [ 304.315943] ? task_work_cancel+0x240/0x240 [ 304.320278] ? copy_fd_bitmaps+0x210/0x210 [ 304.324528] ? do_syscall_64+0x9a/0x820 [ 304.328519] exit_to_usermode_loop+0x318/0x380 [ 304.333122] ? syscall_slow_exit_work+0x520/0x520 [ 304.337980] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 304.343542] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 304.349097] do_syscall_64+0x6be/0x820 [ 304.353005] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 304.358377] ? syscall_return_slowpath+0x5e0/0x5e0 [ 304.363319] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 304.368166] ? trace_hardirqs_on_caller+0x310/0x310 [ 304.373198] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 304.378230] ? prepare_exit_to_usermode+0x291/0x3b0 [ 304.383276] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 304.388146] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 304.393342] RIP: 0033:0x457569 02:06:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfff, 0x212600) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYBLOB="17000008b77851ca396a48f953a3ab938eb9c7004bb63e04dc326c"], &(0x7f00000000c0)=0x1f) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000100)={r3, 0x7}, 0xc) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:35 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1e0, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x118, 0x150, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x258) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:35 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fc", 0x57}], 0x1) 02:06:35 executing program 2: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x0, &(0x7f0000000040), 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="85c59e8daf2474b5324706662cd4b77bc5c4ce67cfb81be8b44c"]) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x80000000) lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) [ 304.393360] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 304.393368] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 304.393384] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 304.393393] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 304.393401] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 304.393411] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 304.393425] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 02:06:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) io_setup(0x8abd, &(0x7f0000000000)=0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x501500, 0x0) io_cancel(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x8, 0x2, r0, &(0x7f0000000080)="a3aff2d9353ed5db7dbf831f4c27cbb78b37cdb0983073d8e6dddb3341d542180a55dd51acb5", 0x26, 0x6, 0x0, 0x3, r2}, &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) fcntl$getown(r3, 0x9) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:35 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1e0, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x118, 0x150, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x258) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 304.485953] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 304.518300] kernel msg: ebtables bug: please report to author: Valid hook without chain 02:06:35 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="1000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:35 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x1e0, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x118, 0x150, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x258) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:35 executing program 2: mq_open(&(0x7f0000000080)='eth0\x00', 0x42, 0x0, &(0x7f0000000000)) r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000500)={0x28, 0x0, 0x2710, @my=0x1}, 0x10, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000580)={'veth0_to_bond\x00', 0x1}) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='sysv\x00', 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r1, 0xab07, 0x1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000140)=[{0x2, 0x400}, {0x0, 0x10001}, {0xb, 0xfffffffffffffff8}], 0x3) mkdir(&(0x7f0000000180)='./file0//ile0\x00', 0x0) r2 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000280)={0x0, 0x100, 0x30}, &(0x7f0000000380)=0xc) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f00000003c0)={r3, 0xdb, "43c388d17c22178168bde05cb34074d7d3946348d4b2ce3934d2ff5036971d9627c0c3f81987d8b54b10ff2fe33d396a65196421c5a15494927d77b2411a8cd5e082b7afacfd9036130a448ee9f7672ee56c7677321d1eaad9227fb9a0994165f5573163ea7a472d4dc0d6653c7e140a69c352a1e9b96eb9deb2dd9f99a161070c6edc2d0221d405cce02b4ba42657345f52736cb372a346ddca563a096c37d3f12d3f976e9f70917cca1c4a01636742739b86daf502b5dda7daf8afc3902ba0dda967697c83de7a4a7a267ca9fafa071b14bb639a9ae75db3dc5f"}, &(0x7f00000004c0)=0xe3) syz_genetlink_get_family_id$fou(&(0x7f00000001c0)='fou\x00') write$UHID_GET_REPORT_REPLY(r2, &(0x7f00000002c0)={0xa, 0x8, 0xfff, 0x9}, 0xa) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f00000006c0)={{0xa, 0x0, 0x1, @ipv4={[], [], @multicast1}}, {0xa, 0x4e23, 0x3ff, @mcast1}, 0x4, [0x0, 0x4, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x3]}, 0x5c) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x3, 0xffffffffffffffff, 0x0) rmdir(&(0x7f0000000340)='./file0//ile0\x00') setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000240)=0x2, 0x4) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5, 0x101, 0x4, 0x200, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x8, 0x100000001, 0x0, 0x0, 0x12000, 0x400000000, 0x0, 0x6, 0x768a, 0x100000000, 0x0, 0x7ff, 0x0, 0xf7, 0x2, 0x0, 0x0, 0x2a5b, 0x0, 0x0, 0xffffffffffff7fff, 0x0, 0xc013, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040)}, 0x0, 0x7, 0x5, 0x0, 0xffffffff, 0x4}, 0x0, 0xc, 0xffffffffffffffff, 0x3) 02:06:35 executing program 3 (fault-call:4 fault-nth:1): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 304.624085] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 304.738449] kernel msg: ebtables bug: please report to author: Valid hook without chain [ 304.767689] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 304.778091] FAULT_INJECTION: forcing a failure. [ 304.778091] name failslab, interval 1, probability 0, space 0, times 0 [ 304.810007] CPU: 0 PID: 10564 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 304.817308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 304.826677] Call Trace: [ 304.829291] dump_stack+0x1c4/0x2b4 [ 304.832953] ? dump_stack_print_info.cold.2+0x52/0x52 [ 304.838498] should_fail.cold.4+0xa/0x17 [ 304.842580] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 304.847703] ? __save_stack_trace+0x8d/0xf0 [ 304.852067] ? save_stack+0xa9/0xd0 [ 304.855718] ? save_stack+0x43/0xd0 02:06:35 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x100, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:36 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fc", 0x57}], 0x1) [ 304.859351] ? kasan_kmalloc+0xc7/0xe0 [ 304.863248] ? kasan_slab_alloc+0x12/0x20 [ 304.867405] ? kmem_cache_alloc_node+0x144/0x730 [ 304.872170] ? __alloc_skb+0x119/0x770 [ 304.876077] ? hci_sock_dev_event+0x1ee/0x740 [ 304.880592] ? hci_unregister_dev+0x335/0x990 [ 304.885138] ? vhci_release+0x76/0xf0 [ 304.888941] ? __fput+0x385/0xa30 [ 304.892412] ? ____fput+0x15/0x20 [ 304.895879] ? task_work_run+0x1e8/0x2a0 [ 304.899968] ? exit_to_usermode_loop+0x318/0x380 [ 304.904739] ? do_syscall_64+0x6be/0x820 02:06:36 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x800, 0x0) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 304.908815] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 304.914193] ? hci_unregister_dev+0x7cc/0x990 [ 304.918714] ? lock_release+0x970/0x970 [ 304.922708] ? arch_local_save_flags+0x40/0x40 [ 304.927303] ? hci_dev_do_close+0xee7/0x1180 [ 304.931736] ? lock_downgrade+0x900/0x900 [ 304.935909] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 304.941461] ? check_preemption_disabled+0x48/0x200 [ 304.946502] ? check_preemption_disabled+0x48/0x200 [ 304.951534] __should_failslab+0x124/0x180 [ 304.955783] should_failslab+0x9/0x14 02:06:36 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x8680, 0x0) ioctl$LOOP_SET_FD(r2, 0x4c00, r0) [ 304.959623] kmem_cache_alloc_node_trace+0x5a/0x740 [ 304.964693] __kmalloc_node_track_caller+0x33/0x70 [ 304.969655] __kmalloc_reserve.isra.39+0x41/0xe0 [ 304.974433] __alloc_skb+0x155/0x770 [ 304.978164] ? skb_scrub_packet+0x490/0x490 [ 304.982528] ? kasan_check_write+0x14/0x20 [ 304.986800] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 304.991747] ? wait_for_completion+0x8a0/0x8a0 [ 304.996357] hci_sock_dev_event+0x1ee/0x740 [ 305.000694] ? mgmt_index_removed+0x16d/0x410 [ 305.005211] ? hci_send_monitor_ctrl_event+0x520/0x520 02:06:36 executing program 1: set_tid_address(&(0x7f0000000000)) r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f00000000c0)) [ 305.010505] ? do_raw_write_trylock+0x1c0/0x1c0 [ 305.015213] hci_unregister_dev+0x335/0x990 [ 305.019550] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 305.024319] ? ima_file_check+0x130/0x130 [ 305.028493] ? vhci_close_dev+0x50/0x50 [ 305.032484] vhci_release+0x76/0xf0 [ 305.036130] __fput+0x385/0xa30 [ 305.039425] ? get_max_files+0x20/0x20 [ 305.043331] ? trace_hardirqs_on+0xbd/0x310 [ 305.047671] ? kasan_check_read+0x11/0x20 [ 305.051834] ? task_work_run+0x1af/0x2a0 [ 305.055916] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 305.061383] ? kasan_check_write+0x14/0x20 [ 305.065646] ? do_raw_spin_lock+0xc1/0x200 [ 305.069887] ____fput+0x15/0x20 [ 305.073170] task_work_run+0x1e8/0x2a0 [ 305.077073] ? task_work_cancel+0x240/0x240 [ 305.077096] ? copy_fd_bitmaps+0x210/0x210 [ 305.077112] ? do_syscall_64+0x9a/0x820 [ 305.077133] exit_to_usermode_loop+0x318/0x380 [ 305.089668] ? syscall_slow_exit_work+0x520/0x520 [ 305.089686] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 305.089707] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.089729] do_syscall_64+0x6be/0x820 [ 305.089745] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 305.089765] ? syscall_return_slowpath+0x5e0/0x5e0 [ 305.110260] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 305.110280] ? trace_hardirqs_on_caller+0x310/0x310 [ 305.110298] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 305.110317] ? prepare_exit_to_usermode+0x291/0x3b0 [ 305.110340] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 305.110369] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 305.119603] RIP: 0033:0x457569 [ 305.119619] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 305.119629] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 305.119656] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 305.119666] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 305.119675] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 305.119685] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 305.119695] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 02:06:36 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x50, &(0x7f0000000000), &(0x7f0000000140)=0x30) getsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) 02:06:36 executing program 5 (fault-call:7 fault-nth:0): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:36 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000080)={0x1, 0x0, 0x49, 0x0, @buffer={0x0, 0x0, &(0x7f0000000400)=""/153}, &(0x7f0000000100)="cb57b9d5b38618a4f59c902c47c8f1e122c976d17bac34cef310991ded301738704b47f1c5f8ec8042c311ce5eafd27a2bed4a471acd6442e4219f858d1f82c12a4c32215a5eac59b3e448049393d96ef8959113fb250a0022730ff48336a9f80b8158b831aedb50e04eb1361559e67d3e0c322a5b271b4792d4867a4aad34a22ab4c141b9158211bdf9b7bc9be8300bf7e717a20e86f24315431df0f5990100000000", &(0x7f0000000300)=""/126, 0x0, 0x0, 0x3, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 305.271321] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:36 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00000c7d80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 305.418799] FAULT_INJECTION: forcing a failure. [ 305.418799] name failslab, interval 1, probability 0, space 0, times 0 [ 305.453357] CPU: 1 PID: 10603 Comm: syz-executor5 Not tainted 4.19.0-rc8+ #69 [ 305.460691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 305.470051] Call Trace: [ 305.472654] dump_stack+0x1c4/0x2b4 [ 305.476280] ? dump_stack_print_info.cold.2+0x52/0x52 [ 305.481492] should_fail.cold.4+0xa/0x17 [ 305.485541] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 305.490671] ? rcu_bh_qs+0xc0/0xc0 [ 305.494256] ? __netlink_insert+0xd2c/0x13b0 [ 305.498660] ? __netlink_insert+0xd2c/0x13b0 [ 305.503075] ? graph_lock+0x170/0x170 [ 305.506896] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 305.512427] ? graph_lock+0x170/0x170 [ 305.516212] ? graph_lock+0x170/0x170 [ 305.520001] ? find_held_lock+0x36/0x1c0 [ 305.524067] ? ___might_sleep+0x1ed/0x300 [ 305.528292] ? __local_bh_enable_ip+0x160/0x260 [ 305.532961] ? arch_local_save_flags+0x40/0x40 [ 305.537529] ? trace_hardirqs_on+0xbd/0x310 [ 305.541839] ? _raw_spin_unlock_bh+0x30/0x40 [ 305.546250] __should_failslab+0x124/0x180 [ 305.550469] should_failslab+0x9/0x14 [ 305.554289] kmem_cache_alloc_node+0x26e/0x730 [ 305.558856] ? __local_bh_enable_ip+0x160/0x260 [ 305.563529] ? _raw_spin_unlock_bh+0x30/0x40 [ 305.567926] __alloc_skb+0x119/0x770 [ 305.571624] ? skb_scrub_packet+0x490/0x490 [ 305.575938] ? netlink_insert+0x15a/0x3f0 [ 305.580070] ? __netlink_insert+0x13b0/0x13b0 [ 305.584564] ? graph_lock+0x170/0x170 [ 305.588353] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.593875] ? netlink_autobind.isra.34+0x232/0x310 [ 305.598877] netlink_sendmsg+0xb29/0xfc0 [ 305.602928] ? netlink_unicast+0x760/0x760 [ 305.607152] ? smack_socket_sendmsg+0xb0/0x190 [ 305.611723] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.617291] ? security_socket_sendmsg+0x94/0xc0 [ 305.622040] ? netlink_unicast+0x760/0x760 [ 305.626284] sock_sendmsg+0xd5/0x120 [ 305.629990] sock_write_iter+0x35e/0x5c0 [ 305.634038] ? sock_sendmsg+0x120/0x120 [ 305.638006] do_iter_readv_writev+0x8b0/0xa80 [ 305.642490] ? vfs_dedupe_file_range+0x670/0x670 [ 305.647232] ? rw_copy_check_uvector+0x310/0x3e0 [ 305.651974] ? rw_verify_area+0x118/0x360 [ 305.656108] do_iter_write+0x185/0x5f0 [ 305.660008] ? dup_iter+0x270/0x270 [ 305.663625] ? proc_cwd_link+0x1d0/0x1d0 [ 305.667729] vfs_writev+0x1f1/0x360 [ 305.671340] ? vfs_iter_write+0xb0/0xb0 [ 305.675303] ? wait_for_completion+0x8a0/0x8a0 [ 305.679885] ? __lock_is_held+0xb5/0x140 [ 305.683942] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 305.689476] ? __fdget_pos+0xde/0x200 [ 305.693262] ? __fdget_raw+0x20/0x20 [ 305.696961] ? __sb_end_write+0xd9/0x110 [ 305.701011] do_writev+0x11a/0x310 [ 305.704550] ? vfs_writev+0x360/0x360 [ 305.708336] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 305.713775] __x64_sys_writev+0x75/0xb0 [ 305.717752] do_syscall_64+0x1b9/0x820 [ 305.721624] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 305.726980] ? syscall_return_slowpath+0x5e0/0x5e0 [ 305.731897] ? trace_hardirqs_on_caller+0x310/0x310 [ 305.736905] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 305.741945] ? recalc_sigpending_tsk+0x180/0x180 [ 305.746691] ? kasan_check_write+0x14/0x20 [ 305.750916] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 305.755748] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 305.760919] RIP: 0033:0x457569 [ 305.764099] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 305.782983] RSP: 002b:00007fa30ffadc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 305.790677] RAX: ffffffffffffffda RBX: 00007fa30ffadc90 RCX: 0000000000457569 [ 305.797929] RDX: 0000000000000001 RSI: 0000000020e11ff0 RDI: 0000000000000004 [ 305.805181] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 305.812431] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa30ffae6d4 02:06:37 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:37 executing program 3 (fault-call:4 fault-nth:2): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:37 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) r1 = dup3(r0, r0, 0x80000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000001e80)={'vcan0\x00', 0x0}) sendmsg$xdp(r1, &(0x7f0000001f80)={&(0x7f0000001ec0)={0x2c, 0x2, r2, 0x9}, 0x10, &(0x7f0000001f40)=[{&(0x7f0000001f00)="daaf15373a0d1169417fc229a69e14e007d2f63d638033c78a46d53cc6e516a3", 0x20}], 0x1, 0x0, 0x0, 0x1}, 0x48004) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) r4 = add_key(&(0x7f0000000000)='cifs.idmap\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)="edc65558608d6d856266a08996aabb03139d1388846de8cdd93e0eab6af1545b2225c0d6386984cf28690d21e7aab36a8a684326b686125ba131e80a1736b19dd5623841ff60125281bdc13ad8b52380a4d7fa13f4859c6a53b15004478301cb94de90acfd71c3804d2dc916f74a09f6d8f8f538d164adb1949d44c127deb4adb96f9dfb8e21f881d4be7673a765590fcba51f48ad22bdcaf13ca7ab8acb3d1f181f8b626129c6cfdd496f2e13b13bb0bda2a59fa9bbac9660021cf5f9fa5026", 0xc0, 0xfffffffffffffffc) r5 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$link(0x8, r4, r5) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:37 executing program 2: mknod$loop(&(0x7f0000000140)='./file0\x00', 0x2000, 0xffffffffffffffff) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)=@known='trusted.syz\x00', &(0x7f0000000100)='/vmnet0\x00', 0x11f, 0x0) unlink(&(0x7f0000000000)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x220901, 0x10) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f00000000c0)={0x8, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}]}) [ 305.819684] R13: 00000000004c30b5 R14: 00000000004d9078 R15: 0000000000000007 02:06:37 executing program 5 (fault-call:7 fault-nth:1): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 305.948803] FAULT_INJECTION: forcing a failure. [ 305.948803] name failslab, interval 1, probability 0, space 0, times 0 [ 305.950425] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 305.983972] kernel msg: ebtables bug: please report to author: bad policy [ 305.998484] CPU: 0 PID: 10612 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 306.005797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 306.015155] Call Trace: [ 306.017768] dump_stack+0x1c4/0x2b4 [ 306.021432] ? dump_stack_print_info.cold.2+0x52/0x52 [ 306.026645] should_fail.cold.4+0xa/0x17 [ 306.030698] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 306.035803] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.041357] ? wake_up_klogd+0x11a/0x180 [ 306.045425] ? console_device+0xc0/0xc0 [ 306.049413] ? graph_lock+0x170/0x170 [ 306.053217] ? __down_trylock_console_sem+0x155/0x200 [ 306.058418] ? vprintk_emit+0x268/0x930 [ 306.062385] ? find_held_lock+0x36/0x1c0 [ 306.066457] ? ___might_sleep+0x1ed/0x300 [ 306.070591] ? arch_local_save_flags+0x40/0x40 [ 306.075164] ? vprintk_default+0x28/0x30 [ 306.079232] __should_failslab+0x124/0x180 [ 306.083459] should_failslab+0x9/0x14 [ 306.087250] kmem_cache_alloc_trace+0x2d7/0x750 [ 306.091922] kobject_uevent_env+0x2f3/0x101e [ 306.096320] ? sysfs_remove_group+0xf6/0x1b0 [ 306.100735] kobject_uevent+0x1f/0x24 [ 306.104567] device_del+0x6c9/0xb70 [ 306.108190] ? __device_links_no_driver+0x320/0x320 [ 306.113233] rfkill_unregister+0x137/0x480 [ 306.117460] ? hci_sock_dev_event+0x10b/0x740 [ 306.121940] ? mgmt_index_removed+0x16d/0x410 [ 306.126425] ? rfkill_register+0xe00/0xe00 [ 306.130658] ? do_raw_write_trylock+0x1c0/0x1c0 [ 306.135323] hci_unregister_dev+0x360/0x990 [ 306.139644] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 306.144424] ? ima_file_check+0x130/0x130 [ 306.148592] ? vhci_close_dev+0x50/0x50 [ 306.152578] vhci_release+0x76/0xf0 [ 306.156218] __fput+0x385/0xa30 [ 306.159504] ? get_max_files+0x20/0x20 [ 306.163400] ? trace_hardirqs_on+0xbd/0x310 [ 306.167731] ? kasan_check_read+0x11/0x20 [ 306.171879] ? task_work_run+0x1af/0x2a0 [ 306.175934] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 306.181372] ? kasan_check_write+0x14/0x20 [ 306.185602] ? do_raw_spin_lock+0xc1/0x200 [ 306.189837] ____fput+0x15/0x20 [ 306.193114] task_work_run+0x1e8/0x2a0 [ 306.197009] ? task_work_cancel+0x240/0x240 [ 306.201319] ? copy_fd_bitmaps+0x210/0x210 [ 306.205543] ? do_syscall_64+0x9a/0x820 [ 306.209506] exit_to_usermode_loop+0x318/0x380 [ 306.214093] ? syscall_slow_exit_work+0x520/0x520 [ 306.218948] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 306.224492] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.230018] do_syscall_64+0x6be/0x820 [ 306.233896] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 306.239255] ? syscall_return_slowpath+0x5e0/0x5e0 [ 306.244174] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 306.249022] ? trace_hardirqs_on_caller+0x310/0x310 [ 306.254029] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 306.259035] ? prepare_exit_to_usermode+0x291/0x3b0 [ 306.264042] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 306.268893] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 306.274095] RIP: 0033:0x457569 [ 306.277313] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 306.296224] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 306.303926] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 306.311201] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 306.318458] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 306.325711] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 306.332963] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 02:06:37 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:37 executing program 2: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000200)='./file1\x00', 0x0) fallocate(r1, 0x1, 0x0, 0x2000000003) 02:06:37 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) openat$null(0xffffffffffffff9c, &(0x7f0000000540)='/dev/null\x00', 0x80, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) fstat(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x5, &(0x7f0000000000)=[0xee00, 0xee00, 0xffffffffffffffff, 0xee00, 0xee00]) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setresgid(r1, r2, r4) r5 = syz_open_procfs(r3, &(0x7f0000000440)='net/anycast6\x00') setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000480)={0x101, {{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x21}}}}, 0x88) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) write$binfmt_elf64(r6, &(0x7f0000000440)=ANY=[], 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000008c0)) r8 = accept4(r7, &(0x7f0000000180)=@in={0x2, 0x0, @multicast1}, &(0x7f0000000240)=0x80, 0x800) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r8, 0x29, 0x32, &(0x7f0000000400)={@loopback, r9}, 0x14) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 306.362358] FAULT_INJECTION: forcing a failure. [ 306.362358] name failslab, interval 1, probability 0, space 0, times 0 [ 306.411246] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 306.421598] CPU: 1 PID: 10624 Comm: syz-executor5 Not tainted 4.19.0-rc8+ #69 [ 306.428915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 306.438284] Call Trace: [ 306.440907] dump_stack+0x1c4/0x2b4 [ 306.444567] ? dump_stack_print_info.cold.2+0x52/0x52 [ 306.449796] should_fail.cold.4+0xa/0x17 [ 306.453887] ? fault_create_debugfs_attr+0x1f0/0x1f0 02:06:37 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000280)={@mcast2, 0x0}, &(0x7f0000000400)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000440)={{{@in=@broadcast, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}}}, &(0x7f0000000540)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000580)={0x0, @multicast2, @dev}, &(0x7f00000005c0)=0xc) getpeername(r1, &(0x7f0000000600)=@hci={0x1f, 0x0}, &(0x7f0000000680)=0x80) getpeername(r1, &(0x7f00000006c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000740)=0x80) getsockname$packet(r0, &(0x7f0000000840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000880)=0x14) getpeername$packet(0xffffffffffffff9c, &(0x7f00000008c0)={0x11, 0x0, 0x0}, &(0x7f0000000900)=0x14) getsockname$packet(0xffffffffffffffff, &(0x7f0000000940)={0x11, 0x0, 0x0}, &(0x7f0000000980)=0x14) ioctl$sock_ifreq(r1, 0x89bf, &(0x7f00000009c0)={'veth1_to_bond\x00', @ifru_addrs=@hci={0x1f, 0x0}}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000a00)={'vcan0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000a40)={{{@in6, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000b40)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000001040)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20210000}, 0xc, &(0x7f0000001000)={&(0x7f0000000b80)={0x46c, r2, 0x100, 0x70bd28, 0x25dfdbfc, {}, [{{0x8, 0x1, r3}, {0x214, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xcd}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x81}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r8}, {0x234, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x8001}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r12}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}, {0x8}}}]}}]}, 0x46c}, 0x1, 0x0, 0x0, 0x4}, 0x4800) r14 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x480000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r14, &(0x7f0000000100)={0xa, 0x4, 0xfa00, {r15}}, 0xc) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 306.459009] ? __save_stack_trace+0x8d/0xf0 [ 306.463354] ? graph_lock+0x170/0x170 [ 306.467175] ? save_stack+0xa9/0xd0 [ 306.470830] ? save_stack+0x43/0xd0 [ 306.474463] ? kasan_kmalloc+0xc7/0xe0 [ 306.478363] ? find_held_lock+0x36/0x1c0 [ 306.482474] ? ___might_sleep+0x1ed/0x300 [ 306.486644] ? arch_local_save_flags+0x40/0x40 [ 306.491244] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.496803] __should_failslab+0x124/0x180 [ 306.501061] should_failslab+0x9/0x14 [ 306.504904] kmem_cache_alloc_node_trace+0x270/0x740 [ 306.510017] __kmalloc_node_track_caller+0x33/0x70 [ 306.514941] __kmalloc_reserve.isra.39+0x41/0xe0 [ 306.519701] __alloc_skb+0x155/0x770 [ 306.523419] ? skb_scrub_packet+0x490/0x490 [ 306.527540] kernel msg: ebtables bug: please report to author: bad policy [ 306.527744] ? netlink_insert+0x15a/0x3f0 [ 306.538815] ? __netlink_insert+0x13b0/0x13b0 [ 306.543309] ? graph_lock+0x170/0x170 [ 306.547130] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.552692] ? netlink_autobind.isra.34+0x232/0x310 [ 306.557720] netlink_sendmsg+0xb29/0xfc0 [ 306.561817] ? netlink_unicast+0x760/0x760 [ 306.566073] ? smack_socket_sendmsg+0xb0/0x190 [ 306.570681] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.576235] ? security_socket_sendmsg+0x94/0xc0 [ 306.581011] ? netlink_unicast+0x760/0x760 [ 306.585274] sock_sendmsg+0xd5/0x120 [ 306.589010] sock_write_iter+0x35e/0x5c0 [ 306.593090] ? sock_sendmsg+0x120/0x120 [ 306.597109] do_iter_readv_writev+0x8b0/0xa80 [ 306.601625] ? vfs_dedupe_file_range+0x670/0x670 [ 306.606389] ? rw_copy_check_uvector+0x310/0x3e0 [ 306.611161] ? rw_verify_area+0x118/0x360 [ 306.615319] do_iter_write+0x185/0x5f0 [ 306.619207] ? dup_iter+0x270/0x270 [ 306.622834] ? proc_cwd_link+0x1d0/0x1d0 [ 306.626922] vfs_writev+0x1f1/0x360 [ 306.630583] ? vfs_iter_write+0xb0/0xb0 [ 306.634577] ? wait_for_completion+0x8a0/0x8a0 [ 306.639792] ? __lock_is_held+0xb5/0x140 [ 306.643878] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 306.649437] ? __fdget_pos+0xde/0x200 [ 306.653260] ? __fdget_raw+0x20/0x20 [ 306.656977] ? __sb_end_write+0xd9/0x110 [ 306.661045] do_writev+0x11a/0x310 [ 306.664574] ? vfs_writev+0x360/0x360 [ 306.668376] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 306.673852] __x64_sys_writev+0x75/0xb0 [ 306.677825] do_syscall_64+0x1b9/0x820 [ 306.681714] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 306.687073] ? syscall_return_slowpath+0x5e0/0x5e0 [ 306.692001] ? trace_hardirqs_on_caller+0x310/0x310 [ 306.697026] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 306.702044] ? recalc_sigpending_tsk+0x180/0x180 [ 306.706803] ? kasan_check_write+0x14/0x20 [ 306.711041] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 306.715891] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 306.721065] RIP: 0033:0x457569 [ 306.724246] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 306.743257] RSP: 002b:00007fa30ffadc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 306.750964] RAX: ffffffffffffffda RBX: 00007fa30ffadc90 RCX: 0000000000457569 02:06:37 executing program 3 (fault-call:4 fault-nth:3): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 306.758225] RDX: 0000000000000001 RSI: 0000000020e11ff0 RDI: 0000000000000004 [ 306.765485] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 306.772751] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa30ffae6d4 [ 306.780012] R13: 00000000004c30b5 R14: 00000000004d9078 R15: 0000000000000007 02:06:38 executing program 5 (fault-call:7 fault-nth:2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:38 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000080080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:38 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:38 executing program 2: r0 = socket$kcm(0xa, 0x20122000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f0000000040), 0x1) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000003840)=@nl=@unspec={0x40000000, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000080)="d90d0000768606681d012f629c75adfa4208d5febf524a024aface6a6ac7d846ed2fa163e15ffb5033e9ad60d7a8a295b90bf9cc85a2b1496c0c48000402080a2f858ad2c4aa412d", 0x48}], 0x1}, 0x0) [ 306.947305] kernel msg: ebtables bug: please report to author: bad policy [ 306.962126] FAULT_INJECTION: forcing a failure. [ 306.962126] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 306.973974] CPU: 0 PID: 10650 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 306.981252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 306.990607] Call Trace: [ 306.993242] dump_stack+0x1c4/0x2b4 [ 306.996887] ? dump_stack_print_info.cold.2+0x52/0x52 [ 307.002115] ? up+0xea/0x1c0 [ 307.005149] ? lock_downgrade+0x900/0x900 [ 307.009320] should_fail.cold.4+0xa/0x17 [ 307.013414] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 307.018542] ? console_unlock+0x83a/0x1160 [ 307.022794] ? lock_downgrade+0x900/0x900 [ 307.026986] ? mark_held_locks+0x130/0x130 [ 307.031233] ? vprintk_emit+0x33d/0x930 [ 307.035227] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 307.040693] ? kasan_check_write+0x14/0x20 [ 307.044948] ? do_raw_spin_lock+0xc1/0x200 [ 307.049207] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 307.054239] ? console_unlock+0x9ba/0x1160 [ 307.058507] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.064064] ? should_fail+0x22d/0xd01 [ 307.067971] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 307.073523] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 307.078650] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.084201] ? wake_up_klogd+0x11a/0x180 [ 307.088600] __alloc_pages_nodemask+0x34b/0xde0 02:06:38 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, 0x0}, 0x8) 02:06:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) openat$cgroup_int(r0, &(0x7f00000000c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) 02:06:38 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, 0x0}, 0x8) 02:06:38 executing program 2: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount(&(0x7f0000000140)=ANY=[], &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)={[{0x2b, 'io'}]}, 0x4) 02:06:38 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, 0x0}, 0x8) [ 307.093296] ? __down_trylock_console_sem+0x155/0x200 [ 307.098527] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 307.103571] ? vprintk_emit+0x268/0x930 [ 307.107565] ? find_held_lock+0x36/0x1c0 [ 307.111672] ? ___might_sleep+0x1ed/0x300 [ 307.115843] ? trace_hardirqs_off+0xb8/0x310 [ 307.120273] cache_grow_begin+0x91/0x8c0 [ 307.124353] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 307.129913] ? check_preemption_disabled+0x48/0x200 [ 307.134954] kmem_cache_alloc_trace+0x67e/0x750 [ 307.139694] kobject_uevent_env+0x2f3/0x101e 02:06:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000000c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040), 0x12) [ 307.144180] ? sysfs_remove_group+0xf6/0x1b0 [ 307.148629] kobject_uevent+0x1f/0x24 [ 307.152473] device_del+0x6c9/0xb70 [ 307.156127] ? __device_links_no_driver+0x320/0x320 [ 307.161175] rfkill_unregister+0x137/0x480 [ 307.165436] ? hci_sock_dev_event+0x10b/0x740 [ 307.169964] ? mgmt_index_removed+0x16d/0x410 [ 307.174475] ? rfkill_register+0xe00/0xe00 [ 307.178726] ? do_raw_write_trylock+0x1c0/0x1c0 [ 307.183440] hci_unregister_dev+0x360/0x990 [ 307.187784] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 307.192551] ? ima_file_check+0x130/0x130 [ 307.192582] ? vhci_close_dev+0x50/0x50 [ 307.192603] vhci_release+0x76/0xf0 [ 307.204381] __fput+0x385/0xa30 [ 307.204402] ? get_max_files+0x20/0x20 [ 307.204417] ? trace_hardirqs_on+0xbd/0x310 [ 307.204430] ? kasan_check_read+0x11/0x20 [ 307.204444] ? task_work_run+0x1af/0x2a0 [ 307.204460] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 307.204495] ? kasan_check_write+0x14/0x20 [ 307.233863] ? do_raw_spin_lock+0xc1/0x200 [ 307.238118] ____fput+0x15/0x20 [ 307.241418] task_work_run+0x1e8/0x2a0 [ 307.245322] ? task_work_cancel+0x240/0x240 [ 307.249687] ? copy_fd_bitmaps+0x210/0x210 [ 307.253938] ? do_syscall_64+0x9a/0x820 [ 307.257948] exit_to_usermode_loop+0x318/0x380 [ 307.262569] ? syscall_slow_exit_work+0x520/0x520 [ 307.267427] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 307.272982] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.278547] do_syscall_64+0x6be/0x820 [ 307.282470] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 307.287870] ? syscall_return_slowpath+0x5e0/0x5e0 [ 307.292820] ? trace_hardirqs_off_thunk+0x1a/0x1c 02:06:38 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0x339) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0xb0, 0x4000) futimesat(r2, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={{0x0, 0x2710}, {0x0, 0x7530}}) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 307.297692] ? trace_hardirqs_on_caller+0x310/0x310 [ 307.302726] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 307.307771] ? prepare_exit_to_usermode+0x291/0x3b0 [ 307.312837] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 307.317714] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 307.322935] RIP: 0033:0x457569 [ 307.326149] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 307.345091] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 307.352812] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 307.360088] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 307.367391] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 307.374690] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 307.381969] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 [ 307.395824] FAULT_INJECTION: forcing a failure. [ 307.395824] name failslab, interval 1, probability 0, space 0, times 0 [ 307.407740] CPU: 1 PID: 10681 Comm: syz-executor5 Not tainted 4.19.0-rc8+ #69 [ 307.415031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 307.415040] Call Trace: [ 307.415067] dump_stack+0x1c4/0x2b4 [ 307.415095] ? dump_stack_print_info.cold.2+0x52/0x52 [ 307.415117] ? mark_held_locks+0x130/0x130 [ 307.415147] should_fail.cold.4+0xa/0x17 [ 307.415162] ? find_held_lock+0x36/0x1c0 [ 307.415184] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 307.415209] ? graph_lock+0x170/0x170 [ 307.415225] ? __mutex_lock+0x85e/0x1700 [ 307.415245] ? graph_lock+0x170/0x170 [ 307.427191] ? graph_lock+0x170/0x170 [ 307.435996] ? lock_release+0x970/0x970 [ 307.436020] ? find_held_lock+0x36/0x1c0 [ 307.436040] ? __lock_is_held+0xb5/0x140 [ 307.436074] ? ___might_sleep+0x1ed/0x300 [ 307.444396] ? arch_local_save_flags+0x40/0x40 [ 307.444425] ? find_held_lock+0x36/0x1c0 [ 307.444460] __should_failslab+0x124/0x180 [ 307.444480] should_failslab+0x9/0x14 [ 307.453634] kmem_cache_alloc_node+0x26e/0x730 [ 307.453663] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 307.453692] __alloc_skb+0x119/0x770 [ 307.453713] ? skb_scrub_packet+0x490/0x490 [ 307.461572] ? kasan_check_write+0x14/0x20 [ 307.461588] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 307.461696] ? inet_diag_dump_one_icsk+0x39e/0x4f0 [ 307.461717] ? wait_for_completion+0x8a0/0x8a0 [ 307.469330] ? mutex_unlock+0xd/0x10 [ 307.469348] ? inet_diag_cmd_exact+0x86/0x170 [ 307.469379] netlink_ack+0x2c5/0xb80 [ 307.469410] ? netlink_sendmsg+0xfc0/0xfc0 [ 307.477610] ? mutex_unlock+0xd/0x10 [ 307.477667] ? sock_diag_rcv_msg+0x28d/0x410 [ 307.477689] netlink_rcv_skb+0x35d/0x440 [ 307.485893] ? sock_diag_bind+0x80/0x80 [ 307.485924] ? netlink_ack+0xb80/0xb80 [ 307.485953] sock_diag_rcv+0x2a/0x40 [ 307.485970] netlink_unicast+0x5a5/0x760 [ 307.485993] ? netlink_attachskb+0x9a0/0x9a0 [ 307.494663] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.494680] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 307.494704] netlink_sendmsg+0xa18/0xfc0 [ 307.494730] ? netlink_unicast+0x760/0x760 [ 307.502765] ? smack_socket_sendmsg+0xb0/0x190 [ 307.502783] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.502808] ? security_socket_sendmsg+0x94/0xc0 [ 307.512307] ? netlink_unicast+0x760/0x760 [ 307.512328] sock_sendmsg+0xd5/0x120 [ 307.512346] sock_write_iter+0x35e/0x5c0 [ 307.512364] ? sock_sendmsg+0x120/0x120 [ 307.636685] do_iter_readv_writev+0x8b0/0xa80 [ 307.641175] ? vfs_dedupe_file_range+0x670/0x670 [ 307.645921] ? rw_copy_check_uvector+0x310/0x3e0 [ 307.650671] ? rw_verify_area+0x118/0x360 [ 307.654809] do_iter_write+0x185/0x5f0 [ 307.658684] ? dup_iter+0x270/0x270 [ 307.662296] ? proc_cwd_link+0x1d0/0x1d0 [ 307.666350] vfs_writev+0x1f1/0x360 [ 307.669973] ? vfs_iter_write+0xb0/0xb0 [ 307.673956] ? wait_for_completion+0x8a0/0x8a0 [ 307.678561] ? __lock_is_held+0xb5/0x140 [ 307.682618] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 307.688151] ? __fdget_pos+0xde/0x200 [ 307.691938] ? __fdget_raw+0x20/0x20 [ 307.695648] ? __sb_end_write+0xd9/0x110 [ 307.699709] do_writev+0x11a/0x310 [ 307.703243] ? vfs_writev+0x360/0x360 [ 307.707121] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 307.712561] __x64_sys_writev+0x75/0xb0 [ 307.716526] do_syscall_64+0x1b9/0x820 [ 307.720424] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 307.725777] ? syscall_return_slowpath+0x5e0/0x5e0 [ 307.730695] ? trace_hardirqs_on_caller+0x310/0x310 [ 307.735704] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 307.740731] ? recalc_sigpending_tsk+0x180/0x180 [ 307.745472] ? kasan_check_write+0x14/0x20 [ 307.749695] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 307.754531] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 307.759705] RIP: 0033:0x457569 [ 307.762883] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 307.781772] RSP: 002b:00007fa30ffadc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 307.789463] RAX: ffffffffffffffda RBX: 00007fa30ffadc90 RCX: 0000000000457569 02:06:38 executing program 3 (fault-call:4 fault-nth:4): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 307.796719] RDX: 0000000000000001 RSI: 0000000020e11ff0 RDI: 0000000000000004 [ 307.803988] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 307.811243] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa30ffae6d4 [ 307.818511] R13: 00000000004c30b5 R14: 00000000004d9078 R15: 0000000000000007 02:06:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 307.884008] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 307.910843] FAULT_INJECTION: forcing a failure. [ 307.910843] name failslab, interval 1, probability 0, space 0, times 0 [ 307.935672] CPU: 1 PID: 10688 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 307.935773] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 307.942971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 307.942980] Call Trace: [ 307.943008] dump_stack+0x1c4/0x2b4 [ 307.943036] ? dump_stack_print_info.cold.2+0x52/0x52 [ 307.971839] ? is_bpf_text_address+0xd3/0x170 [ 307.976362] should_fail.cold.4+0xa/0x17 [ 307.980442] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 307.985541] ? graph_lock+0x170/0x170 [ 307.989343] ? save_stack+0xa9/0xd0 [ 307.992972] ? save_stack+0x43/0xd0 [ 307.996615] ? kasan_kmalloc+0xc7/0xe0 [ 308.000518] ? kmem_cache_alloc_trace+0x152/0x750 [ 308.005366] ? kobject_uevent_env+0x2f3/0x101e [ 308.009958] ? kobject_uevent+0x1f/0x24 [ 308.013922] ? device_del+0x6c9/0xb70 [ 308.017726] ? rfkill_unregister+0x137/0x480 [ 308.022142] ? find_held_lock+0x36/0x1c0 [ 308.026217] ? ___might_sleep+0x1ed/0x300 [ 308.030355] ? arch_local_save_flags+0x40/0x40 [ 308.034931] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 308.040462] __should_failslab+0x124/0x180 [ 308.044702] should_failslab+0x9/0x14 [ 308.048510] __kmalloc+0x2d4/0x760 [ 308.052048] ? kobject_uevent_env+0x2f3/0x101e [ 308.056659] ? rcu_read_lock_sched_held+0x108/0x120 [ 308.061667] ? kobject_get_path+0xc2/0x1b0 [ 308.065891] ? kmem_cache_alloc_trace+0x353/0x750 [ 308.070755] kobject_get_path+0xc2/0x1b0 [ 308.074805] kobject_uevent_env+0x314/0x101e [ 308.079216] ? sysfs_remove_group+0xf6/0x1b0 [ 308.083656] kobject_uevent+0x1f/0x24 [ 308.087478] device_del+0x6c9/0xb70 [ 308.091110] ? __device_links_no_driver+0x320/0x320 [ 308.096147] rfkill_unregister+0x137/0x480 [ 308.100431] ? hci_sock_dev_event+0x10b/0x740 [ 308.104953] ? mgmt_index_removed+0x16d/0x410 [ 308.109455] ? rfkill_register+0xe00/0xe00 [ 308.113700] ? do_raw_write_trylock+0x1c0/0x1c0 [ 308.118366] hci_unregister_dev+0x360/0x990 [ 308.122700] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 308.127483] ? ima_file_check+0x130/0x130 [ 308.131674] ? vhci_close_dev+0x50/0x50 [ 308.135635] vhci_release+0x76/0xf0 [ 308.139259] __fput+0x385/0xa30 [ 308.142540] ? get_max_files+0x20/0x20 [ 308.146439] ? trace_hardirqs_on+0xbd/0x310 [ 308.150745] ? kasan_check_read+0x11/0x20 [ 308.154879] ? task_work_run+0x1af/0x2a0 [ 308.158932] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 308.164372] ? kasan_check_write+0x14/0x20 [ 308.168649] ? do_raw_spin_lock+0xc1/0x200 [ 308.172881] ____fput+0x15/0x20 [ 308.176147] task_work_run+0x1e8/0x2a0 [ 308.180033] ? task_work_cancel+0x240/0x240 [ 308.184346] ? copy_fd_bitmaps+0x210/0x210 [ 308.188590] ? do_syscall_64+0x9a/0x820 [ 308.192584] exit_to_usermode_loop+0x318/0x380 [ 308.197202] ? syscall_slow_exit_work+0x520/0x520 [ 308.202059] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 308.207612] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 308.213177] do_syscall_64+0x6be/0x820 [ 308.213195] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 308.213216] ? syscall_return_slowpath+0x5e0/0x5e0 [ 308.222470] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 308.232233] ? trace_hardirqs_on_caller+0x310/0x310 [ 308.237270] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 308.242294] ? prepare_exit_to_usermode+0x291/0x3b0 [ 308.247305] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 308.252141] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 308.257317] RIP: 0033:0x457569 [ 308.260520] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 308.279426] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 308.287122] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 308.294376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 308.301660] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 308.308931] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 308.316190] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 02:06:39 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fffffdfd80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:39 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x0, 0x0, @local, 0x9}]}, &(0x7f0000000100)=0x10) 02:06:39 executing program 0: ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40086607, &(0x7f00000001c0)) madvise(&(0x7f0000a75000/0x2000)=nil, 0x2000, 0xc) open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000480)=""/93, 0x5d}], 0x1) mlockall(0x1) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) 02:06:39 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x500, 0x0) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="e03f03001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:39 executing program 3 (fault-call:4 fault-nth:5): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 308.430730] FAULT_INJECTION: forcing a failure. [ 308.430730] name failslab, interval 1, probability 0, space 0, times 0 [ 308.464055] CPU: 0 PID: 10707 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 308.471356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 308.480717] Call Trace: [ 308.483343] dump_stack+0x1c4/0x2b4 [ 308.486995] ? dump_stack_print_info.cold.2+0x52/0x52 [ 308.492222] should_fail.cold.4+0xa/0x17 [ 308.496306] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 308.501440] ? __save_stack_trace+0x8d/0xf0 [ 308.505780] ? graph_lock+0x170/0x170 [ 308.505869] ? graph_lock+0x170/0x170 [ 308.505885] ? save_stack+0xa9/0xd0 [ 308.505911] ? save_stack+0x43/0xd0 [ 308.513500] ? kasan_kmalloc+0xc7/0xe0 [ 308.513522] ? find_held_lock+0x36/0x1c0 [ 308.513544] ? __lock_is_held+0xb5/0x140 [ 308.513574] ? ___might_sleep+0x1ed/0x300 [ 308.513588] ? graph_lock+0x170/0x170 [ 308.513605] ? arch_local_save_flags+0x40/0x40 [ 308.513627] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 308.550939] __should_failslab+0x124/0x180 [ 308.555220] should_failslab+0x9/0x14 [ 308.559041] kmem_cache_alloc_node_trace+0x270/0x740 [ 308.564175] __kmalloc_node_track_caller+0x33/0x70 [ 308.569122] __kmalloc_reserve.isra.39+0x41/0xe0 [ 308.573897] __alloc_skb+0x155/0x770 [ 308.577663] ? skb_scrub_packet+0x490/0x490 [ 308.582005] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 308.588078] ? kasan_check_read+0x11/0x20 [ 308.592240] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 308.597531] ? rcu_bh_qs+0xc0/0xc0 [ 308.601100] ? netlink_has_listeners+0x2cb/0x4a0 [ 308.605914] ? netlink_tap_init_net+0x3d0/0x3d0 [ 308.610605] alloc_uevent_skb+0x84/0x1da [ 308.614707] kobject_uevent_env+0xa52/0x101e [ 308.619128] ? sysfs_remove_group+0xf6/0x1b0 [ 308.623571] kobject_uevent+0x1f/0x24 [ 308.627393] device_del+0x6c9/0xb70 02:06:39 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r2, &(0x7f0000000300)=ANY=[], 0x36b) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x4082, 0x0) openat$cgroup_type(r3, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) getsockopt$bt_BT_DEFER_SETUP(r3, 0x112, 0x7, &(0x7f0000000180)=0x6, &(0x7f00000001c0)=0x4) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000240), &(0x7f0000000280)=0x8) ioctl$FIBMAP(r3, 0x1, &(0x7f0000000000)=0xfffffffffffffffc) [ 308.631052] ? __device_links_no_driver+0x320/0x320 [ 308.636096] rfkill_unregister+0x137/0x480 [ 308.640348] ? hci_sock_dev_event+0x10b/0x740 [ 308.644856] ? mgmt_index_removed+0x16d/0x410 [ 308.649381] ? rfkill_register+0xe00/0xe00 [ 308.653635] ? do_raw_write_trylock+0x1c0/0x1c0 [ 308.658348] hci_unregister_dev+0x360/0x990 [ 308.662692] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 308.667464] ? ima_file_check+0x130/0x130 [ 308.667496] ? vhci_close_dev+0x50/0x50 [ 308.667517] vhci_release+0x76/0xf0 [ 308.679274] __fput+0x385/0xa30 [ 308.682570] ? get_max_files+0x20/0x20 [ 308.686473] ? trace_hardirqs_on+0xbd/0x310 [ 308.690802] ? kasan_check_read+0x11/0x20 [ 308.694961] ? task_work_run+0x1af/0x2a0 [ 308.699032] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 308.704497] ? kasan_check_write+0x14/0x20 [ 308.708746] ? do_raw_spin_lock+0xc1/0x200 [ 308.712996] ____fput+0x15/0x20 [ 308.716291] task_work_run+0x1e8/0x2a0 [ 308.720193] ? task_work_cancel+0x240/0x240 [ 308.724534] ? copy_fd_bitmaps+0x210/0x210 [ 308.728976] ? do_syscall_64+0x9a/0x820 [ 308.732997] exit_to_usermode_loop+0x318/0x380 [ 308.737607] ? syscall_slow_exit_work+0x520/0x520 [ 308.742473] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 308.748029] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 308.753583] do_syscall_64+0x6be/0x820 [ 308.757485] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 308.762865] ? syscall_return_slowpath+0x5e0/0x5e0 [ 308.767857] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 308.772717] ? trace_hardirqs_on_caller+0x310/0x310 [ 308.777763] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 308.782798] ? prepare_exit_to_usermode+0x291/0x3b0 [ 308.787840] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 308.792710] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 308.797919] RIP: 0033:0x457569 [ 308.801125] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 308.820035] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 02:06:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xfffffffffffffd33) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff}) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) r2 = socket$inet_dccp(0x2, 0x6, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000000c0)={0x0, @broadcast, @loopback}, &(0x7f0000000100)=0xc) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) getsockname$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000080)=0x1c) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 308.827761] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 308.835388] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 308.842671] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 308.849957] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 308.857238] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 [ 308.889764] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="00f0ff7f1400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:40 executing program 3 (fault-call:4 fault-nth:6): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000300)="d3abc7990d535c9e70bc111c8eff7f0000000000004e0000", 0x18) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000c6b000/0x2000)=nil, 0x2000, 0x400000000000, 0x31, 0xffffffffffffffff, 0x1) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000140)) [ 308.994199] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:40 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000040080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 309.082347] FAULT_INJECTION: forcing a failure. [ 309.082347] name failslab, interval 1, probability 0, space 0, times 0 [ 309.121886] CPU: 1 PID: 10737 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 309.129183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 309.138547] Call Trace: [ 309.141155] dump_stack+0x1c4/0x2b4 [ 309.144811] ? dump_stack_print_info.cold.2+0x52/0x52 [ 309.150026] ? lock_downgrade+0x900/0x900 [ 309.154204] should_fail.cold.4+0xa/0x17 [ 309.158289] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 309.163412] ? rcu_bh_qs+0xc0/0xc0 [ 309.166962] ? unwind_dump+0x190/0x190 [ 309.170869] ? graph_lock+0x170/0x170 [ 309.174687] ? is_bpf_text_address+0xd3/0x170 [ 309.179197] ? graph_lock+0x170/0x170 [ 309.183020] ? __kernel_text_address+0xd/0x40 [ 309.187525] ? unwind_get_return_address+0x61/0xa0 [ 309.192473] ? find_held_lock+0x36/0x1c0 [ 309.196548] ? __lock_is_held+0xb5/0x140 [ 309.200634] ? ___might_sleep+0x1ed/0x300 [ 309.204807] ? kobject_uevent+0x1f/0x24 [ 309.204826] ? arch_local_save_flags+0x40/0x40 [ 309.204841] ? vhci_release+0x76/0xf0 [ 309.204854] ? __fput+0x385/0xa30 [ 309.204866] ? ____fput+0x15/0x20 [ 309.204880] ? task_work_run+0x1e8/0x2a0 [ 309.204905] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 309.213474] __should_failslab+0x124/0x180 [ 309.213497] should_failslab+0x9/0x14 [ 309.213517] kmem_cache_alloc+0x2be/0x730 [ 309.213545] skb_clone+0x1bb/0x500 [ 309.249361] ? skb_split+0x11e0/0x11e0 [ 309.253272] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 309.258301] ? netlink_trim+0x1b4/0x380 [ 309.258394] syz-executor2 (10709) used greatest stack depth: 10296 bytes left [ 309.262294] ? netlink_skb_destructor+0x210/0x210 [ 309.274429] netlink_broadcast_filtered+0x110f/0x1680 02:06:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 309.279651] ? __netlink_sendskb+0xd0/0xd0 [ 309.283925] ? kasan_check_read+0x11/0x20 [ 309.288095] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 309.293399] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 309.298961] ? refcount_inc_not_zero_checked+0x1e5/0x2f0 [ 309.304439] ? refcount_add_not_zero_checked+0x330/0x330 [ 309.309911] ? netlink_has_listeners+0x2cb/0x4a0 [ 309.314711] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 309.319751] netlink_broadcast+0x3a/0x50 [ 309.323829] kobject_uevent_env+0xa83/0x101e [ 309.328266] ? sysfs_remove_group+0xf6/0x1b0 [ 309.332700] kobject_uevent+0x1f/0x24 [ 309.336514] device_del+0x6c9/0xb70 [ 309.340163] ? __device_links_no_driver+0x320/0x320 [ 309.345205] rfkill_unregister+0x137/0x480 [ 309.349453] ? hci_sock_dev_event+0x10b/0x740 [ 309.353957] ? mgmt_index_removed+0x16d/0x410 [ 309.358470] ? rfkill_register+0xe00/0xe00 [ 309.362724] ? do_raw_write_trylock+0x1c0/0x1c0 [ 309.367423] hci_unregister_dev+0x360/0x990 [ 309.371764] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 309.376536] ? ima_file_check+0x130/0x130 [ 309.380715] ? vhci_close_dev+0x50/0x50 [ 309.384701] vhci_release+0x76/0xf0 [ 309.388339] __fput+0x385/0xa30 [ 309.391632] ? get_max_files+0x20/0x20 [ 309.395543] ? trace_hardirqs_on+0xbd/0x310 [ 309.399869] ? kasan_check_read+0x11/0x20 [ 309.404028] ? task_work_run+0x1af/0x2a0 [ 309.408098] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 309.413561] ? kasan_check_write+0x14/0x20 [ 309.417814] ? do_raw_spin_lock+0xc1/0x200 [ 309.422042] ____fput+0x15/0x20 [ 309.425308] task_work_run+0x1e8/0x2a0 [ 309.429181] ? task_work_cancel+0x240/0x240 [ 309.433491] ? copy_fd_bitmaps+0x210/0x210 [ 309.437721] ? do_syscall_64+0x9a/0x820 [ 309.441682] exit_to_usermode_loop+0x318/0x380 [ 309.446251] ? syscall_slow_exit_work+0x520/0x520 [ 309.451081] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 309.456606] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 309.462137] do_syscall_64+0x6be/0x820 [ 309.466014] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 309.471370] ? syscall_return_slowpath+0x5e0/0x5e0 [ 309.476285] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 309.481123] ? trace_hardirqs_on_caller+0x310/0x310 [ 309.486130] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 309.491132] ? prepare_exit_to_usermode+0x291/0x3b0 [ 309.496136] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 309.500994] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 309.506169] RIP: 0033:0x457569 [ 309.509348] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 02:06:40 executing program 2: mmap(&(0x7f0000000000/0xe62000)=nil, 0xe62000, 0x100000c, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000000), &(0x7f0000000040)=0x4) 02:06:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.stat\x00', 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227c, &(0x7f0000000200)) 02:06:40 executing program 0: clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) [ 309.528232] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 309.535924] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 309.543174] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 309.550423] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 309.557679] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 309.564932] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 02:06:40 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'veth1_to_team\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @remote}, 0x14) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) 02:06:40 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000000)={0x200003f}, 0x2) 02:06:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="effd00001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:40 executing program 3 (fault-call:4 fault-nth:7): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x404000, 0x0) ioctl$NBD_DISCONNECT(r3, 0xab08) r4 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') recvmsg(r1, &(0x7f0000009ac0)={&(0x7f00000088c0)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000009a40)=[{&(0x7f0000008940)=""/71, 0x47}, {&(0x7f00000089c0)=""/99, 0x63}, {&(0x7f0000008a40)=""/4096, 0x1000}], 0x3, &(0x7f0000009a80), 0x0, 0xe6d3}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f000000a1c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f000000a200)=0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f000000a280)={'vcan0\x00', 0x0}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f000000a2c0)={@multicast1, @dev, 0x0}, &(0x7f000000a300)=0xc) sendmsg$TEAM_CMD_NOOP(r3, &(0x7f000000a4c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x6629aa46d675c1f3}, 0xc, &(0x7f000000a480)={&(0x7f000000a340)={0x114, r4, 0x400, 0x70bd28, 0x25dfdbff, {}, [{{0x8, 0x1, r5}, {0x4}}, {{0x8, 0x1, r6}, {0xa0, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x1000}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x34, 0x4, [{0x98, 0x10000, 0x0, 0xfff}, {0x1c23, 0x8f5a, 0xe5a, 0x7fff}, {0x0, 0x9, 0x5, 0x5}, {0x82, 0x41c7, 0x9, 0x3}, {0x8, 0x7ff, 0x1, 0x5}, {0x9, 0x8, 0x7fff, 0xfff}]}}}]}}, {{0x8, 0x1, r7}, {0x44, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r8}}}]}}]}, 0x114}, 0x1, 0x0, 0x0, 0x4000}, 0x810) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 309.688712] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:40 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4={[], [], @rand_addr}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x33}, 0x0, @in6, 0x0, 0x0, 0x0, 0x5}}, 0xe8) connect$inet6(r0, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f00000002c0), 0x4cc, 0x0) [ 309.794041] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 309.815071] FAULT_INJECTION: forcing a failure. [ 309.815071] name failslab, interval 1, probability 0, space 0, times 0 [ 309.833014] CPU: 1 PID: 10770 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 309.840839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 309.850197] Call Trace: [ 309.852802] dump_stack+0x1c4/0x2b4 [ 309.856452] ? dump_stack_print_info.cold.2+0x52/0x52 [ 309.861680] should_fail.cold.4+0xa/0x17 [ 309.865791] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 309.870907] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 309.876461] ? wake_up_klogd+0x11a/0x180 [ 309.880563] ? console_device+0xc0/0xc0 [ 309.884588] ? graph_lock+0x170/0x170 [ 309.888424] ? __down_trylock_console_sem+0x155/0x200 [ 309.893630] ? vprintk_emit+0x268/0x930 [ 309.897648] ? find_held_lock+0x36/0x1c0 [ 309.901764] ? ___might_sleep+0x1ed/0x300 [ 309.905929] ? arch_local_save_flags+0x40/0x40 [ 309.910536] ? vprintk_default+0x28/0x30 [ 309.914617] __should_failslab+0x124/0x180 [ 309.918884] should_failslab+0x9/0x14 [ 309.922699] kmem_cache_alloc_trace+0x2d7/0x750 [ 309.927401] kobject_uevent_env+0x2f3/0x101e [ 309.931830] ? mutex_unlock+0xd/0x10 [ 309.935566] ? kernfs_remove_by_name_ns+0x65/0xb0 [ 309.940459] kobject_uevent+0x1f/0x24 [ 309.944277] device_del+0x6c9/0xb70 [ 309.947934] ? __device_links_no_driver+0x320/0x320 [ 309.952967] ? kobject_put+0x86/0xe0 [ 309.956707] hci_unregister_dev+0x3a2/0x990 [ 309.961043] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 309.965816] ? ima_file_check+0x130/0x130 [ 309.969996] ? vhci_close_dev+0x50/0x50 [ 309.973997] vhci_release+0x76/0xf0 [ 309.977647] __fput+0x385/0xa30 [ 309.980959] ? get_max_files+0x20/0x20 [ 309.984874] ? trace_hardirqs_on+0xbd/0x310 [ 309.989213] ? kasan_check_read+0x11/0x20 [ 309.993372] ? task_work_run+0x1af/0x2a0 [ 309.997461] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 310.002925] ? kasan_check_write+0x14/0x20 [ 310.007175] ? do_raw_spin_lock+0xc1/0x200 [ 310.011431] ____fput+0x15/0x20 [ 310.014723] task_work_run+0x1e8/0x2a0 [ 310.018632] ? task_work_cancel+0x240/0x240 [ 310.022986] ? copy_fd_bitmaps+0x210/0x210 [ 310.027244] ? do_syscall_64+0x9a/0x820 [ 310.031239] exit_to_usermode_loop+0x318/0x380 [ 310.035852] ? syscall_slow_exit_work+0x520/0x520 [ 310.040703] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 310.046258] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 310.051815] do_syscall_64+0x6be/0x820 [ 310.055722] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 310.061098] ? syscall_return_slowpath+0x5e0/0x5e0 [ 310.066043] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 310.070909] ? trace_hardirqs_on_caller+0x310/0x310 [ 310.075946] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 310.081001] ? prepare_exit_to_usermode+0x291/0x3b0 [ 310.086078] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 310.090946] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 310.096169] RIP: 0033:0x457569 [ 310.099374] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 310.118292] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 310.126017] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 310.133320] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 02:06:41 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000100)="66b91000004066b80000000066ba000000000f30baa000eddb8f05000f89ae6a660f3a22efa80f09f00fc709f20f1ab60d0066b93608000066b80000000066ba008000000f3066b9800000c00f326635000800000f30", 0x56}], 0x1, 0x0, &(0x7f0000000180), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000380)="153f6234488dd25d766070") socketpair(0x0, 0x0, 0x0, &(0x7f0000000040)) bind(r3, &(0x7f0000000180)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2, 0x4816}}}, 0x80) ioctl$KVM_SMI(r2, 0xaeb7) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 310.140597] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 310.147874] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 310.155156] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 02:06:41 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0006000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="effdffff1400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:41 executing program 3 (fault-call:4 fault-nth:8): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 310.258849] FAULT_INJECTION: forcing a failure. [ 310.258849] name failslab, interval 1, probability 0, space 0, times 0 [ 310.274813] CPU: 0 PID: 10786 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 310.282110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 310.291475] Call Trace: [ 310.294099] dump_stack+0x1c4/0x2b4 [ 310.297746] ? dump_stack_print_info.cold.2+0x52/0x52 [ 310.302958] ? is_bpf_text_address+0xd3/0x170 [ 310.307479] should_fail.cold.4+0xa/0x17 [ 310.311569] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 310.316695] ? graph_lock+0x170/0x170 [ 310.320537] ? save_stack+0xa9/0xd0 [ 310.324176] ? save_stack+0x43/0xd0 [ 310.327816] ? kasan_kmalloc+0xc7/0xe0 [ 310.331714] ? kmem_cache_alloc_trace+0x152/0x750 [ 310.336599] ? kobject_uevent_env+0x2f3/0x101e [ 310.341204] ? kobject_uevent+0x1f/0x24 [ 310.345193] ? device_del+0x6c9/0xb70 [ 310.349006] ? hci_unregister_dev+0x3a2/0x990 [ 310.353528] ? find_held_lock+0x36/0x1c0 [ 310.357626] ? ___might_sleep+0x1ed/0x300 [ 310.361803] ? arch_local_save_flags+0x40/0x40 [ 310.366405] ? rcu_lockdep_current_cpu_online+0x1f0/0x2d0 [ 310.371961] __should_failslab+0x124/0x180 [ 310.376214] should_failslab+0x9/0x14 [ 310.380028] __kmalloc+0x2d4/0x760 [ 310.383582] ? kobject_uevent_env+0x2f3/0x101e [ 310.388175] ? rcu_read_lock_sched_held+0x108/0x120 [ 310.393199] ? kobject_get_path+0xc2/0x1b0 [ 310.397447] ? kmem_cache_alloc_trace+0x353/0x750 [ 310.402307] kobject_get_path+0xc2/0x1b0 [ 310.406390] kobject_uevent_env+0x314/0x101e [ 310.410850] ? mutex_unlock+0xd/0x10 [ 310.414598] ? kernfs_remove_by_name_ns+0x65/0xb0 [ 310.419496] kobject_uevent+0x1f/0x24 [ 310.423316] device_del+0x6c9/0xb70 [ 310.426961] ? __device_links_no_driver+0x320/0x320 [ 310.431989] ? kobject_put+0x86/0xe0 [ 310.435728] hci_unregister_dev+0x3a2/0x990 [ 310.440068] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 310.444838] ? ima_file_check+0x130/0x130 [ 310.449010] ? vhci_close_dev+0x50/0x50 [ 310.453005] vhci_release+0x76/0xf0 [ 310.456656] __fput+0x385/0xa30 [ 310.459955] ? get_max_files+0x20/0x20 [ 310.463857] ? trace_hardirqs_on+0xbd/0x310 [ 310.468194] ? kasan_check_read+0x11/0x20 [ 310.472354] ? task_work_run+0x1af/0x2a0 [ 310.476456] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 310.481938] ? kasan_check_write+0x14/0x20 [ 310.486185] ? do_raw_spin_lock+0xc1/0x200 [ 310.490441] ____fput+0x15/0x20 [ 310.493735] task_work_run+0x1e8/0x2a0 [ 310.497650] ? task_work_cancel+0x240/0x240 [ 310.501992] ? copy_fd_bitmaps+0x210/0x210 [ 310.506243] ? do_syscall_64+0x9a/0x820 [ 310.510240] exit_to_usermode_loop+0x318/0x380 [ 310.514850] ? syscall_slow_exit_work+0x520/0x520 [ 310.519708] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 310.525279] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 310.530875] do_syscall_64+0x6be/0x820 [ 310.534788] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 310.540167] ? syscall_return_slowpath+0x5e0/0x5e0 [ 310.545123] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 310.549979] ? trace_hardirqs_on_caller+0x310/0x310 [ 310.555022] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 310.560065] ? prepare_exit_to_usermode+0x291/0x3b0 [ 310.565103] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 310.569969] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 310.575164] RIP: 0033:0x457569 [ 310.578374] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 310.597284] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 02:06:41 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'vlan0\x00', 0x2003}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'vlan0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB=' ']}) 02:06:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="c00000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 310.605033] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 310.612330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 310.619621] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 310.626914] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 310.634191] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 02:06:41 executing program 0: add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz'}, 0x0, 0x0, 0xfffffffffffffffd) 02:06:41 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x220201, 0x0) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f0000000080)={0x1b, 0x2, 0x1, 0x1a, 0xa, 0x4, 0x0, 0xe0, 0xffffffffffffffff}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5387, &(0x7f00000000c0)) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:41 executing program 3 (fault-call:4 fault-nth:9): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 310.700208] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:41 executing program 0: r0 = socket(0x18, 0x0, 0x3) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, 0xfffffffffffffffd) [ 310.763007] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:42 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000002c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="bdcf2fb1b9", 0x5) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000002180)=[{{&(0x7f0000000180)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000001e40)=[{&(0x7f0000001d40)="b269517ecc0b313b90412ab985ef65fe57c32c455a2f877bcf442f1ff3071cbbca48ce199aee42cc344b52449a3467e4f430a82563bffc10b1fb1ad3bea1d851c6f7136abd16cfed5518ec376ae75d6710a7cd70ec5e0ababbb4637de5a37b68e9465a91f3aa8ba98869ef3249", 0x6d}], 0x1, &(0x7f0000001ec0)=[{0xa8, 0x107, 0x4, "32caad17fed615b31e345bc0575b1476c0425531caa7be452db7dff82f37e6d9073312c5dffe62bab41d8caca4a6dae34a4e3e627732874c5f9e1b55d1768dd1763dbb25116b9d40c1db138e9179ccba636774c03613c84e2265e8bfab11a27b3c856bb5c1be6f1c68f49622de456d75ebd583bc4c0db2492211b9b264fdca42db21eed57f2f8f7e30e16146ec53add63eea7d15"}], 0xa8, 0x4000000}, 0x1}], 0x1, 0x85) recvmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000480)=""/162, 0xa2}, {&(0x7f0000000540)=""/167, 0xa7}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/243, 0xf3}, {&(0x7f0000000100)=""/9, 0x9}, {&(0x7f0000001700)=""/246, 0xf6}, {&(0x7f0000001800)=""/174, 0xae}, {&(0x7f00000018c0)=""/237, 0xed}, {&(0x7f00000019c0)=""/155, 0x9b}, {&(0x7f0000001a80)=""/194, 0xc2}], 0xa, &(0x7f0000000140)=""/37, 0x25, 0x80000000000000}, 0x10000) 02:06:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x6000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000080)={0x10001, 0x0, 0xffffffffffffffc1}) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$getownex(r0, 0x10, &(0x7f0000000100)) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 310.839597] FAULT_INJECTION: forcing a failure. [ 310.839597] name failslab, interval 1, probability 0, space 0, times 0 [ 310.887743] CPU: 0 PID: 10808 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 310.895049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 310.904410] Call Trace: [ 310.904544] sg_write: data in/out 1886416907/2147479510 bytes for SCSI command 0x0-- guessing data in; [ 310.904544] program syz-executor1 not setting count and/or reply_len properly [ 310.907037] dump_stack+0x1c4/0x2b4 [ 310.927475] ? dump_stack_print_info.cold.2+0x52/0x52 [ 310.932705] should_fail.cold.4+0xa/0x17 [ 310.938173] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 310.943294] ? graph_lock+0x170/0x170 [ 310.947103] ? lock_release+0x970/0x970 [ 310.951086] ? arch_local_save_flags+0x40/0x40 [ 310.955693] ? graph_lock+0x170/0x170 [ 310.959512] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 310.964549] ? console_unlock+0x9ba/0x1160 [ 310.968817] ? find_held_lock+0x36/0x1c0 [ 310.972900] ? __lock_is_held+0xb5/0x140 [ 310.977001] ? ___might_sleep+0x1ed/0x300 [ 310.981165] ? put_dec+0x3b/0xf0 02:06:42 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="8cffffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:42 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)="7374617409c0d2febcf9df2deac8c177ff171248e91193513049f831550d6f7de66cf637bdbf1311920c8a26eda4dcc3783f9db5116b34d31b0512a5608aaff01e7952340cd6fd00000000", 0x275a, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fallocate(r1, 0x0, 0x0, 0xfff) fallocate(r0, 0x0, 0x0, 0x10001) ftruncate(r0, 0x5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0x0, r1}) [ 310.984553] ? arch_local_save_flags+0x40/0x40 [ 310.989150] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 310.994709] ? graph_lock+0x170/0x170 [ 310.998533] __should_failslab+0x124/0x180 [ 311.002793] should_failslab+0x9/0x14 [ 311.006604] kmem_cache_alloc_node+0x26e/0x730 [ 311.011205] ? find_held_lock+0x36/0x1c0 [ 311.015285] __alloc_skb+0x119/0x770 [ 311.019016] ? skb_scrub_packet+0x490/0x490 [ 311.023351] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 311.029158] ? kasan_check_read+0x11/0x20 [ 311.033323] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 02:06:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="0f0000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:42 executing program 0: waitid(0x3, 0x0, &(0x7f0000000580), 0x1, &(0x7f00000004c0)) ioctl$KVM_PPC_GET_PVINFO(0xffffffffffffffff, 0x4080aea1, &(0x7f0000000380)=""/118) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x210200, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(0xffffffffffffffff, 0x8008ae9d, &(0x7f00000001c0)=""/35) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000480)='highspeed\x00', 0xe) sendto$inet6(r1, &(0x7f0000000280), 0xfffffffffffffedd, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty={[0xe00000000000000, 0x0, 0x801000cf00000000, 0x0, 0x0, 0x0, 0x0, 0xd9050000]}}, 0x1c) r2 = gettid() r3 = request_key(&(0x7f0000000240)='trusted\x00', &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000000300)='highspeed\x00', 0x0) r4 = add_key(&(0x7f0000000340)='keyring\x00', &(0x7f0000000400)={'syz'}, &(0x7f00000005c0)="beb4923ba6b17875767eefefc444cb33c9a3b014d84ffd61c1f6b296a13e82bdd102c732a4a96aa4537ab5e1a4b6f5305ffa98a32babe203ae42f4963a0d1d19a958bc485f8c716cd29a89621cc0ba86367701488a850e", 0x57, 0xfffffffffffffffd) keyctl$unlink(0x9, r3, r4) timer_create(0x0, &(0x7f0000000000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000340), &(0x7f0000000180)}}, &(0x7f0000044000)=0x0) timer_settime(r5, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) tkill(r2, 0x401104000000016) [ 311.038619] ? rcu_bh_qs+0xc0/0xc0 [ 311.042198] ? netlink_has_listeners+0x2cb/0x4a0 [ 311.046969] ? netlink_tap_init_net+0x3d0/0x3d0 [ 311.051665] alloc_uevent_skb+0x84/0x1da [ 311.055767] kobject_uevent_env+0xa52/0x101e [ 311.060187] ? mutex_unlock+0xd/0x10 [ 311.063937] ? kernfs_remove_by_name_ns+0x65/0xb0 [ 311.068806] kobject_uevent+0x1f/0x24 [ 311.072622] device_del+0x6c9/0xb70 [ 311.076284] ? __device_links_no_driver+0x320/0x320 [ 311.081315] ? kobject_put+0x86/0xe0 [ 311.085057] hci_unregister_dev+0x3a2/0x990 [ 311.089397] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 311.094172] ? ima_file_check+0x130/0x130 [ 311.098352] ? vhci_close_dev+0x50/0x50 [ 311.102353] vhci_release+0x76/0xf0 [ 311.106006] __fput+0x385/0xa30 [ 311.109321] ? get_max_files+0x20/0x20 [ 311.113222] ? trace_hardirqs_on+0xbd/0x310 [ 311.117554] ? kasan_check_read+0x11/0x20 [ 311.121729] ? task_work_run+0x1af/0x2a0 [ 311.125809] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 311.131275] ? kasan_check_write+0x14/0x20 02:06:42 executing program 2: r0 = memfd_create(&(0x7f00000000c0)="00000600000000000000", 0x0) write$binfmt_elf64(r0, &(0x7f00000094c0)=ANY=[@ANYBLOB="7f454c4600ce60720b561e5f32000000000000000000001fd83d000000400000000000ebffffff000000000000fc22c2765902d1b9624547d5b151c7e12959bfef70600c8f14612f94f70dffef5b4cbbd6a2957cbac929c0ef3829e5a4c0c3cf8adb6e76d80ff6b39e9634d76422b00a06df8906c29ea624b4f7d3dca6f69050b338"], 0x82) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000002c0), 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f00000092c0)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000080)=""/57, 0x39}, {&(0x7f0000000300)}], 0x2, &(0x7f0000000380)=""/250, 0xfa, 0x9}, 0x64d}, {{0x0, 0x0, &(0x7f0000006200)=[{&(0x7f0000005fc0)=""/73, 0x49}], 0x1, &(0x7f0000006280)=""/143, 0x8f}}, {{&(0x7f0000006340)=@nl=@unspec, 0x80, &(0x7f0000006900)=[{&(0x7f0000006400)=""/140, 0x8c}, {&(0x7f00000064c0)=""/185, 0xb9}, {&(0x7f0000006580)=""/156, 0x9c}, {&(0x7f0000006700)}, {&(0x7f0000006740)=""/156, 0x9c}, {&(0x7f0000006800)=""/200, 0xc8}], 0x6, &(0x7f0000006980)=""/227, 0xe3, 0x4}, 0x2}], 0x3, 0x40000000, 0x0) execveat(r0, &(0x7f0000000000)='\x00', &(0x7f0000000280), &(0x7f0000000500), 0x1000) pipe(&(0x7f0000000040)) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000001c0)) [ 311.135537] ? do_raw_spin_lock+0xc1/0x200 [ 311.139792] ____fput+0x15/0x20 [ 311.143095] task_work_run+0x1e8/0x2a0 [ 311.146998] ? task_work_cancel+0x240/0x240 [ 311.151360] ? copy_fd_bitmaps+0x210/0x210 [ 311.155622] ? do_syscall_64+0x9a/0x820 [ 311.159655] exit_to_usermode_loop+0x318/0x380 [ 311.164255] ? syscall_slow_exit_work+0x520/0x520 [ 311.169108] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 311.175185] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 311.180748] do_syscall_64+0x6be/0x820 [ 311.184665] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 311.187132] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 311.190044] ? syscall_return_slowpath+0x5e0/0x5e0 [ 311.190061] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 311.190080] ? trace_hardirqs_on_caller+0x310/0x310 [ 311.190101] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 311.220199] ? prepare_exit_to_usermode+0x291/0x3b0 [ 311.225235] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 311.230104] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 311.235316] RIP: 0033:0x457569 [ 311.238523] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 311.257434] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 311.265154] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 311.272433] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 311.279718] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 02:06:42 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'vlan0\x00', 0x2003}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'vlan0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB='\n']}) 02:06:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x14}}}, 0x81, 0x3f}, &(0x7f0000000100)=0x90) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000bc0)={"5e4e09af8db92a0472a6bcf88ced7239f809d9cd8e0a3370871f661003ad0803326834b1317300658954b5a2fd21eca0f295ac405c92638520b79180850d636dcca5e8d57a90d2b8eda827c8bb015f8ff4561abeab819bc4d1eb372e926038aa617fffd36cb9f451b893b640640a4ff9d8e9e75213b572540d3e6b75b95a96bf0c965ad930c88d41239523d4cb75c13440e8ca6a2df42deed5ee7a6e48b208a92e2be1e428468a58255fcac784bd091ba06d1ce9e53e5bd0167d1c5ce7a7fbf04a9d6138cbeabfa58a930d29bf15429cf1c7adff7459d6db3876b1f2390cac4fd2dccdfc7498cafdb15588707a82507a0b202403614e1b2dd985822c6bec8058c5e069507b7ab4ec7410ae0dd688fa86d6f758265216a1aa8e166bef3543fba1e993522facd1facbbad1cc6645af7be1df51b4bd9a22ad540304c69d1fc8af679535472c95b2590f6b78c36cf633e784f1e2172ad0f280240b8aa17cedf57c2e8884ca464bd84043c74257a81d3ef241650484afe480eb56e261e7ab6701d5de9ce042c05e603b799ad97c62246ce87273b54c1accc6d5454d97cb131d58bfb3f6b4715ca4bfa8e78b0ca6d0a1e79fb878bcab1d0f5512ec993e2e2a5864a067de2b8bee98ef48bb0b9cff16edd8f68ae0ee0f5721e47ca216317b30aa43fcdab25a79a39e0678835d5132359538f21cbed95d149b9a342d9b4d6b770fededf9177af8769d796e887bfb356cf2a15c15c519296c6cf619ea914040d4dad97c0753ea54507f94fbd00371805f431646605f8c038c18d374becb9b52cd3048f04a3995793b5d02ff524711a32945e756534b0bdc5ea23e8cc74eae4a4127210d45d3fa92a4e4fbf7f2cac7822e695f2f7538625159507f48c8632e525b55254224aa99b5b523e4e674aa9803e5cc53a1c77349219e52c1e65c302b59027088dab5185b8bc7aa9e7ec3ed715f87147ce8b40a11721dde3f8479d3c23b3931d9910137788f18d7f3a6ca80507e9234a75e7851c57d9fa30b4355fa7712b970849703213bc84020ae25a038390547a66b783cc37dc5a697cbf44e72d8c07ae89de22148a0be865b25f25a8d6514ef3419098d673364deb4f949840698581c13ee91a7b22651f5572c9ca47d9e6a00ea1d756dce00e9c8a955703346b463b96cef65193d2613540ccc4f81c2fb6b5e99da89782fd9d8c93e0e16c63f1c34b45c58d9562b01d7fdbc21c921a7e43c2b21e4bb85a5850936b7b771650118098a92fe2a4a4a02992f94970ad10621765e5750d8d039e979713522ad7cba37fdbb75b751acd152d4f4975035570dcb982f865bb92ac38a4d8fed4c7d91a94fde2871f33e07834bbb2a6a5877231bf705bb277398c25a8a2c67fbe6930a86fb599485dc00df84dd2f77da372659f70ab86d569407f5f37337044d23a0661f6e00"}) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000640)={0x0, {{0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x17}}}}, 0x90) accept$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e) setsockopt$inet_sctp_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f0000000140)={r0, 0x0, 0x7}, 0x8) 02:06:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 311.286996] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 311.294276] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 02:06:42 executing program 3 (fault-call:4 fault-nth:10): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:42 executing program 0: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000004c00), &(0x7f0000004c40)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000004c80)={{{@in6=@mcast1, @in6=@ipv4={[], [], @remote}}}, {{}, 0x0, @in=@multicast1}}, &(0x7f0000004d80)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000004dc0), &(0x7f0000004e00)=0xc) getpgrp(0x0) getpid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000006740)={{{@in6, @in6=@loopback}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000006840)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000400)={{{@in=@local, @in=@local}}, {{@in6}}}, &(0x7f00000000c0)=0xe8) shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) mkdir(&(0x7f0000000180)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000540)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000100)='ext-\x00', &(0x7f0000000140)='./file1\x00', 0x0, 0x0, &(0x7f0000001800), 0x820, &(0x7f0000000240)) 02:06:42 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) socket$bt_rfcomm(0x1f, 0x3, 0x3) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="c00e00001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 311.475454] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 311.495201] IPVS: ftp: loaded support on port[0] = 21 [ 311.508897] FAULT_INJECTION: forcing a failure. [ 311.508897] name failslab, interval 1, probability 0, space 0, times 0 [ 311.558149] CPU: 0 PID: 10861 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 311.565443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 311.574810] Call Trace: [ 311.577417] dump_stack+0x1c4/0x2b4 [ 311.581067] ? dump_stack_print_info.cold.2+0x52/0x52 [ 311.586289] should_fail.cold.4+0xa/0x17 [ 311.590374] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 311.595493] ? __save_stack_trace+0x8d/0xf0 [ 311.599839] ? graph_lock+0x170/0x170 [ 311.603670] ? graph_lock+0x170/0x170 [ 311.607520] ? save_stack+0xa9/0xd0 [ 311.611157] ? save_stack+0x43/0xd0 [ 311.614805] ? kasan_kmalloc+0xc7/0xe0 [ 311.618706] ? find_held_lock+0x36/0x1c0 [ 311.622784] ? __lock_is_held+0xb5/0x140 [ 311.626871] ? ___might_sleep+0x1ed/0x300 [ 311.631046] ? graph_lock+0x170/0x170 [ 311.631088] ? arch_local_save_flags+0x40/0x40 [ 311.631108] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 311.631135] __should_failslab+0x124/0x180 [ 311.631156] should_failslab+0x9/0x14 [ 311.631177] kmem_cache_alloc_node_trace+0x270/0x740 [ 311.658227] __kmalloc_node_track_caller+0x33/0x70 [ 311.663173] __kmalloc_reserve.isra.39+0x41/0xe0 [ 311.667955] __alloc_skb+0x155/0x770 [ 311.671690] ? skb_scrub_packet+0x490/0x490 [ 311.676035] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 311.676049] ? kasan_check_read+0x11/0x20 [ 311.676067] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 311.676085] ? rcu_bh_qs+0xc0/0xc0 [ 311.676118] ? netlink_has_listeners+0x2cb/0x4a0 [ 311.676138] ? netlink_tap_init_net+0x3d0/0x3d0 [ 311.676158] alloc_uevent_skb+0x84/0x1da [ 311.676180] kobject_uevent_env+0xa52/0x101e [ 311.676198] ? mutex_unlock+0xd/0x10 [ 311.676216] ? kernfs_remove_by_name_ns+0x65/0xb0 [ 311.676240] kobject_uevent+0x1f/0x24 [ 311.676260] device_del+0x6c9/0xb70 [ 311.676284] ? __device_links_no_driver+0x320/0x320 [ 311.676303] ? kobject_put+0x86/0xe0 [ 311.686244] hci_unregister_dev+0x3a2/0x990 [ 311.686266] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 311.686286] ? ima_file_check+0x130/0x130 [ 311.686316] ? vhci_close_dev+0x50/0x50 [ 311.686331] vhci_release+0x76/0xf0 [ 311.686361] __fput+0x385/0xa30 [ 311.686380] ? get_max_files+0x20/0x20 [ 311.686396] ? trace_hardirqs_on+0xbd/0x310 [ 311.686408] ? kasan_check_read+0x11/0x20 [ 311.686423] ? task_work_run+0x1af/0x2a0 [ 311.686440] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 311.686457] ? kasan_check_write+0x14/0x20 [ 311.686474] ? do_raw_spin_lock+0xc1/0x200 [ 311.686492] ____fput+0x15/0x20 [ 311.686510] task_work_run+0x1e8/0x2a0 [ 311.799439] ? task_work_cancel+0x240/0x240 [ 311.803787] ? copy_fd_bitmaps+0x210/0x210 [ 311.808026] ? do_syscall_64+0x9a/0x820 [ 311.812004] exit_to_usermode_loop+0x318/0x380 [ 311.816604] ? syscall_slow_exit_work+0x520/0x520 [ 311.821463] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 311.827000] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 311.832557] do_syscall_64+0x6be/0x820 [ 311.836456] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 311.841808] ? syscall_return_slowpath+0x5e0/0x5e0 [ 311.846723] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 311.851564] ? trace_hardirqs_on_caller+0x310/0x310 [ 311.856602] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 311.861648] ? prepare_exit_to_usermode+0x291/0x3b0 [ 311.866665] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 311.871511] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 311.876697] RIP: 0033:0x457569 [ 311.879893] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 311.898784] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 311.906480] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 311.913738] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 311.921014] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 311.928269] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 311.935528] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 [ 311.949214] EXT4-fs (sda1): re-mounted. Opts: ,errors=continue [ 311.965480] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:43 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0060000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:43 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x6, 0x50000) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3ff, 0x10000, 0x0, 0xf, 0x1e, 0x4, "05dea6cf1260a9ebfcf328402f3daf0a4baab074f0acfd739e391cd82a5a5bcc04a9fa7f6adaa76d96c314e2ee8c446fd86784073ba6ed0a834e61aa897ef430", "257b63016efe26cd144a4c3e639a447c1805641632232e5089c3d4e4c339eca08a94fb6a49172e0c2114a530b64b60dc357bf1d754d0fdecc79e4d8bbc446f25", "34aa404ad6df7d784a3b9130cc6c473479a1c230dd74193e280edfd4db31a6c2", [0x7, 0x4bb]}) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) fsetxattr$security_smack_transmute(r1, &(0x7f0000000180)='security.SMACK64TRANSMUTE\x00', &(0x7f00000001c0)='TRUE', 0x4, 0x3) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:43 executing program 3 (fault-call:4 fault-nth:11): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:43 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="980100201400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 312.016078] EXT4-fs (sda1): re-mounted. Opts: ,errors=continue 02:06:43 executing program 0: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f000000d700)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0xe7, &(0x7f000000d940)}, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000780)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3dad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88bc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e57e43a3e36bd48d2a85bf4fd4a804e83f2f3cf378a435af5e287d4e27337b4ada11b26219832ec6b2b38446b3b95fe3771e9f42ca30fb21e12f0a3d8bc2d85454af9fcc0232d8fd909448b01f46c593d31ea1c926465e35a4199079c3ca41128b17cb01fbf5b522be0fd02022ada37fecc14b6c8c8831883b85a1106f2f867020d529f17a350f20dd3bf51a98cfda70c2e3638a483fd3f87940bb478b07c4c110394c0093d17955089f2ca97bbe075124c9b1ff6500d536a95d96f03d48596e008bf0a028b539cec796cec9bf585eb80fe3e0d26") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={"6e72300100", 0x1132}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0xc}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000340)) socket$kcm(0x11, 0x0, 0x300) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000640)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r4 = openat$cgroup_ro(r1, &(0x7f0000000280)='cpu.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r4, 0x4008240b, &(0x7f00000006c0)={0x2, 0x70, 0x80, 0x74, 0x0, 0x0, 0x0, 0x31fe, 0x480, 0x7, 0x0, 0x80000000, 0xfffffffffffffff7, 0xffff, 0x4, 0x0, 0xe4cf, 0x4, 0x20, 0x1000, 0x3, 0x7f, 0x0, 0x7ff, 0x16, 0x1f, 0x6, 0xf775, 0x2, 0x3, 0x9a97, 0x5, 0x365b, 0x7, 0x0, 0x10001, 0x0, 0x8, 0x0, 0x3, 0x2, @perf_config_ext={0x3845, 0x10000}, 0x10028, 0x8, 0x1, 0x7, 0x7f, 0x10001, 0x3d}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={0x0, 0xffffffffffffffff, 0x0, 0xd6, &(0x7f0000000500)="6e7230030060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3cad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88c60fd7140fbc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e"}, 0x30) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000004c0)={&(0x7f0000000140)='./file0\x00', r4}, 0x10) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000400)) write$cgroup_int(r2, &(0x7f0000000000), 0x12) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="f81600004000e3ffb6070000010000004800000000050000000000000000000078360000000088c63d1e09e7c7b1779f01d7189901572956c1401a553ac5284685674e38ac3b9fb4e4376583246c15df249054dffee369f1012b1a9568eafd4d7934f13d9084c55e3814c48af88da6d23b941566c96505c3a998d6f70a1ebe33d84a61abd51085bc0c2d49cd07000000245092fa1cb2362769b33bbfa8d2919bf49c933a794d32aed4ed40c2d21617625347c30e4693941908697963cb2e76d245b7feb20385d094e988577fff01d041603a55b5221041fed3ef611c302394fd7330c21b358c700e7a6fd95a5ee26b7bb19cc8e688152cef67932e3d3d88e76c7a578a33caa0cb909ebdd140d46650cc477fd0beb032d49ced343c2ff7e1137602e48c5ff009ff3931ba6631f74e90a2e67dcb2aa3888c8283147514789c6c44f0d627ab3b53ad1d94fa3458d45ec9b0064b39ddb4f20a7180b07789845828dd30ae7a2a08c6f31355907b8e673790767cf9f84198ac69696e428686a11259feed1839"], &(0x7f0000000300)="4f50431c4e4c0000eb0000000000000000"}, 0x48) socket$kcm(0x29, 0x5, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xd, 0xf6, &(0x7f00000000c0)="410b8a8046c3a988fbc5f08e8e", &(0x7f00000001c0)=""/246, 0xffffffff00000f20}, 0x28) openat$cgroup_ro(r3, &(0x7f0000000680)='cgroup.events\x00', 0x0, 0x0) close(r0) [ 312.084872] sg_write: data in/out 1935898123/2147479510 bytes for SCSI command 0x0-- guessing data in; [ 312.084872] program syz-executor1 not setting count and/or reply_len properly [ 312.122199] FAULT_INJECTION: forcing a failure. [ 312.122199] name failslab, interval 1, probability 0, space 0, times 0 [ 312.136230] CPU: 1 PID: 10875 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 312.143531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 312.152900] Call Trace: [ 312.155507] dump_stack+0x1c4/0x2b4 [ 312.159246] ? dump_stack_print_info.cold.2+0x52/0x52 [ 312.164453] ? lock_downgrade+0x900/0x900 [ 312.168617] should_fail.cold.4+0xa/0x17 [ 312.172706] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 312.177830] ? rcu_bh_qs+0xc0/0xc0 [ 312.181382] ? unwind_dump+0x190/0x190 [ 312.185289] ? graph_lock+0x170/0x170 [ 312.189113] ? is_bpf_text_address+0xd3/0x170 [ 312.193621] ? graph_lock+0x170/0x170 [ 312.197445] ? __kernel_text_address+0xd/0x40 [ 312.201957] ? unwind_get_return_address+0x61/0xa0 [ 312.206904] ? find_held_lock+0x36/0x1c0 [ 312.210982] ? __lock_is_held+0xb5/0x140 [ 312.215073] ? ___might_sleep+0x1ed/0x300 [ 312.219245] ? kobject_uevent+0x1f/0x24 [ 312.223235] ? arch_local_save_flags+0x40/0x40 [ 312.227836] ? __fput+0x385/0xa30 [ 312.231294] ? ____fput+0x15/0x20 [ 312.234756] ? task_work_run+0x1e8/0x2a0 [ 312.238829] ? exit_to_usermode_loop+0x318/0x380 [ 312.243605] __should_failslab+0x124/0x180 [ 312.247865] should_failslab+0x9/0x14 [ 312.251681] kmem_cache_alloc+0x2be/0x730 [ 312.255876] skb_clone+0x1bb/0x500 [ 312.259446] ? skb_split+0x11e0/0x11e0 [ 312.263348] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 312.268372] ? netlink_trim+0x1b4/0x380 [ 312.272375] ? netlink_skb_destructor+0x210/0x210 [ 312.277273] netlink_broadcast_filtered+0x110f/0x1680 [ 312.282499] ? __netlink_sendskb+0xd0/0xd0 [ 312.286749] ? kasan_check_read+0x11/0x20 [ 312.290912] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 312.296208] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 312.301758] ? refcount_inc_not_zero_checked+0x1e5/0x2f0 [ 312.307222] ? refcount_add_not_zero_checked+0x330/0x330 [ 312.312695] ? netlink_has_listeners+0x2cb/0x4a0 [ 312.317461] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 312.322495] netlink_broadcast+0x3a/0x50 [ 312.326572] kobject_uevent_env+0xa83/0x101e [ 312.330992] ? mutex_unlock+0xd/0x10 [ 312.334718] ? kernfs_remove_by_name_ns+0x65/0xb0 [ 312.339585] kobject_uevent+0x1f/0x24 [ 312.343396] device_del+0x6c9/0xb70 [ 312.347048] ? __device_links_no_driver+0x320/0x320 [ 312.352075] ? kobject_put+0x86/0xe0 [ 312.355811] hci_unregister_dev+0x3a2/0x990 [ 312.360151] ? hci_bdaddr_list_clear+0x2f0/0x2f0 [ 312.364919] ? ima_file_check+0x130/0x130 [ 312.369093] ? vhci_close_dev+0x50/0x50 [ 312.373115] vhci_release+0x76/0xf0 [ 312.376756] __fput+0x385/0xa30 [ 312.380064] ? get_max_files+0x20/0x20 [ 312.383969] ? trace_hardirqs_on+0xbd/0x310 [ 312.388300] ? kasan_check_read+0x11/0x20 [ 312.392459] ? task_work_run+0x1af/0x2a0 [ 312.396539] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 312.402004] ? kasan_check_write+0x14/0x20 [ 312.406263] ? do_raw_spin_lock+0xc1/0x200 [ 312.410513] ____fput+0x15/0x20 [ 312.413818] task_work_run+0x1e8/0x2a0 [ 312.417741] ? task_work_cancel+0x240/0x240 [ 312.422082] ? copy_fd_bitmaps+0x210/0x210 [ 312.426343] ? do_syscall_64+0x9a/0x820 [ 312.430333] exit_to_usermode_loop+0x318/0x380 [ 312.434931] ? syscall_slow_exit_work+0x520/0x520 [ 312.439804] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 312.445357] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 312.450915] do_syscall_64+0x6be/0x820 [ 312.454816] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 312.460192] ? syscall_return_slowpath+0x5e0/0x5e0 [ 312.465145] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 312.470018] ? trace_hardirqs_on_caller+0x310/0x310 [ 312.475048] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 312.480078] ? prepare_exit_to_usermode+0x291/0x3b0 [ 312.485117] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 312.489981] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 312.495175] RIP: 0033:0x457569 [ 312.498427] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 312.517339] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 312.525061] RAX: 0000000000000000 RBX: 00007f486e07bc90 RCX: 0000000000457569 [ 312.532341] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 312.539630] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 312.546924] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 312.554217] R13: 00000000004ef912 R14: 00000000004cc460 R15: 0000000000000004 [ 312.570987] IPVS: ftp: loaded support on port[0] = 21 02:06:43 executing program 3 (fault-call:4 fault-nth:12): r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 312.589732] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 312.645554] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 312.904547] device nr0 entered promiscuous mode 02:06:47 executing program 2: 02:06:47 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000000), 0xcd}) 02:06:47 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:47 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0020000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:47 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001200add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:47 executing program 0: sched_setaffinity(0x0, 0x375, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x617, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000140)='./file0\x00', 0x0) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 316.370113] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:47 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) timer_create(0x3, &(0x7f0000000000)={0x0, 0x17, 0x4, @thr={&(0x7f0000000080)="dec162ed018e7e3c7481b2008f2d9dca1373678998ae027cb4a9715d87bc460304ba8053c91e24b5ceb702ad5f023b4fd827815c0be553549dbcb43a1bdfa226b32d5528194fbba4efed53a08698d4aef235258487ffd03d94bd724fa3733de9329ec7adf11a49ca9744c25dbdde3858bfeeb483ae3fc68ddd9b69ae222974053fecfa32614dd95dc8702a875ac014350c993cff1f1105c07b0d3044d12217", &(0x7f0000000140)="3a355e7dc61044cdd71afad5b93b72482344511999051345179bbd64ef85024faef1ec464f8c76e46e57b49e18bd135791d3f51fa7e6a29bbfabed05998f5d1910ecb818fa3e9d59f55a9aa6a7424ae593352553392c997fe74abb8ff7afc966af0699434361052e4d1416779041ce18ccf0de36b7afdce2f2bea97d586fd2abfb717fe42f8ba228470ca0eebeecc81f70c795e792e54f082af5f09485323c49141c9cfbb0bf6752ed3b45600bce91c42f1231f176d0d44ea6"}}, &(0x7f0000000240)) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:47 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="ff800047b33dcedbc97970206253e40ff301a28dd2f2d145cb84f41f9b006662ef8a3d8d784f099bdf3fb6e58eadca3ab735c689bc975c2f0fae98ecb71bcc0294709f96c9f1db64b2fad1f9d37b4b72fee96a8ed36461ab9fe077b0c85efe5c94b9d0073682a6b0e204a3"], 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f00000000c0)='ppp0:%\x00') r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x5, 0x2000) close(r0) 02:06:47 executing program 2: [ 316.494786] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:47 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000007480", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:47 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vga_arbiter\x00', 0x600840, 0x0) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000600)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f00000000c0)) r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x80, 0x0) ioctl$EVIOCGBITSND(r3, 0x80404532, &(0x7f0000000140)=""/23) 02:06:47 executing program 2: 02:06:47 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="5800f0001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:47 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x100, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e21, 0x9, @ipv4={[], [], @local}, 0x5}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e21, @local}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e24, 0x7fff, @remote, 0x101}], 0xc660245b50458f4c) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000240), 0xc) close(r1) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x94110, r1, 0xd) 02:06:47 executing program 2: [ 316.778796] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:47 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000080)={0x0, 0x7d, "d66da4d538d80fb62dc7aec6166a0a0d982672c96fcc8bfa0c716e847a9aff6987a8b5a6a7766de1943d68ed6ac9a521844ff043d7288f08af304faa30ed467f47cfe2ad2910eb1b6cf763bdc24cba837253f803990db4153c3529cf2d6cbe02f64a3d1400e990f4b231a0b02eeb51864f3566a00ffcf1061789dbdb07"}, &(0x7f0000000140)=0x85) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000180)={r2, 0x4}, &(0x7f00000001c0)=0x8) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 316.862499] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:48 executing program 2: 02:06:48 executing program 0: 02:06:48 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="ff1d8d07000000f6f2ef06000000000000001eeb851bac53ee6b89fd33ae80582a41e281a5e61f737d39b6aea73f"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000100)={{{@in6=@mcast2, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast2}}, &(0x7f0000000040)=0xe8) bind$bt_hci(r1, &(0x7f0000000240)={0x1f, r2}, 0xffffff9c) close(r0) 02:06:48 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0000000180", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:48 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000240)={0x0, 0xfffffffffffffffd, 0xbc, 0x4, @buffer={0x0, 0xd4, &(0x7f0000000080)=""/212}, &(0x7f0000000400)="5eefe0a3ac15e24b55e770259673d38ac64ae54fa0788bb1df985de2bd68291193743a2275ec91926f8126b87f961331a0b6d50291b630ec6c0efcc721111a62bf4c2b15f386dec820bf45f7349426eec21f52d39ca0f513d648f294b10a6bb204ae0b2e4e67f8c2efa37f5ae7739d13ed97d1435e10aa2032fb7fe148cc2aaf22a9568a614e711c3aecf9b7bd10f07e6dc03c46ce64baceffb5895c10d40d6464cd725489d23541a0f568494ae8ce463bd9e2768aef73f67f51914b", &(0x7f0000000180)=""/92, 0x1, 0x0, 0x1}) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:48 executing program 2: 02:06:48 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001300add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:48 executing program 2: 02:06:48 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x1, 0x0) ioctl$RNDZAPENTCNT(r2, 0x5204, &(0x7f0000000080)) 02:06:48 executing program 3: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x18100, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f0000000100)={{0x3, 0x3, 0x4, 0x3, 0x8}, 0xc6, 0x2c000000, 'id0\x00', 'timer1\x00', 0x0, 0x20003, 0x1ff, 0x5}) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080), 0xc) close(r1) 02:06:48 executing program 0: [ 317.531601] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:48 executing program 2: [ 317.613717] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:48 executing program 0: 02:06:48 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000000)=0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x8200, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r2, 0x4038ae7a, &(0x7f0000000140)={0x2, 0xbff, &(0x7f00000000c0)="482230004d2a391e1719a20c70e887fa23c674c4efa79a917c924397d803d0bc88eca5a1c39e2b74bf64cbcc8f1ea421bacf2883561b4411869d1ff59a14dbd106d04c78eb1c6c185a09e9b9351c2a052b9049b3e70d8e420fccf78dd94bd6d451f62b11f130", &(0x7f0000000400)="366eba56031e1022c7b80e28d7293d74feffe4472f153ba989778149a83048fe03a18260d44cb5a7779e70041b9f9287a4627c16caa28ffe4c1da97eb7ae62fe2a244600576206f46a64c740f851bc3e5d81d58a5af208309c22b4ccb46945c3b097994c7ed220052c5193353b8ae89fea571dc7409ef8ad29c9fe1b4702bc9954073e3ba824251b656071e37a0197306a8653d0fc136252dfc4f4d74a40980b9b58ac08c99086b8ce726667ee39350f1e302ce74cefe1e150c05fb1b11817678ce7bedd5395b5b07d", 0x66, 0xc9}) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:48 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0048000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:48 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x248, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) write$P9_RLERRORu(r1, &(0x7f0000000040)={0xe, 0x7, 0x1, {{0x1, '%'}, 0x7}}, 0xe) 02:06:48 executing program 0: 02:06:48 executing program 2: 02:06:48 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="585a02001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:48 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000180)={0xffffffffffffff9c, 0x10, &(0x7f0000000140)={&(0x7f0000000100)=""/31, 0x1f, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0)=r1, 0x4) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socket$bt_hidp(0x1f, 0x3, 0x6) r3 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x100000001, 0xc3e8be845c856dab) getsockopt$inet_mreq(r3, 0x0, 0x24, &(0x7f0000000080)={@remote, @multicast2}, &(0x7f00000000c0)=0x8) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[], 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_VERSION_NUM(r3, 0x2282, &(0x7f0000000240)) lsetxattr$trusted_overlay_redirect(&(0x7f0000000280)='./file0\x00', &(0x7f0000000400)='trusted.overlay.redirect\x00', &(0x7f0000000440)='./file0\x00', 0x8, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=@ipv4_getroute={0x1c, 0x1a, 0x4, 0x70bd2d, 0x25dfdbfe, {0x2, 0x94, 0x10, 0x5, 0xfe, 0x3, 0xff, 0x7, 0x800}, ["", "", ""]}, 0x1c}}, 0x4000001) 02:06:49 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="80b4f5fe89b5"], 0x2) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000080), 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000100)=r0) bind$bt_hci(r1, &(0x7f0000000240), 0xc) syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x5, 0x200) close(r0) 02:06:49 executing program 2: 02:06:49 executing program 0: 02:06:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:49 executing program 2: [ 317.935198] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:49 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="ff809f88a4b275d5f892990ecded665fbccfa5bc057a233dafae5749c125e67d082c978ec4ccd2653e7b59d2347ae0304db2c480f6bd27571fad5a492b292c9144cf06961cf7e8cc9154b479afe144f956fc046bed4e65cb0385be56ac6f20601f0254430fe82aee30f37ef7251850aee3d55d369b042c988a482319f1a251b84cb998dd819b72f7"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) close(r0) [ 318.021690] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:49 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0700000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:49 executing program 0: 02:06:49 executing program 2: 02:06:49 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x100, 0x0) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f0000000140)={0x8, 0xff, [{0x3, 0x0, 0x20}, {0xd84, 0x0, 0x9}, {0x4, 0x0, 0x6}, {0x8, 0x0, 0x9}, {0x9e, 0x0, 0x3}, {0x53d6, 0x0, 0x3}, {0x7, 0x0, 0x9}, {0x5, 0x0, 0x7}]}) setsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000040)="f33117542b7f08eab07a813572816249d8410f5b914674330d617682bc35fe27172a5a28cf713f6a587f3962a7f5aed4be7030da32e4b45d296cd1094a23627cdf942a7735c6", 0x46) mq_unlink(&(0x7f0000000480)='/dev/hwrng\x00') write$P9_RLERRORu(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="55a4a4119262c7dae9c9693d7786c515"], 0x2) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000280)) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000440)='/dev/hwrng\x00', 0x1, 0x0) setsockopt$packet_int(r0, 0x107, 0x1f, &(0x7f0000000100)=0x101, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000600)={0xa, &(0x7f0000000580)=[{}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}]}) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/null\x00', 0x80, 0x0) ioctl$BLKALIGNOFF(r3, 0x127a, &(0x7f0000000640)) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000400)={r2, &(0x7f0000000300)=""/209}) readlinkat(r3, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000640), 0x0) fcntl$addseals(r0, 0x409, 0x2) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000500)={0x100, @time={0x77359400}, 0x8, {0xb6ec, 0x5}, 0xfffffffffffffffa, 0x3, 0xc}) close(r0) ioctl$KVM_GET_CLOCK(r0, 0x8030ae7c, &(0x7f0000000200)) 02:06:49 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="58f000001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x2, 0x80500) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:49 executing program 0: 02:06:49 executing program 2: 02:06:49 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000240), 0xc) close(r0) [ 318.243769] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:49 executing program 0: 02:06:49 executing program 2: [ 318.323992] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f00000001c0)=ANY=[@ANYRESOCT=0x0, @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYPTR64=&(0x7f0000000100)=ANY=[@ANYPTR, @ANYPTR, @ANYRESDEC=r0], @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYRESHEX=r0], @ANYRES64=r0]], 0x1f) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000500)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000540)={0x1, r1}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x8840, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r3, 0xc0286415, &(0x7f0000000080)={&(0x7f0000693000/0x3000)=nil, 0xfffffffffffffff7, 0x5, 0xb, &(0x7f0000d2c000/0x3000)=nil, 0x8}) ioctl$NBD_SET_FLAGS(r3, 0xab0a, 0x2) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) write$P9_RRENAMEAT(r3, &(0x7f00000000c0)={0x7, 0x4b, 0x2}, 0x7) openat$userio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/userio\x00', 0x52603e433d88b2c8, 0x0) syz_open_dev$audion(&(0x7f00000004c0)='/dev/audio#\x00', 0x672, 0x44080) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) getsockopt$netlink(r3, 0x10e, 0x3, &(0x7f0000000400)=""/186, &(0x7f0000000240)=0xba) 02:06:49 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="7fffffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:49 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000080)=ANY=[@ANYRES32=r0], 0xfffffe96) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:49 executing program 0: 02:06:49 executing program 2: 02:06:49 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000022300add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vcs\x00', 0x10000, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f00000005c0)=""/255, &(0x7f00000006c0)=0xff) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$KVM_SET_VAPIC_ADDR(r1, 0x4008ae93, &(0x7f00000001c0)=0x4002) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000180)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f00000000c0)=[@in6={0xa, 0x4e22, 0x100000001, @mcast1, 0x6}, @in6={0xa, 0x4e24, 0x4, @dev={0xfe, 0x80, [], 0x16}, 0x80000000}, @in6={0xa, 0x4e20, 0x6, @ipv4={[], [], @multicast2}, 0xe44c}, @in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e20, 0x100000001, @mcast2, 0x2}, @in={0x2, 0x4e24, @rand_addr=0x8}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e21, @local}], 0xb0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:49 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = semget(0x3, 0x3, 0x202) semctl$SEM_STAT(r2, 0x3, 0x12, &(0x7f00000000c0)=""/240) bind$bt_hci(r1, &(0x7f0000000240), 0xc) getpeername$inet(r0, &(0x7f0000000040)={0x2, 0x0, @rand_addr}, &(0x7f0000000080)=0x10) close(r1) 02:06:49 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) recvfrom$inet(r0, &(0x7f00000000c0)=""/145, 0x91, 0x0, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) 02:06:49 executing program 2: getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000001440)=@assoc_value, &(0x7f0000001500)=0x8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000004c80)={{{@in6=@mcast1, @in6=@ipv4={[], [], @remote}}}, {{}, 0x0, @in=@multicast1}}, &(0x7f0000004d80)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000004dc0), &(0x7f0000004e00)=0xc) getpgrp(0x0) getpid() setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000280), 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000006740)={{{@in6, @in6=@loopback}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000006840)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000400)={{{@in=@local, @in=@local}}, {{@in6}}}, &(0x7f00000000c0)=0xe8) getresuid(&(0x7f0000009a40), &(0x7f0000009a80), &(0x7f0000009ac0)) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000300)=""/204) mkdir(&(0x7f0000000180)='./file1\x00', 0x0) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000540)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000100)='ext-\x00', &(0x7f0000000140)='./file1\x00', 0x0, 0x0, &(0x7f0000001800), 0x820, &(0x7f0000000240)) 02:06:49 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="ffffffeb80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:49 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r1, &(0x7f0000000080)="ff8327d88d62917a6d8614566e4f4eadd097c9aae4958f8a87668dd254b287d3270cdcd876f15c", &(0x7f00000000c0)=""/36}, 0x18) getpeername$unix(r1, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f0000000280)=0x8, 0x4) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000240)={&(0x7f0000000400)=""/4096, 0x10000, 0x1000, 0x7e82}, 0x18) 02:06:49 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:49 executing program 2: ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40086607, &(0x7f00000001c0)) madvise(&(0x7f0000a75000/0x2000)=nil, 0x2000, 0xc) mlockall(0x1) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) 02:06:49 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="ff80a7c1738c10e09ca666ca4db9f0edab3049e56733ba90823f9078fe3c78de2c315df23c495afa2100b400d0a424c96c756bec6d71e5a3b8d845e5a4666146008f"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x4001, 0x0) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x6a) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:50 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:50 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580500001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:50 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="3d1a37ef5522ff80000000"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000000c0)={0x0, r1, 0x3, 0x4, 0x3, 0x3}) bind$bt_hci(r1, &(0x7f0000000240), 0xc) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff) r2 = open(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) r3 = open(&(0x7f0000000440)='./file0\x00', 0x0, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r3, 0x40086602, &(0x7f0000000000)=r2) close(r0) getpeername$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x14) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x1b, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5000000000, 0x0, 0x0, 0x0, 0xc896}, [@map={0x18, 0xf, 0x1, 0x0, r0}]}, &(0x7f0000000140)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x1, [], r4}, 0x48) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, &(0x7f0000000080)) 02:06:50 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="fcfdffff80", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x1, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:50 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:50 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) ioctl$FICLONE(r0, 0x40049409, r0) write$P9_RLERRORu(r0, &(0x7f0000000080)=ANY=[], 0xffffffffffffffb0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mknodat(r0, &(0x7f0000000040)='./file0\x00', 0xc0, 0x2) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rfkill\x00', 0x20000, 0x0) perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x70, 0x100000001, 0x9, 0x4729, 0xb9, 0x0, 0x42, 0x4, 0x0, 0x25, 0x800, 0x0, 0x2, 0x1, 0x1, 0x0, 0x100000001, 0x1f, 0xffffffffffff3e7e, 0x7, 0x6, 0x1178, 0x10001, 0x200, 0x46b192df, 0xc8, 0x8, 0x2, 0x4, 0x2, 0x9, 0xbb97, 0x8, 0x8, 0x2, 0x2, 0x0, 0x0, 0x100000001, 0x3, @perf_bp={&(0x7f0000000280), 0x1}, 0x501, 0x8000, 0x8001, 0x7, 0x3ff, 0x20, 0xf45}, 0xffffffffffffff9c, 0xa, 0xffffffffffffff9c, 0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000480)='/dev/sequencer\x00', 0x0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/sequencer\x00', 0x20000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x10400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r2 = fcntl$getown(r0, 0x9) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x84, 0x4, 0x1, 0x1, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x3}, [@nested={0x28, 0x8000, [@typed={0x8, 0x1b, @pid=r2}, @typed={0x8, 0x25, @u32=0x2}, @typed={0x14, 0x7b, @ipv6=@local}]}, @generic="2f5763b6ac4cd5c5bbc49e0e62dde303dc07724f0b1a408541139450c38361575906d313cd0fcc2aee53ce5110a76731331da58f623bf536f25308375e5f48abd89fd767e1"]}, 0x84}, 0x1, 0x0, 0x0, 0x4040}, 0x880) 02:06:50 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000000c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000040), 0x12) 02:06:50 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00T', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:50 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040), 0xc) close(r0) 02:06:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000)) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:50 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:50 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580200001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:50 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:50 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x4002, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000100)=0x5, 0x4) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000080)) write$binfmt_elf64(r2, &(0x7f0000000300)=ANY=[], 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x7f, 0x1, 0x3, 0x0, 0xffffffffffffff9c}, 0x2c) bpf$MAP_CREATE(0x0, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0xffffffffffff4c25, 0x0, r3, 0x0, [0x305f, 0xa]}, 0x2c) mmap(&(0x7f000047e000/0x1000)=nil, 0x1000, 0x1, 0x31, 0xffffffffffffffff, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000000c0)={0x7f, 0x100000000, 0x8, 0x10000, 0xe5, 0x1, 0x6, 0x300000000, 0x5, 0x4}) ioctl$PIO_FONT(r2, 0x4b61, &(0x7f0000000400)="c40f55fe869725bced735c9e9beb904c7d8114c2517f9fe09a0181d725e9df808f76f68031087450a50a1d60e842987bee571169d48e72a02048c3593e75a64efbe86b7a70bc650dfa888a324c6231f13189fcd13893162addbc87122c6fbf34d0db2484294834ff2ff74dac3ce62bc60e30797c289b6bb452995d15c7392899d19f05469f1ab1804facdd52ce897b473376c04b9c38ad2454ad12328d9a1d133934db4ffb7d5f0f6b507db1a05d3dc3d11b4c725274698e2d05e1c89d31fa58dd45fd51ae7d97765cb0509e9c460ab49b07698cef2f153baa387f39775be5a2cab363a581390d4a7d0751c4724d7e52fc17fe82aca01f968589f0b0491b3a4859cedb01e8fd8cfb0408a7846049647dac7e51c46ffd4a3534fcfba5031ddd939f079d1c2c0ba7d2dea7d7bd95c8b0ea6fb4a1602d84e4892e107aade1e4fee3a6a6583da1cacec2995e9fd65cabc8390d0b452a4181ab9d74aa1a908512e2a6911e3ee586eb6f3ecab33df4db25835345d7e8307ea676c29ca68f63181d6633594d6a1e51e435bf6cdc8991e1bf03397ba78fd70880670f7226dded3e9063a18c58617f9c0b52cb9d04fc9eeee56485e8b243e3feb999c20c540902850d649b2980331bb41772359a3224b2bf03e4f4cdc1a823cc3d783b1c501e916e0bdaa90d0584d8c86b6b3d6c0503e0783e829849bfa34d75bbc8811bd22c03dfbb93e57bdbd9ff13b04c8099505e5d8d6e4122abb49445eb3e59e2d86e761f453d8dffeb6713dc7087c80c994f7b7532caf9614814a13d40d174cd0f3b6abc0acdb221cfe895d7d52cf103f94b6eabb5e30c7716073b53bf892b04ccdc6cb8f9c9238c49620accc2663e9810d149b57b155f6027a5e08f6425cb0a3f4b8b63ddbaa512c93b581939f2f61ccdb90778a6b098548b6ab63fadc38555072f35c707880efe22e622ff946d8e6298fc58294f7082942b882a9912b23630882516290dad1934600c366c2b33b8c8b9590046e9b0d473cba2fd5cb720ccc4cef748ecece89cb693d207473d7ebec8e7f9a2ec1bea520d1fcd502011758fbfeb7f38907b9652bbcc250e9fcbd5ca33d19984cc601c7f6501c84d2b737d3f79867a18fb8e87c61f68a90543c282b5b592280d136650f1280755f3030c85c373451988f3d0186dc314abb923764d1cf2d561ffdc0a891fae38cd6a4177f4c3778ce9fbb8c7f02b6646f10924504c85300c7361cd015e46d00b9b277ac90c9c73940b764dd359a9ff68c4c20c9b0cf8a9b11709202c8da515c66a9c859d1d7b252c4867e85da4943ffbe4a8580a7b861eb4a7069273cfc11b0a671064813f0a030cb28ddd3c321613b2696db18582f100e3c619f24e91015f0c493db412a1f5546f49bd19644fe42ec036c14e40ecdf38a0588929abf021175d23aa0fc8a58e30eec5e6e17c7e8cdf66814dec2b63402dc4e71d2675df1b3b6e0f080c586597d788db9c09dac5b7a8e535e30143e5b2d9acaa2dd8ff737c93e010ccd2803bbdd105b1b97b1e40f9ff2e8b2dbb6e77c3307949f9013252b0b682b8f92fde3ece38c50164de989e6f9b8912cc7ef1c4755cc7eb4688260813d71ada36f562aa2e5d9e8392a70a8f5e32371e779702921936c31081a917cdbbf1130a0102de0fd908e51bd414eedeaf74fd5c4272b28f2174709af31dcc691caa47363868e1357f52fb215fff5b975b0a7e1533d2cbbfd81bd4566808f39b933db992f9d2d7518c314b6e29f7adf4a3cb9b646276a709bdc20e76c163cafda46f9977756e11c642e768d61f90b1baee43fd80233e7d5707262d46ee3651ff13b768911b609f6193c953db102bd48f147c48a47b333f112e5030892185baaf39834ae2919a210faa81d1f4971ac19b290f65e8580a513e03a5cba89dd566714e19cd7eac3f31fe37aeafb1d97597840e7cdc9057c504a972a0d24acec5fb17037063d63d40fc313efbd7e0e6d510ec287b81201df877175fc185ab96f9f7fcb866872b21831dc5055e4f4c0451c18490d09dcd2d7850fb02ae69e4f8df9d0d8ce742679dba667506ae5e6b52ba0df8cf629c505a89b467668cc55dee615da26766a6a68ffddf67336d274ba33c629c9afb027b9f94dfcffb3d48548f5585530a6a3537ea0093232ee90b765f1f075e3ca05441cf7fea98e5f68e6e68935f73d6f9ab0ee4a47e875a14d9ba242a696712c521d642a1e29061778f6ccd5fbcd6ee20c585598ed535669d99eda285d59edef9b90c31d28700484ad95b1e430ae2b3873310f820afe06ff16ab2891a53f251b59a1a6bd7a2722cfb96ccd84f54b3bf7c8ce49db02a9b80fa7c6e54a98bb3c0e9a647d88126af0beba605b9e5488c7f098b4df39e3335e964723f27b539f0fbe6f1b5e790fbe1f57fa7494e36a4713b138896fc0cb61e33c7b0cdc2917e0da916f90fe68f7edcd2ce99a5f479c320d0ea3dd246bd33e3c405105804f9f0bcd49f851d3d928ff89df67ea8f4bb091d8eae05047e7ea4b9d8e0591d697d3334c807c777a99c8fb5989e84fe932c88230983d68caab1b569eae018ee6dc42abb7e550edee1b06456a22f6a42c318c6fca5cb581aa91af26ec1ade6b9647b5460a18a8528fc009792f875145b506c83790d77712f7a4398c9e7b021f9ebd0fdf926b107564e7578b6069c3859e8db1966a9ba47b67a0b39363b7fd6a6f8addf683007210818ddc258ecb1849df30e58c4360bcc38e1f991d030dddf3d207a81729ce5f1e45844dd37dab40d0f148e27880ac9659df4188e328fa53181bee5bbb3ee17a4e05b00b629bf05127f93bea9817e0ced3750e2c1bdd8aaaf807a0465eb9b510a5bcabdd592a44ab1a651fbf6a8225ccaa7a15b579557ed4282fab5409aed2b7b327cce79a66841c451fc068bc01c0a6f653110119663f60ad7b9a0245886a5d431155e191bf6b03d064fcb66922224fb9edcc11797c4c97b0d7e25b560f7a746f8ae88e9edab0a02760ee9ce5ecbd6c26f288f23c57c03eb737b58cbbf1962b940ae64db7ebf761e898d4b44d3f3d1c0ecfaccfdd3cae0575d8351422b2cca908a575c9b9baecbeca406b483ce89f68d7a96ee1228f6859f2623c8ac36bdf017fd0a68fad91b0a38fe802a5d35f9cff6ea0407244c294566962a6880793da4e3d075978aba2d257109d112997b307bfc4190869c37233b7366281e71696b2454c5b97691cca87eaf6866c390e5f4279efef9fef3bef7168ad85c8becf28f1412b2379c3c4d14fe3690b99e277bae76c2783f33edac6e180f87e37a1335d6151a55f5b0ede465fc9cfe507dc1f542c4771aef4942de200608420040873b31a74239306cb9b58e42726fc98843430efcabc5765241c2ce05276bf4421d9666924e6c0bb845bb6401027ea0037cd543f0ee63f264cec65fd7648c4db706c32802b0a19c5f23a00235221a75494ee7f784e53aa44acb5d489484501f5a1525580e1e897a2d800b9d0ae1ef93a642baae2e209140a332e28a3c0423ce7d2483e6012544607dbd2be8619e4f7243cf2a33845b5ddbaecec53a03cc6ab7b07bc9825183151f52de88e8a8d9677481e2a874375c36bf4a46c2a988bccfe3e7362ccbe60bf743d635ce7204269f668313f6bbf4b207cac6ceccf24580f5767552169352561d79f55cacb28097a2458cfc9242c34d6a38b66dc58e147d1703b5695d464d1f42d8c4dbe628d1ad5a3ef6e9aa98fc4fe394880111a2d0c56c250923316f8a2f2793eff9a90392572472800239a1d6f7807c1d4fa8b26ed8bc1fc55c027a182204c20b7fc5769ddeb458b44928e823a08c62b4f6e86a7e43a1402baa458f3e7d93c28e3876674a0a9239eeb9e0fc1a7d46199ef3fd0e887e5c475e665b1c676fcef51c21f258a8c6916e13511754a6ee20115d50880b3fbf22a1b56ffbf5c40eb3ba77497c9126a7d31e3b7e04bf0fcc1a03317bd40e87cffd3020b8a0988b34679fb92461cce1863dfa401d30fcc1d110fe67225e13d99b5008e7fd519b9ec5279f5481fbf2644f510810f082929094e6a3152c80e826e6c0c0b6f567b6968906e0c98216443e7de3da939b5e85e54b1841cb82d3fdb3aa09e52ae878beabaf877fd1d6160fd9617f0a4d85d1a731036f5a809c68c2121a3a9f86b5d94fbc2cec316a01b4a54e6d2839e0ba9ec7f232114d04e9a0cb7edfdef4e0f07bd02a5dd1f81c69852adced0c2a836eb9423a03f3e60450067c8fb6ffd457841f724a8688ff5e5a57fe10071e60c433a94c0bca6233c4e280c9bd35144975d6791905488b7f35fe53bd2e5a356cef9d6780dafeb3fd85d492111576c72e3360d713de984748843c18def07762a472db66cfb91c750ad19bae9ed10554bb1ec303312205318dbc930bc0b2280d94d71131d6f7fca0d66e1abbffbece070184d972d415a5b339829d1528c28e5a41a35e699e13cc4851278b2c9e010e60cb11c0664590dc8fee7799f5d82452118df921a46c70b3794d4e9ec95c90ced7f45d641924fe4e7c64b72d4fe859b55fc69b18f79d9d2764a39e3090c8226570dea33d00ece6350bd529ea127279d81dd5dd8a88781f0df25afa2d0c55f04813154db5dd44726197e3e0ad5399d3b3287fd79126f66acb03a54e060dc6d6cd26e3bcc7aec16e0f8c6db289581ea8718dc8939ebe9dba91aa3f761d68d100cf9a6016352ca5fd6ec14136fc3bdd1ca7b0b5e7145cf29025b2e53b814ba15d4dbfc10acef7cd3f8712922cc3f457646273670c3618aa2042178fdd449f4b7fd4c9c204d306f5e5aab71820eaabe1a792ed4280889982a030a8e4b456ac9df7bfbe7bf944f7f4d37a6b027589580e243e09a0e841bc2716a1daf611d5adce73755af88b4abc42319852cecf49902dace1d7e8e4dff6a9b8e5f29191371675cf197616bb03ce8d26a3072e26b575cf460540047901c2e538ff76d757fce8c51d83be48bd55493427a78dc330113de5b76f53609b1f5c0f47e1bc187f487066b40d52af34b0e1e32257fc6ea702ab5c33ff07069d5b8ea1f47f5d91575355d7fd87656eb80f6ee8fb8c8ac6a9fc4844bf0dfa1ececf7866a9f154c5913d78ca931b7c083a0787a77919241040937f5ca87bad83f5b41a0398a1bbd774ad8db18c78abe93e864f1df2abc24c8d3002cda5b540b9606b53e0f498a83cecb2fcc0586ec021a2589c771be7782c21cd359c145a6431565f14b01149843c9e2327291379f92764ec73de2d482f968a1c9660f78109320abc21b43fd26ec0e88b494ffcb3e35bc257b40c4e6b1e742fa75fd8032a5b197525a2e15a6ef42fba525376dda6d151c5e04753c1c7eded714cd40c182e11b76961c2b9e7a1f5db62f96ecdb48f64b0c4b4445a5dc3467346cf31c91b14d3edc72b4d7e0a86fb9b9e37cbcec1a4deaa449e4774d60054867b69c5ceb01a5c42f841888ef6ede685f4b552388dd22348d3ac13eac840d43573e5d64b7ebc9a539a61fdf2737cbe73174e595629cf5f6a4aa3768812250f6d60cdcb35231a413e87fc2409af9deb396af602039d401557ee8c10514fb6d9df39288f18680924a735ff4a2c9dcdcdb3ae6d6f92e9d31b6fff4e2d533824dbb100927a8c8c87e1065d7c96932144d70cdb29681634c0440d0510b1065ef6eb8eab946cf1e1eaf564e45bda553cf750d3cbdb445798c2a5545e6d1a755cc5716ab8126077b5e646b99382075df49cbeffc31e1b488173279c0226a4f451396fc425f2271aaf8b774990bb5dfc3f5055d7aa5c4400e3912a8ff196b97322") ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:50 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="ff80a7c1738c10e09ca666ca4db9f0edab3049e56733ba90823f9078fe3c78de2c315df23c495afa2100b400d0a424c96c756bec6d71e5a3b8d845e5a4666146008f"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:50 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00^', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:51 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000040)={0xa, 0x1}, 0xa) 02:06:51 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) [ 319.882854] sg_write: data in/out 91/2147479510 bytes for SCSI command 0x0-- guessing data in; [ 319.882854] program syz-executor1 not setting count and/or reply_len properly 02:06:51 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="ff80a7c1738c10e09ca666ca4db9f0edab3049e56733ba90823f9078fe3c78de2c315df23c495afa2100b400d0a424c96c756bec6d71e5a3b8d845e5a4666146008f"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:51 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:51 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580f00001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000080), &(0x7f0000000100)=0x68) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuacct.usage_user\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000280)=0x3, 0x4) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000000)={'veth0_to_bridge\x00'}) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x400880, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000400)='fou\x00') ioctl$KVM_S390_INTERRUPT_CPU(r4, 0x4010ae94, &(0x7f00000001c0)={0x6, 0x60b, 0x1ff}) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000140)=0x100000000) dup3(r1, r0, 0x80000) 02:06:51 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000240), 0xc) close(r0) 02:06:51 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="007a000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:51 executing program 2: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="ff80a7c1738c10e09ca666ca4db9f0edab3049e56733ba90823f9078fe3c78de2c315df23c495afa2100b400d0a424c96c756bec6d71e5a3b8d845e5a4666146008f"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:51 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x7, 0xffffffffffffffff) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) fgetxattr(r0, &(0x7f0000000000)=@random={'user.', '}%\x00'}, &(0x7f0000000040)=""/43, 0x2b) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:51 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000002c0)={0x0}, &(0x7f0000000100)=0x1) ioprio_set$pid(0x1, r2, 0xfffffffffffffffc) fchmod(r1, 0xca) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x200, 0x4) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000001c0), &(0x7f0000000200)=0x4) fremovexattr(r0, &(0x7f0000000180)=@random={'trusted.', '$vboxnet1trustednodevkeyring\x00'}) getdents64(r1, &(0x7f0000000140)=""/19, 0x13) 02:06:51 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x100, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e21, 0x9, @ipv4={[], [], @local}, 0x5}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e21, @local}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e24, 0x7fff, @remote, 0x101}], 0xc660245b50458f4c) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000240), 0xc) close(r1) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x94110, r1, 0xd) 02:06:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000080)={0x46, 0x6, 0xad6, "613a48f8577048116226cc7c5afb5c512a5f131005ff4e980c91f872ab8a191e12f89f23afad669e2cbe32fa51fa4ea6440b899e41916c3134db1a9b0d4d1b6a5cf632d08784"}) 02:06:51 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:51 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0004000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:51 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="0500000000000000000000000000"], 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000080), 0x4) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:51 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580005001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:51 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x100, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e21, 0x9, @ipv4={[], [], @local}, 0x5}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e21, @local}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e24, 0x7fff, @remote, 0x101}], 0xc660245b50458f4c) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000240), 0xc) close(r1) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x94110, r1, 0xd) 02:06:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0xfffffffffffffffe, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = perf_event_open$cgroup(&(0x7f0000000080)={0x5, 0x70, 0xc58, 0x10001, 0xfffffffffffffff7, 0x80000000000, 0x0, 0xffffffffffff8000, 0xa4, 0x0, 0x0, 0x3ff, 0x3f, 0x6, 0x7, 0x4, 0x8, 0xfffffffffffffffd, 0x6c, 0x66b4ee79, 0x1, 0x973, 0xfffffffffffffff8, 0x6, 0x302e, 0x80000000, 0x7, 0x4, 0x5, 0x1f, 0x8, 0x7fff, 0x2, 0x5, 0xffffffffffffff7f, 0x4d, 0x6cbe3a1e, 0x40, 0x0, 0x2, 0x1, @perf_bp={&(0x7f0000000000), 0xc}, 0x31140, 0x6, 0x1, 0x7, 0x2, 0x3ff, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffff9c, 0xf) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x6) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:51 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:51 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x18000, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x404000, 0x0) 02:06:51 executing program 0: sendto$inet(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:51 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x100, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e21, 0x9, @ipv4={[], [], @local}, 0x5}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e21, @multicast2}, @in={0x2, 0x4e21, @local}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e24, 0x7fff, @remote, 0x101}], 0xc660245b50458f4c) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000240), 0xc) close(r1) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x94110, r1, 0xd) 02:06:51 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000000)={r0, 0x0, 0x2, 0xfff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) r2 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x2, 0x10000) r3 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x7ff, 0x400000) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000100)={0x0, r3, 0x1}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:51 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00;', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:51 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="d35555cf306b1315a0bf935e1a3ff0c9b9a91e98338ee917003ecd831a24fe7db0c776f8c83b6dc26c"], 0x2) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000040)=0x6) fcntl$getownex(r0, 0x10, &(0x7f0000000080)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) fcntl$notify(r1, 0x402, 0x4) 02:06:51 executing program 2 (fault-call:4 fault-nth:0): clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:51 executing program 0: r0 = socket$inet(0x2, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:52 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="58003f001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:52 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$eventfd(r0, &(0x7f0000000080)=0x3, 0x8) bind$bt_hci(r1, &(0x7f0000000040), 0x371) ioctl$DRM_IOCTL_MAP_BUFS(r0, 0xc0186419, &(0x7f0000002680)={0x7, &(0x7f0000000140)=""/81, &(0x7f00000025c0)=[{0x8, 0x69, 0x10000, &(0x7f00000001c0)=""/105}, {0x8cde, 0xfa, 0xc49, &(0x7f0000000240)=""/250}, {0x1, 0xfa, 0x5, &(0x7f0000000340)=""/250}, {0x3, 0x1000, 0x1, &(0x7f0000000440)=""/4096}, {0x4, 0x9c, 0x400, &(0x7f0000001440)=""/156}, {0x3, 0xa0, 0x76b, &(0x7f0000001500)=""/160}, {0x3, 0x1000, 0x5, &(0x7f00000015c0)=""/4096}]}) close(r0) openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x101000, 0x0) 02:06:52 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r0, r0, 0x80000) ioctl$PPPOEIOCDFWD(r3, 0xb101, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000280)=0x0) r5 = getuid() getgroups(0x7, &(0x7f0000000500)=[0xee01, 0xee00, 0x0, 0x0, 0xee00, 0xee01, 0xee00]) r7 = getpid() getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=0xc) r9 = getgid() r10 = fcntl$getown(r2, 0x9) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000005c0)={{{@in6=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6}}, &(0x7f00000006c0)=0xe8) r12 = getgid() ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000700)=0x0) r14 = geteuid() r15 = getgid() r16 = getpgrp(0xffffffffffffffff) stat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0}) r18 = getegid() ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000b40)=0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000b80)={0x0, 0x0}, &(0x7f0000000bc0)=0xc) r21 = getgid() r22 = getpgid(0xffffffffffffffff) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000d40)={0x0, 0x0}, &(0x7f0000000d80)=0xc) getresgid(&(0x7f0000000dc0)=0x0, &(0x7f0000000e00), &(0x7f0000000e40)) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000e80)={0x3, r3, 0x1}) r26 = getpgrp(0xffffffffffffffff) r27 = geteuid() lstat(&(0x7f0000000ec0)='./file0\x00', &(0x7f0000000f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r29 = gettid() getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000f80)={0x0, 0x0}, &(0x7f0000000fc0)=0xc) getgroups(0x40000000000002a2, &(0x7f0000001280)) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000001340)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000001380)={{{@in6=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000001480)=0xe8) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000014c0)={0x0, 0x0, 0x0}, &(0x7f0000001500)=0xc) r34 = fcntl$getown(r3, 0x9) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000001740)={{{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000001840)=0xe8) lstat(&(0x7f0000001880)='./file0\x00', &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000001940)=0x0) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000001980)={{{@in=@rand_addr, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f0000001a80)=0xe8) getgroups(0x2, &(0x7f0000001ac0)=[0xee01, 0xee01]) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001b40)={0x0, r3, 0x0, 0x11, &(0x7f0000001b00)="2e7b656d312173656c696e7578a7262b00", 0xffffffffffffffff}, 0x30) getresuid(&(0x7f0000001b80), &(0x7f0000001bc0), &(0x7f0000001c00)=0x0) fstat(r2, &(0x7f0000001c40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r1, 0x10, &(0x7f0000001cc0)={0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000001d00)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f0000001e00)=0xe8) getgroups(0x2, &(0x7f0000001e40)=[0xffffffffffffffff, 0x0]) r46 = getpgrp(0xffffffffffffffff) getresuid(&(0x7f0000001e80), &(0x7f0000001ec0)=0x0, &(0x7f0000001f00)) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000001f40)={0x0, 0x0, 0x0}, &(0x7f0000001f80)=0xc) r49 = getpgid(0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000001fc0)={{{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000020c0)=0xe8) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000002100)={0x0, 0x0, 0x0}, &(0x7f0000002140)=0xc) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000002180)=0x0) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000021c0)={{{@in=@multicast1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f00000022c0)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000002300)={0x0, 0x0, 0x0}, &(0x7f0000002340)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000002d80)={0x0}, &(0x7f0000002dc0)=0xc) getresuid(&(0x7f0000002e00)=0x0, &(0x7f0000002e40), &(0x7f0000002e80)) fstat(r0, &(0x7f0000002ec0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r2, &(0x7f0000002f80)=[{&(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000240)=[{&(0x7f0000000140)="193ff3475ced41c04af6667b7d10282ff869ae31b1dbd0a36a714341c6a834a1cada0027890b0ac248c57b7d65d322a28b01d107497c39e913afbebe0dd7e5bed0a35c89342a9e3ac064f3ec66b42f39f28e0780031c84007e978d2252733e96b508ec48735f10ffd807d4c7156f07cad43caa9715d799bc2a7a9b73dcddc945e30adb985e96250ddd562f21df3e03be", 0x90}, {&(0x7f0000000400)="1c65d4c2da8ca3a6ae5a0bf66796764f859c1011fa24922ab00093bfada8061a534e31b677640ef4d10ded0484073eaeceffdf1cf6b6e59cae750d4227798a620e0050440e5cf4bcf7da34e1209c0be2263a48df38f1182b41844a6147de0518468644dfa547d24188d3ef73a423c002c89af97a170dae617606dfc75d3606fb546b6ab1398adf71ff7f21c95ac1582c1000bcad64ad78404c159ffcb69b4bae1c67550a69aa3805cccd46d884a0f21572f905b6381106d00e0ba398d543d6db7c370e3af35b74359cb7d1271addeef6b711fbe540b0474a533fb3cea4f352ad3faee23a9d87fa2760887db110446a3c156dd81ecc", 0xf5}], 0x2, &(0x7f0000000800)=[@cred={0x20, 0x1, 0x2, r4, r5, r6}, @cred={0x20, 0x1, 0x2, r7, r8, r9}, @cred={0x20, 0x1, 0x2, r10, r11, r12}, @rights={0x18, 0x1, 0x1, [r2]}, @cred={0x20, 0x1, 0x2, r13, r14, r15}, @cred={0x20, 0x1, 0x2, r16, r17, r18}], 0xb8, 0x24000010}, {&(0x7f00000008c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000940)="a793e29f4fb1f48811fb7455987ef47a374ab8a4826202788c34ab203d121671", 0x20}, {&(0x7f0000000980)="c2317cdfab38f814fb6bfff9f62396c9421e7c482c097a6e5a85fc1d1bd48ef7a99df6a4d6f9e6e67bec69fe97f0de71bfa6859565a19e639f09667b52dde46cfa0670d7c6eba3e7d85bcfb34e3347e63969371ba7e8209e19ad5c1fb5e42bc47ebdcaae098e93df756b701f23501bdb2df04ff3aeb667bb7d3f5152c13a596ffe14e0dd32a1f567bf0394c2df297320bbfc13c6c05820816e66db509249ce583fe102aacc2416", 0xa7}, {&(0x7f0000000a40)="00107a6b900205ab94d86b298575115865debd903b09fc7686b0215c6a37e67ee503c17434578e75cff1d3dab4eb766bb7108b89a21ab358645ac16fd5763ac178b09c216440464dc7f2409eb0f82bf0e42d11e28c55214fba68ce46d30c2fc12f27886a8b47dfd3374cedb7dc91e93e42db752e31d1bc9d93b2e5e3daa2893773f2d42dd07438", 0x87}], 0x3, &(0x7f0000000c00)=[@cred={0x20, 0x1, 0x2, r19, r20, r21}], 0x20, 0x20000040}, {&(0x7f0000000c40)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000d00)=[{&(0x7f0000000cc0)="482d92288c4a2395717221b173ca4087b9ee9d8410e959ef8edc22098b9de54efb1960957934653b67efa351346d2c", 0x2f}], 0x1, &(0x7f0000001040)=[@cred={0x20, 0x1, 0x2, r22, r23, r24}, @rights={0x28, 0x1, 0x1, [r2, r3, r1, r1, r1]}, @rights={0x28, 0x1, 0x1, [r0, r3, r3, r25, r2]}, @rights={0x28, 0x1, 0x1, [r2, r0, r3, r3, r2, r3]}, @cred={0x20, 0x1, 0x2, r26, r27, r28}, @cred={0x20, 0x1, 0x2, r29, r30}, @rights={0x28, 0x1, 0x1, [r2, r1, r3, r1, r0]}, @rights={0x30, 0x1, 0x1, [r1, r2, r2, r0, r3, r1, r0]}], 0x130, 0x4008000}, {&(0x7f0000001180)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000001300)=[{&(0x7f0000001200)="6302202035e81a39476c0897efb7aa8650df7bf5cf90de84f47ec16d2aa64cc94ef64502743ad6122edb46390cc8fb4b079cba87906839c12b05c7f9ccb304b7b43ed2596abd4bf546c4c594", 0x4c}, {&(0x7f0000001280)}, {&(0x7f00000012c0)="3720cc4c", 0x4}], 0x3, &(0x7f0000001540)=[@cred={0x20, 0x1, 0x2, r31, r32, r33}, @rights={0x30, 0x1, 0x1, [r2, r3, r0, r2, r1, r0, r2]}], 0x50, 0x48810}, {&(0x7f00000015c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000001700)=[{&(0x7f0000001640)="69396005e5d6fd467bfa0f02e9b5fa5b58bb0120f23a08fe9d3bbc60b5fea855bd8bdc8e0c02eab6f33236749cdbde1fc755d917600d36c802bdae8350b66a474c6c02e756b182f362ec1fe4ed1589fe1b572cbcb9befede9babfa2090d395598fcd5b315e19bd225ef7c1c496b193", 0x6f}, {&(0x7f00000016c0)="8b7be29d11e10f1bf05a0eac473b8e2e720a2303847d8191bb6b80d85f851e1213a3120e7a05fcfb324addca1c7dff2ebd17", 0x32}, {0x0}], 0x3, &(0x7f0000002400)=[@cred={0x20, 0x1, 0x2, r34, r35, r36}, @cred={0x20, 0x1, 0x2, r37, r38, r39}, @cred={0x20, 0x1, 0x2, r40, r41, r42}, @cred={0x20, 0x1, 0x2, r43, r44, r45}, @cred={0x20, 0x1, 0x2, r46, r47, r48}, @cred={0x20, 0x1, 0x2, r49, r50, r51}, @rights={0x18, 0x1, 0x1, [r1]}, @rights={0x18, 0x1, 0x1, [r2, r0]}, @rights={0x38, 0x1, 0x1, [r1, r1, r0, r3, r0, r0, r1, r2, r1]}, @cred={0x20, 0x1, 0x2, r52, r53, r54}], 0x148, 0x20000801}, {&(0x7f0000002580)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000002380), 0x0, &(0x7f0000002600)=[@rights={0x20, 0x1, 0x1, [r1, r1, r3]}, @rights={0x20, 0x1, 0x1, [r3, r1, r0]}, @rights={0x20, 0x1, 0x1, [r1, r0, r3]}], 0x60, 0x8051}, {&(0x7f0000002680)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000002800)=[{&(0x7f0000002700)="9331f501e5206c48b00f9f0e3d61354deb2cb2f1844f76acd2dc43e05c158e51d1e8be71e8f46f24f87e20881be0d53eb3acc1717b2cb2a1b6fd460d5d0869ef0800578fd2f36ad442ddb2853f4179f8a2f3c5fbe4e3bcb107b6b1c57246e9b4ce895c09fc926fba8a30117e76cea4ab00491b3e8536ff38c869a388d8752a987b4aefa249824c835dd519d8a836517f3aed6e3d0e7e6530243b73ca82c85df1a4c9c601b587436f59c18f7a420455b8f0e21244868ecddfb6b3ebbf87c7bb057c5914da29adc92f3fd009bdad007218b02666565c4e8c5f1d8937b6fc114e1737071427d224e74672c0c9bf24a7fa7cfbbde8ca", 0xf4}], 0x1, 0x0, 0x0, 0x4000}, {&(0x7f0000002840)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000002ac0)=[{&(0x7f00000028c0)="97b0963e36dd294ebede5247695ebce523821561a01e0c20940e453d9d242777847abc74ee5f18684bba431361671399d4c88b66eb56be011e51be326c9c9cf28e4b599a6c0ea28ebe5ee9dd46f051c78ccc223b5a31a9622de55518cf7361662bf3054e92cad96ce7b15fd36ec76dc76e566d1b356d2efea03a1bb1d136aa95967b5087dbc0ab6d13851d998c0b26b1401f9fc67edde80900d992c95927ea9e121e98e6664c0eef0456a6a2b36c2c3f4e115535a0ad48bc7d42902d9f4279ea761e74d910b4d20e74e9672e2a60253e0d3258f8d82ae717cb23b4d418cfaf", 0xdf}, {&(0x7f00000029c0)="54f104e68d8dbeffde41e4ce07d2a6a548c27140f00449f9f3847897009b1873a92e38753f755cfd07acbf2fdd9ec22d984a534c6ce4fbb09053bfe7fe77d92f4a8e5059591792ebf7c46bd769d11d278ec98a72bc145db9f803143c9cfc58c536260c87238a599989badb2b913024844d3ebbd856529d5d6d263f7c3d3df43fbda78ad0de7c3f70c6b22e5dc5324fe964ee4201efd2ea083a7ab4430520732fc8e948e70fe4fbe74778b93a26b295ed0a227b4695ee4ac60b5cda0603c8a5061a84aa3a8ff0c0b19f040f43dcb9286e279579d606991f15d51c7157182d896950da6b9fe61025", 0xe7}], 0x2, 0x0, 0x0, 0x4}, {&(0x7f0000002b00)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000002d40)=[{&(0x7f0000002b80)="2b7c6f67773e5a0b523fee369d75c1534d5ce809784755e74f4d7a20463a87f8b5b8e9cf503e1fa7b734b97a4c349d7df42c4dd2db02a57e4666bbb5ad31478dc42984f499dfac8a6e32668c650dff367eed561db3389fcbd75baa1b6b6654", 0x5f}, {&(0x7f0000002c00)}, {&(0x7f0000002c40)="050e1f878dd2a2beb4b974c03ab42b2bf0db8951257a759c390b29e1bac3831ce4271431f0a5d685fb6161bf0aa15dc696f0738b84ae64d656d549ad0b5d534d5a6a3b8d2e1b9be2c8dddae9ff95b33f06e92d35b91ab314562db5feef8877301dd5534c34a4524d2cce9094c74274b5539dbdd615c96f7770aa07ad2dbdb9605342ee4a7fe944e3de1f8684f7848548999d874b40d39c9f4c5f717185ed9c7f08ca4bb601264e1b8b2d207eca42ee455f475ae5e508485e8714d471e6434f568736", 0xc2}], 0x3, &(0x7f0000002f40)=[@cred={0x20, 0x1, 0x2, r55, r56, r57}], 0x20, 0x40}], 0x9, 0x8800) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) fsetxattr$security_smack_entry(r1, &(0x7f0000000000)='security.SMACK64EXEC\x00', &(0x7f0000000080)='/dev/sg#\x00', 0x9, 0x1) 02:06:52 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00_', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:52 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0)={0x218}, 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:52 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00'], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000080)={0x6, 0x1, 0x3, 0x9, 0x10, 0x62}) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) 02:06:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) r2 = dup(r1) ioctl$PPPIOCSMRU(r2, 0x40047452, &(0x7f0000000080)=0x5) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000000)) 02:06:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:52 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00\f', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:52 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0)={0x1802000000000000}, 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x4000, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f00000000c0)) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000100)={0x1, 0x3, 0x8000, 0x76, 0x2, 0x6, 0x215}, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) write$binfmt_script(r1, &(0x7f0000000140)={'#! ', './file0', [{}, {0x20, 'bdevppp0eth0vboxnet0wlan1lomd5sumkeyring\\%eth1vboxnet1'}], 0xa, "984eec28d450070b85ea178c3a413c43997cbc255d21566f13116085a6a0033e5ae5592863a91f"}, 0x6a) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:52 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001500add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:52 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="18814199b4"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) timer_create(0x6, &(0x7f0000000080)={0x0, 0x25, 0x6, @thr={&(0x7f0000000100)="c296fa443199c3be277fd61fe9b22eebd1560903916179cfe220ad36547312c4c772ac172787a5ad35ad3d48e12a2593ed2a00fdbff8db2d39b48dfe40ac733c53cc18405ff798925c1eaf19641ef99cbc4677f95122add4f1efb70fe3c7f4e89938cccedfbd80af5655cffdcc882eede667e74a4739c4fb222c24d11c3a1e2e6a2ea497f6de1c848c1d3b48be05734dd39b51004f91674f94b0c430b5ce92c350af67837ea5ddde9ee42ebee0f89c10cbdb0ba5f24593", &(0x7f0000000040)}}, &(0x7f00000001c0)=0x0) timer_gettime(r2, &(0x7f0000000200)) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x0, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x4, 0x2) write$binfmt_elf64(r0, &(0x7f0000000180)=ANY=[], 0xfffffe54) r1 = semget$private(0x0, 0x0, 0x11) semctl$GETALL(r1, 0x0, 0xd, &(0x7f0000000040)=""/157) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r3 = syz_open_pts(0xffffffffffffff9c, 0x20100) ioctl$KDSIGACCEPT(r3, 0x4b4e, 0x15) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x0, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, r0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:52 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RWSTAT(r0, &(0x7f0000000040)={0x7, 0x7f, 0x1}, 0x7) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000100)=""/244) r2 = pkey_alloc(0x0, 0x1) pkey_free(r2) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={r0, 0x10, &(0x7f0000000080)={&(0x7f0000000380)=""/251, 0xfb, 0x0}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000004c0)={r0, 0x10, &(0x7f0000000480)={&(0x7f0000000280)=""/226, 0xe2, r3}}, 0x10) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:52 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="007d0c0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x220000, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000080), &(0x7f0000000100)=0x68) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x0, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) [ 321.509049] EXT4-fs: 20 callbacks suppressed [ 321.509060] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:52 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0)={0x18020000}, 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:52 executing program 3: ioctl$EVIOCGMTSLOTS(0xffffffffffffffff, 0x8040450a, &(0x7f0000000100)=""/142) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="ff803a5c53530be6c3791b970f0ce526112d59675e29c58a35711a63ae548131d2bd2a98f6ba7e176bff0bdd8e50870805905ff42c92e89b864e1cdc7a4f493f66a2b3e434328be8adf1aad0f1e5fbb28dda31522011209175dc2d4a559f819ac63f93118ac39a07e13a6b87d3cae40348f1fcc8b9b150e0fa226b1e599673f7396e4c1a5cbd0b6ab7b35518b85a5d4001778b0a4ef27dd7a237ea59e7355876be27cde46355f53aa8da055d2705649349f4f7ff9d71e6fd6cda7386bb9d7c9d375468a053ccf87ff27c06fe126c144ad9eaa2fec788cdcb22e3bbbda1a3c113bfdd9ac20ee047e0c0d0e4d51601f34b9e390dbbea8deb0afc8dbc"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 321.593203] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:52 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="58025a001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xf, 0x8, 0x8001, 0x4, 0x5, r0}, 0x2c) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r2, 0xc0305302, &(0x7f00000000c0)={0x6, 0x41, 0x100000000, 0x4, 0x80000001, 0xffff}) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:52 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0)={0x1802}, 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:52 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0010000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:52 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x20000, 0x0) sendmsg$alg(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="cc551e51b7216646f9446942c07d602cd6283c53bfb8751af62f905da4256e16d43adb1a1d27c286922204be9bb72bb0ac5b6352980c9836d3d51760f4d59109247a9fbcd472c5d97e337e5cb9efd3cf67766073a9b5784286e8821086cdd685e5c62cb257a6a6013512a7dfe8dae43e3d6d1c42e17191a76a0e4839bdde81ac52bc2ee76823aa7bab0ca784f631e82d9161066118e2e5f8013481641a1278182a7d8435b03871389be0a48b8eabbcdfe7efb9255b0e506bf8376ab568c37a9b43ed655f39ac116e3aeb989f22604b6793b19d31214997100287652d53bd7328d2cb784dcb467afc7174e95609afb03d6fecec173e1c1dde467f1db3222db2ba34c00c5bbdbff4f26c94380c8f6e5ebbd4ff138c932bdb8acddaaf1c82bac8d223df2ccf6bd14eaec3841924b97e5d3a0cc79888b292611fdae62eeb8215d2c2c0b9418963c666ff95fd9aa18e94c0c67a3edd4e1056a49797a9cc741738904ecf7253efc330bd7dd2e6cdaea26f685cd401a3a702a1e5fceeb34f6772072a21f277a20ae17b882047d0b1fc1df2110c94ffadd9b85909a52e39e6d9d6164308be073e33ab6d826692c7731575a4d512200bb7efbd8302553ce4d2a053475c0dc0e1112443b5a4c36231a5b6cfc5818606faa0bb77f1076eae3b6323aa7152c93e36e8877b097ff087c1ae3212b61269637aa57daaf24bdf8fbb69e155a620963adcc6609efab9997b7ed3855476f9ab39263c125acf2c093c457fda0a56f72c87f6e2ce4935ce9c9e8cb74adf909a10b2e3af10a482d242f961bd26dfa30c49450855558651bd5e12277e6b6b0a4e15d9a7e61061a3df91bdfd2af18d36048d1b998f946f779c9ddc00eb8cf1776567770cc612a7394bb4ad634471d410853d97b01cc1cec427771ef272eb1f9eb7d77d55c93a1679b25bf55e31a5d2aefb358733bc824b7d3387d9ac95a0c8aae6ab7e1f7be7e924af094e14d7fae24b2abbd94dbe0e9663853868e3c3bb7b37869a7bdc24f295d55d0ed2ab6a63955071d34235e209de226db27a56bf5955929ee42a4597016a610180250825c9458acf3de6e8b056b51b2ae6bf3346f78c12850785f302226fee65b1d1e6333c48ce123c989f8676bf6c3e66f5d4e5a23b56bd8bdd25280418e146d12303ba0b0853b96ddb2a307a571f7e44b7e3b8c7d590e17c3631209472a42f04dd2fdba1991dc482d6e503a3d056954b26f509b960ecf2d98c2e2523c04b026a788b1d6e47ba498846a3db31e4f6e70e38c687fdf0324b92042f38ce5330e3015d4ddef501f2617891bede2d017c78475990ffc03a927576746482cdd9f015ca31a520acd859f8b61ed20e3e18a7a282ef1cc3796a4ba8febd7cf4c1af7b5f73ebb84b36c2a65978111de7056e1df6a4df83a88856a65d06d3f00e9b63e7c89beb612f9670999b5deb6978436eecc79447991d9a6d1b9df0499dd86edab87166ca92d4993fe92045e9971846d713b2c8e3779c0202c9551837385afd68c6daeda158f88f148e20fcc1c6ada40d98d1cd92d236ccc11bbc1de881a7da6ca2fe0dff20c40e6ef6261c58fc91bf8e2b3eab82b1b42f1792c8fda913f75d73fd5fd290a6d01410571879d06ffd6f598fe7a0f62fd6fcfee1cafb6bf5b47fb4b738e170f6ec66a1fc7b909b5a84be20108ef629dcb949ff4f083a2077cf40d0e00e354583818cf63f20900f04f9f145758df1cb1c3212243ec06fc2e4e4b578635b4fe5338e988aef883faed93dc285d7f37e665ea36ad57a7dd7cddb58fe7e2079ec0211297a3751dbe43a90725a18976fa1488101f8405744197c665062671ef616a91e9300e597d6763d07ac6ed160f0da4a8e4d4fd1c5849b220d89ae1b342284734dda3253749d974d1a423920d679554360b24e22b3724b4159c717050f18f6d6b79b7b579158a20599d75df69789be4045175120f3fdac0f5a1f01adf3dd0f91b6eefdfe29cf609d2f89b7c9b16354a776480b6bcee2f69ff87316509f600ba4b13bde4fb84fa5259c700b9f32fbefc528bdc2f68278b1c2bbeef66350156c25047d5267c4d2de1f231ba096662b352b4f3de179e818acbf3528b93d47df057de98a79cc6ec606139d16c9ac5f7194166c317ecad6828d6ee6a891f369d951cc4453a45d36f30e95ac08597bf767d27c02d1630dacc85048bc5e4c4b2e62a047682eda51380d62ec8aa5680909a0e5336c98fe4b8e9593f331c85cea31d3dc9296c510f62b3e95b90a12f7cb12d802081cd631d8b07a71875cb5a621e87265b673f623e7be105db4ba9c3604cda46090f4510996f481a140dd07b21667fe545015df573b4139e74328a0f61460bcc1862eb8f0c653420799f82df27da49f05ada0055c998ccba4bd4c9d81ae216df2deda7efdf90cd53726cd77ddad9d3ffa0f89362bb81d9ed1ae547b7d22a1fc981ed93495e430c27cf117818e9df639bbdbfb634e399162e81bbda4814925e7d63554e5895b966932fcc71dca80e441e18a03d3d27b46671de7f3a4c9a2815f022d858e53f46571138665ecd83a892cad56fe8fc7a22d3cd75442aea3c1d8202ebd7a7b521811a8cf47d0401dcb65598519c10423eed4cd446d31f44e34ddb03a3b36019a8a73020c701208911845fedb1331960d82b495b401fab7ce3d918abae6b86b377a2bd78cc4041c0454fae44d7e23f437a16c6bbfa9ed4cd812074149e29e64b11cbfdd5cf4cdd6bc2b37e42f0f61600c6464ea8f21dc314ec8f7f9e3665fee28100cd70cfd8563a291c61843a97a55d58e51aedad0fe2b6d75375b803f27db571fb6c9ae2cce55287100b08d4e0cd632bfb4915fab7bce4b40004ae0312307cf1c1c8801e18fd3f421a9308c8771323541aa3c8fce6cd2bcfd7bd4060a47c5ca55f4f829d9d6ea0819b7ee8407abd7f617c7439036a105833f65be57fc94e008b0badafc0d7cfbebeaa0de9e1748f347c0de17bb6d5e9aec7d3df96ff24a40cff970613c2a15c2e7b80d2e7c7f8eda5ed17d8298b8786c838880187bdde495a4b94b04de70604602fca032d2231592bc70878ec417696d260ef5e017b9172240c537005ef17249360ae6e4d4dfa8ae5adc5b54976607c5a2ce0439ed4ce59239bcdfd572ecd78253373b5cb0565d82d5e620698bc79abb68703527a838fb83ebca10f3efb8d7b042d5748bab951f7e1699599d0dd6ccc46a882dc137bc07fd9d8601bb2a57d96d4cefe006f8803780a15be8c0454d7e1181168e9c0f66056e2c4116e1635d4549805a3c75e49041737de7f4c5a77d55540ca9154f0c5e3b40bc26d94335a8b730a2797821995360e21a9a12a2f5b9b1fd4510d27714f2fcd14ede2a1114838b291ad1be1f8372c51dbb15608e492fcfde646918105b010ee2cfc3429108fda551a60db52d6f7a6cac37d2f62358201e0307db1dceef4c9e68aace1857d6945786398c677bf9d8be3a1015937b6d8fe6c07d13ba201f0ae04338cede68c5a96f98dde7cddf4d1ee3f215ed5293d76da3a5c0e4c1f54368c294fd01beac2e90e49f10625482a6cc2d33255835cf9cdc04b0c24a16bd6e49fad09bd576b591daad89f0a16d5dd0991d1361017091dd0789273543e9c36c576f6090ad32f5becab121a2482ed24689bbdbfc7ef0f1b26189b3beb7b5bdb50b6b999233b1a2f175d37dc50d5aa39e18356eff71b738efb0760371a3c45953bd5a2fff36221483858da61fee415efe85253213f91abadf8055482695a5c429cb389072af0d89682019d7f81b589d1707d904f99707d3c7aa0328910bcc0d29035b745cf2acf230d51c09eda8b9bbe53840e62989e6d4c4342f44037686d76d44188d338176cfa58251ce798b4236a0aee53e14b65077213e16f3215d0048bc31b487ab60f2300337b3a6a26017941958fa7f04849082c497fd0bad06436b3cbdee6df95c5894c00e253abaa82eea9d16f755acf72a0d1c989f4f58f4db5aa9b62c56d040d7e37db489dd5e71a0991ac9da4547b117bebc59861a91d870d70a420da7a60d71dfa98912cb8833426153d48a8232ebd0bf79be3a3d06f2cf915fa515d3f4002ce290c91dc3f251a9bcd98b3efb8be7f7686102960fbcad8b50c404f352732adb7e1825cad5a2630b89546b3eb5776674b407bd7426800d6b64fb5247962bd3da3c7b7fdaa5a2092d666089e5750e6e94a2ace1d3611ac020ceaee10a8ec4539afa57505e4916c295094a3362d4a3940fc0fe7561b537919b9e38ae90b40257475975c690bd01d68a6fc329ddeb59a2834b50223abb81bf2e06e1b8c1a54d1ddb66171c1e379714813d44faf8ff828cd8c523a6cfa34e75c94df57d5930248b5fefb68c307c3725d428798ca8414422d4ae5021594ac22066e401dc5ed747065e454ea0f8967de55a16a338753200dcdc0ebbae3ad4159ff0b0aa4da42657a8a1629926482adf74509f2a7cb977d4659109e91af15306dc15161449eccfa9bedcb63313233958eb80d1da80e0f0d0631c8de0a1d9898d5721c095c004d0e92909662ada3b3934dab00a7d31c14607e30ccaecf1824c4966628023bbb9e4ac318318273987f2505b1f1f54d3131d88df0e7a7aad9884dfbb86bfd582c3d483b11e78e0184c59d1902eb2a512b38a4b092a0f0378ef21c9cde4b3721e9d3ade0594b4206c2c28643b7b143f219eea2e33f2a09b466021ae1decef825d882b80f95b7e487574482f90ac69fbdabc6ee77403802ecd7f52d9376e915a2d1354a23653d8e604c7fcabd9b5803cfc5b635cd78922dc4caba59dc05196d492a56e8f58709d1ce1e8f47d448a8dc6a2a3511d82b5bdfa3976a01fbacff95657d389b8ac480fbd73f850c4a7752fdfef8e3380c07c990fba2db411c8c28b13e72886fd4243c617f26d61bccfb87495204236bcb9e883256418422c036c10b09304b54734c69c930ab4759df2223c0b62b744cca39ae41abe4844a0dbabe42448258748635d26a045833ae8ea45db2a13383b3bf8652536543fcd673df42a05eca8df5d2645a58fde1e912bf633443d5894aca973a74095f3ce46e8840929f649af623ec92d4af0f99077e443273723e4312bbf90ba5af3a92bacdaca2ee4178c8ebfc52ece7847be8a802864a731ba38196df62681a3fa21bf48bbdae09638fda1a881373ea03efa8343ba1efd9591cc9128fb671e9344ec85366a46917f0b20d2c7dd7d726c492bb6adc5f3e34985fe9917ac8c5b993017beba702b8b770b3ec6d539de05ca390851aa9a6cde66c3891a2863da50fe7451c78300ad8063c2394799df5d1b82a96d8ef7b77ca3978d690ad91ad93dafb7845ebb51b3083686f8316002a859cef83df7a12f20ad85640438f6eb64f03ec779ce109209aadb9b2fe42165455f8f00718e73a71847715bc633b0c269f03297112a67f88e765700f63c40de2c8bcf7a1de61ea107a35dfd0a6737424c44a8f8887e6f326a03fcb9e6b9b5dcdd089a723f03fc3c087cd3f6cb16dac8ef3dd1f036df534d0c1719505872f7728bdaa1102749248336ee1fb7d6e8d0db73d8dae79f1c3161a70e7ff319f7122256e66708b835b4c716af8d59c88eba3ce0fda03ac97d8fe434853d7799533c4dff64419df813699326abc87366a123adc300e117e5aeee6beb02b2f969f8a981d3776de05c4644c78b3a4706658b651c951b16bb1f0daeb18675f9ee60f3c38562e8fb23afd42363c7e2e825142bb1207f41698826f20969f2acc06d8c8b36392e2a083035da8be04b7d3ffcdd66a0db4dc884f4", 0x1000}], 0x1, &(0x7f0000000100)=[@iv={0x40, 0x117, 0x2, 0x28, "f7055f7b7ae48805843d4c87c8591acb82b9b73b09e47811a68dc36286f94debc7a52391af9ba072"}], 0x40, 0x4040000}, 0x4080) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000001340)={0x8000000, 0x2, 0x2000}, 0x4) bind$bt_hci(r2, &(0x7f0000000240), 0xc) r3 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)="0e", 0x1, 0xfffffffffffffffe) r4 = request_key(&(0x7f0000001280)='cifs.spnego\x00', &(0x7f00000012c0)={'syz', 0x2}, &(0x7f0000001300)=':$([vboxnet0{[\x00', 0xfffffffffffffffe) keyctl$negate(0xd, r3, 0xffffffff, r4) close(r1) 02:06:52 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x2, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:52 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:52 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) socket(0xb, 0xa, 0x4) 02:06:52 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[], 0xffffffffffffff91) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = gettid() perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xc1f7, 0x9, 0x2, 0x7f, 0x0, 0x40, 0x5000, 0x0, 0x0, 0xfff, 0xfffffffffffffffc, 0xfffffffffffffffe, 0x5, 0xffffffff, 0x5, 0x100000000, 0xffffffffffff2a9d, 0x8, 0x7, 0x7, 0x2, 0xb2b, 0x3, 0x3, 0x35, 0x8, 0x41, 0x3, 0x5, 0xfffffffffffffffd, 0x1, 0x563, 0x7, 0x3, 0x1, 0x2ec, 0x0, 0x1, 0x1, @perf_bp={&(0x7f0000000040), 0x2}, 0x10400, 0x6, 0x3, 0x3, 0x800, 0x2}, r2, 0x4, r0, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f0000000200)=""/49) close(r0) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f0000000180)={r3, 0x80000, r0}) fsetxattr$security_smack_entry(r1, &(0x7f00000000c0)='security.SMACK64EXEC\x00', &(0x7f00000001c0)='\x00', 0x1, 0x3) [ 321.840800] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:53 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x0, 0x0) 02:06:53 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) [ 321.936558] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:53 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="58000f001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x40b1, 0x0) ioctl$BLKPBSZGET(r2, 0x127b, &(0x7f0000000080)) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:53 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="ffa993da190e8c00"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:53 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000540)='/dev/vcs\x00', 0x210080, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000580)={0x0, 0x3}, &(0x7f00000005c0)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000002d00)={r1, @in={{0x2, 0x4e24, @multicast1}}, 0x7, 0xfffffffffffffffd, 0xff4, 0x7, 0x8001}, &(0x7f0000000600)=0x98) clock_gettime(0x2, &(0x7f0000000040)={0x0, 0x0}) r3 = socket(0x2, 0x1, 0xfffffffffffffffe) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000002ac0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c000000000000000000000000000000000000000000000000000000000065727370616e300000000000000000007465616d5f736c6176655f3100000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b747479706500000000000000000000000000000000000000000000000000080000000000000000000000000000636f6e6e627974657300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000300000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000001000000feffffff0000000000a1ec03e9f11ec579b44d2a701d1dc76f720281a9dfebf7e2"]}, 0x2a8) recvmmsg(r3, &(0x7f0000002900)=[{{&(0x7f00000001c0)=@can={0x1d, 0x0}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000240)=""/113, 0x71}, {&(0x7f0000000080)=""/56, 0x38}, {&(0x7f00000002c0)=""/109, 0x6d}, {&(0x7f0000000340)=""/140, 0x8c}, {&(0x7f0000000700)=""/78, 0x4e}], 0x5}, 0x7}, {{&(0x7f0000000800)=@ipx, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000880)=""/200, 0xc8}, {&(0x7f0000000980)=""/94, 0x5e}, {&(0x7f0000000a00)=""/107, 0x6b}, {&(0x7f0000000a80)=""/127, 0x7f}, {&(0x7f0000000b00)=""/190, 0xbe}, {&(0x7f0000000bc0)=""/70, 0x46}], 0x6, &(0x7f0000000cc0)=""/191, 0xbf, 0x10000}}, {{&(0x7f0000000d80)=@in6, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000e00)=""/97, 0x61}, {&(0x7f0000000e80)}, {&(0x7f0000000ec0)=""/25, 0x19}], 0x3, &(0x7f0000000f40)=""/4096, 0x1000, 0x8000}, 0x5}, {{&(0x7f0000001f40), 0x80, &(0x7f0000002280)=[{&(0x7f0000001fc0)=""/127, 0x7f}, {&(0x7f0000002040)=""/45, 0x2d}, {&(0x7f0000002080)}, {&(0x7f00000020c0)=""/162, 0xa2}, {&(0x7f0000002180)=""/227, 0xe3}], 0x5, &(0x7f0000002300)=""/174, 0xae, 0x1e1}, 0xfffffffffffffff7}, {{0x0, 0x0, &(0x7f0000002480)=[{&(0x7f00000023c0)=""/185, 0xb9}], 0x1, &(0x7f00000024c0)=""/227, 0xe3, 0x6}, 0x9}, {{&(0x7f00000025c0)=@l2, 0x80, &(0x7f0000002880)=[{&(0x7f0000002640)=""/136, 0x88}, {&(0x7f0000002700)=""/177, 0xb1}, {&(0x7f00000027c0)=""/101, 0x65}, {&(0x7f0000002840)=""/18, 0x12}], 0x4, &(0x7f00000028c0)=""/58, 0x3a, 0xfff}, 0x5c}], 0x6, 0x2, 0x0) recvfrom$packet(r3, &(0x7f0000000100)=""/113, 0x71, 0x40, &(0x7f0000002a80)={0x11, 0x1f, r4, 0x1, 0x8}, 0x14) sendto$inet(r3, &(0x7f0000000440)="8abc86e0056a986833134bcb9bf6367493288192bba8bed68b2a703b3ceae893e505f07ebee15b15413790c6288795f8803ab2e14a29cbd961106742e201fed0a2cb990eb7bb770bb9cd6a036c2321d997c1939e206ba15754307ceb96aef87402022a3686ee907716ca4d64ca82c196a1370a381d9312893e734a5da71f7a45b52068d2197338895f55109498e780c6c72c4b", 0x93, 0x40000, &(0x7f0000000500)={0x2, 0x4e21, @rand_addr=0x6}, 0x10) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r2+10000000}, 0x8) 02:06:53 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0007000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:53 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:53 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:53 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="65379cc8aa78a8eec46e33f5db6443930a86b7095b589d770af003f65c2614908080803a1ce4c29f3114b941c2b1a79504fb97716599ea66d5257e6ad44b7d88903ca3c45ed9f38c58444861190460909b9c04f394a1ae0592eede29516516fcdbf5d480f555fb9ac3f4f94212ef4c4d99f32e4091fad117a3da9f9850c103004b964a7b73a3258c007865f63d4a6649d79c95df4b7264510c2d5e076e1aa80063022692431485f652f58f7228df7dc764ec6a848cd0e3fc8a89d4a46a3543d6284452738f51c8d971b90e8e00000000"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendfile(r0, r0, &(0x7f0000000040), 0x3) bind$bt_hci(r1, &(0x7f0000000240), 0xc) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x1) close(r0) 02:06:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x20c80, 0x0) fsync(r1) write$apparmor_current(r1, &(0x7f0000000140)=@hat={'changehat ', 0x0, 0x5e, ['/dev/input/mice\x00', '/dev/sg#\x00', '/dev/sg#\x00', 'bdevuser\x00', 'trusted\x00', '/dev/sg#\x00', "bc47504c00", '/dev/input/mice\x00']}, 0x6e) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x202400) ioctl$TIOCPKT(r4, 0x5420, &(0x7f00000000c0)=0x469) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000000)={0x0, 0x7, 0x8745, 0x4}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x1f, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e23, @multicast1}}, 0x5, 0x100000001}, &(0x7f00000001c0)=0x90) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000240)={r5, 0x5}, 0x8) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:53 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000100)=0x3) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = socket(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000140), &(0x7f00000001c0)=0x4) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r1+10000000}, 0x8) ioctl(r0, 0x3f, &(0x7f0000000200)="eb1b885f8d64396f9fcf8ebf624a53801d894ac7baa8b97dec02e66fdeec503dc67e49424a4f10115c87c9e892648cefbc9d0aad5c8185f7a9de839929bcdf04481c3e9d4af2d964e67482c2c0440b1bbd7d467324f647beec0fb51c6670424572cca3373727e64ba6a84462d6a58d7958c6e84859a85ca39ce6e3f4cdc1da5b176eb4d0dd6eb03faf39f46fce5fdac8028d5e0c4210cae7136c51") [ 322.221714] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f00000006c0)=ANY=[], 0x138) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000100)={{0x2c, @multicast2, 0x4e22, 0x3, 'none\x00', 0xa, 0x3, 0x5c}, {@multicast2, 0x4e20, 0x2003, 0xffffffffffffffff, 0x8, 0x8001}}, 0x44) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000001c0)={0x0, @loopback, @multicast2}, &(0x7f0000000640)=0xc) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000540)={@multicast2, @empty, 0x0}, &(0x7f0000000580)=0xc) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xf, 0x9, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000800000000000000040000001800080008020000000000000008000086010500080000000000000000000000180000007f000000000000000600000095000000000000004eae0cb8530a81517147ff8ea8d8ae1143d262b1175e55bcfb988e718d85771221bfb2efeb409b899e6d029cc3821c63257a348165f05934b7e8f15411ad5c45a125c92e72fb63a10b25b1e2cee6012b914d5e529c59579524a5e5d169fdfcf0aac1fca756b8410c306f08b4eb7ab7a3400ca0df225988042a7b5fa8345bb035c71e00e3db6d067bd30f3b9c381d4049b00cec6d700700e2480a44d2540ccacd2f7dd2d68c66e8d5f4f3b01a2e33dc271407acb6d91f666c456d2ca8"], &(0x7f0000000180)='GPL\x00', 0xfd, 0x68, &(0x7f0000000240)=""/104, 0x0, 0x1, [], r3, 0xf}, 0x48) r4 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x67, 0x2) write$P9_RSTATFS(r4, &(0x7f0000000080)={0x43, 0x9, 0x2, {0x4d, 0x0, 0x4, 0x7fffffff, 0x6, 0x37da411a, 0x1, 0x8, 0x5}}, 0x43) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r5 = inotify_add_watch(r4, &(0x7f0000000680)='./file0\x00', 0x400) inotify_rm_watch(r4, r5) 02:06:53 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) [ 322.301089] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 322.325664] IPVS: set_ctl: invalid protocol: 44 224.0.0.2:20002 02:06:53 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580040001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:53 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000040)) write$P9_RLERRORu(r0, &(0x7f0000000280)=ANY=[@ANYRESDEC=r0], 0xee5dc9e866bf1ded) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) lookup_dcookie(0x5, &(0x7f0000000100)=""/198, 0xc6) close(r0) 02:06:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x24842, 0x0) getpeername(r1, &(0x7f00000000c0)=@sco, &(0x7f0000000140)=0x80) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f0000000080)={0x5, 0xe, 0x1ff, 0x10000000000017, 0x8, 0x0, 0x0, 0x164}) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:53 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:53 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="00006c0080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:53 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480), 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) [ 322.536016] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x6, 0x200) setsockopt$bt_hci_HCI_TIME_STAMP(r1, 0x0, 0x3, &(0x7f0000000080)=0xfffffffffffffff7, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYPTR64=&(0x7f0000000400)=ANY=[@ANYRES16=r2, @ANYBLOB="9db5e64faf300fe25e54528918e7477933eec0b08cf6709e103f050de8c1278e0a021f6a727085cdf88f9e9c4a01183c9e9e827eaba51b039cb1e2a91152a5f5a15dd956792639a0b2984a7912d3496967d566a96d03faa36095f59e293c0a6a9340acf4d36b393301becc2a0f8d8cc6365133de5d2887de64b8d6eb56287ba0cafe450f70680dfa86b3c2164265a22ac4ba9c94284da87b7ee837c11c077a37473e138fd160652d083e287776f849ac8dc3449a8d3eb0591520dafeb3deb9105f076622a67d39feb54f50b645a6def5c4e2c4f595"]], 0xfcde) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) sync_file_range(r1, 0x5, 0x4, 0x4) ioctl$sock_bt(r1, 0x541b, &(0x7f0000000500)="541a9dd79373f0c3b5c5d007f158bb64041cf512e484dd0df8abdbf244a16a3add2677f10b5c1ef8d031075d0b1aa0528bb02c3941e9087b8e53d994cc1f67af9804d8f61bf70c9a766f1df7791b91345f43629b7ce0e4726c3388c14780f07e99bc15c69896efaf142e39fc50d55e1255a00c5e0bcc451e26acd4da5b47e98a1f24031a0a135e98a873af778c36f435b4d43ca6024a142afa83031e3fa76ac048216672b3136c0408146cdcacac86b6de773597acb9c9c5ebdcf20406f64fc1298f") 02:06:53 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x244, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{}, {}, {}, {}]}) [ 322.591391] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:53 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00N', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:53 executing program 2: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c000000000000000000000000000000000000000000000000000000000065727370616c300000000000000000007465616d5f736c6176655f1100000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000300000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:53 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480), 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:53 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x80000, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000400)={{{@in=@rand_addr, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000000240)=0xe8) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'ip6gre0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000000680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000500)={0x114, r4, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [{{0x8, 0x1, r5}, {0xf8, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x10000}}}]}}]}, 0x114}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r7 = fcntl$dupfd(0xffffffffffffff9c, 0x0, r1) ioctl$KVM_PPC_ALLOCATE_HTAB(r7, 0xc004aea7, &(0x7f0000000000)) [ 322.825098] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:54 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000000f00add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:54 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x18) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0x400, 0xc, 0x0, 0x10000, "02f79b317717fbc1059c9a2bae4f829d4ad8aedcc9159aef8d6ebaf17b1f7f3b"}) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000180), &(0x7f00000001c0)=0x14) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) fremovexattr(r0, &(0x7f0000000080)=@random={'security.'}) 02:06:54 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480), 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x0, [], [{0x393, 0x4, 0x5, 0x2, 0x4, 0x2}, {0x80000001, 0xffffffffffffffff, 0x9, 0x2, 0xcb72, 0x6}], [[]]}) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) [ 322.881520] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)) r1 = memfd_create(&(0x7f0000000000)='(wlan1\x00', 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x81) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:54 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00b', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:54 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:54 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="7fc0"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:54 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000), 0x0) 02:06:54 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) write$P9_RLERRORu(r0, &(0x7f0000000100)=ANY=[@ANYRES16=r0, @ANYPTR=&(0x7f0000000040)=ANY=[@ANYRES16=r0, @ANYRES16], @ANYRESDEC, @ANYRES16=r0, @ANYBLOB="ef709158893d07fe0470543983eca9d45b0b8e58a4290d18896751c7218e974f27feba011b97a2ab6520c88bea139e622c1e82390a9de147658561327ec9daa587f5f22d8485603e8acc43854cb48e2b21463d60a7ecff16632edc46e5", @ANYPTR64], 0x85) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={0x0, @dev, @loopback}, &(0x7f00000001c0)=0xc) bind$bt_hci(r1, &(0x7f0000000200)={0x1f, r2}, 0xfefb) close(r0) 02:06:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x17, 0x0, 0x7, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:54 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000), 0x0) 02:06:54 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580005001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:54 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:54 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00X', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:54 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x64, r2, 0x620, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x54) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) accept$packet(r3, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000280)=0x14) bind$bt_hci(r1, &(0x7f0000000400)={0x1f, r5}, 0xc) 02:06:54 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000040)={0x6442, 0x1, 0xfff, {0x0, 0x989680}, 0x7f, 0x100}) close(r0) 02:06:54 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000), 0x0) 02:06:54 executing program 2: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x78, 0x3, {"9b255f4eb90b49429fc29baa8ca2825724084f57892b468df5d3846352fd2a0dc29b71ff26b72b2997a8723e225c6c1cb875066b63198567804b7007a98f23a2310aae1365543fc8e69f1c78cba9a9d2f80d215902e15d9f9a26883aa68920"}}, {0x0, "70b0320985f5e12b3679fc67cee39acee368ce522accbf030868a5a392f6181f2a703e41e7926b2f"}}, &(0x7f0000000100)=""/123, 0xa2, 0x7b, 0x1}, 0x20) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000280)=0x0) fcntl$lock(r0, 0x7, &(0x7f00000002c0)={0x2, 0x3, 0x100, 0x4, r1}) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r3 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r2+10000000}, 0x8) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000300)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000340)={r4}) 02:06:54 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00m', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYRES64=r1, @ANYRESHEX=0x0, @ANYPTR64, @ANYPTR=&(0x7f0000000000)=ANY=[@ANYPTR64], @ANYBLOB="cf66213e9e9a5be164fa0c91567d2ff6af3719a99b840464fd1da13afb95ce40fae5477ae4448658f4312cf6d9d037e0286e446d739090ad18c83c0edfedc29a341ee074df02af168f8f1053abafc025f9e85971d50ddd7a84a6dd2ffcfcfb8558f26ff8050decea046c81d4cce0059bbcdb58f386c69d2855cf94e441b8afb1b70fe56c7529ce7e3dc83b757e324693acb06aa768aeb6d44f8ec9604d46594e1b42514dcf5f"], 0xffffff6c) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) 02:06:55 executing program 2: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:55 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040), 0xc) close(r0) 02:06:55 executing program 0 (fault-call:4 fault-nth:0): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:55 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580002001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) r1 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0xec7, 0x0) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x7) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:55 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:55 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0005000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:55 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000100)=[@in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e24, 0x3ff, @local, 0x9}, @in={0x2, 0x4e23}, @in={0x2, 0x4e21}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1d}}, @in6={0xa, 0x4e23, 0x3, @empty, 0x9}, @in={0x2, 0x4e21, @local}], 0xa8) close(r0) 02:06:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) socket$inet_sctp(0x2, 0x0, 0x84) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:55 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x7ffff000}], 0x1) 02:06:55 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) fstat(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000100)='./file0\x00', r2, r3) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0)={0xfffffffffffffffe}, 0x0, &(0x7f0000000080)={0x0, r0+10000000}, 0xff8c) 02:06:55 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x20001580}], 0x1) 02:06:55 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) write$P9_RLERRORu(r0, &(0x7f0000000040)={0xe, 0x7, 0x2, {{0x1, ']'}}}, 0xe) 02:06:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x60000, 0x200) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x804, 0x4) connect$pptp(r2, &(0x7f00000000c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:55 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00A', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:55 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000051400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:55 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c000000000000000000000000000000000000000000000000000000000065727370616e300000000000000000007465616d5f736c6176655f3100000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e62797465730000000000000000000000000000000000000000000000180000000000000000000000000000000000000000000000030000000000000000000074000000000000000000000000eeff000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000557d381aa7f3d07c652c594d855a9479402c80"]}, 0x2a3) r1 = dup3(r0, r0, 0x80000) ioctl$KIOCSOUND(r1, 0x4b2f, 0x9) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000080), 0xffffffffffffff1c) 02:06:55 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x8) [ 324.432874] kernel msg: ebtables bug: please report to author: Wrong len argument 02:06:55 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) io_setup(0x8, &(0x7f0000000100)=0x0) socket$alg(0x26, 0x5, 0x0) io_submit(r2, 0x0, &(0x7f0000000640)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000001c0)={"0000000000000000000000000200", 0x1003}) io_submit(r2, 0x1400, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000080)}]) r4 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r4, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_elf64(r4, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r4, 0x227c, &(0x7f0000000200)) 02:06:55 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0xfffffffffffffec5) vmsplice(r0, &(0x7f0000000500)=[{&(0x7f0000000100)="3ffd4b33a731358ef8326e5fa540f1576fe8cf8777fbd349d84c5484ba0754aa7db7993e2630705e346e43417e8b26a9787dc8ac08e953f91240c17687b6dfec363bd9da5530763048718d012f1356b88546d7bffa4fb912f15c51682a7f57a50920f29c4388ce970767185eaa32b088599e6b8cd9585de7186865180b3a52b3646a6fc92dc2d895a51a24836d63d63babdb550f0a12f65aa44cb51a8820df7845ffec99617b9fb82e26010aa5beca2cb5d795d89a4624d9eabb7efa2fda3ef819b9b1b5736d848d568fe9a66408381bb5b504f3a14db1cc3e00a2d5413f", 0xde}, {&(0x7f0000000040)="c71fe77d0e9ff467a17168611ba68f71af3120467b33e0512cee223fc3773f407d278907cb4c613b", 0x28}, {&(0x7f0000000280)="70c4028d46d5da9119bbaa5fac5b2d2ffadc959c6481f05a18879c3caab04ecb13b9359982169d34e1fd3d98e870494aef9d47d7228572023f890f8dd31a01e2d6d7538d4ac818f200cb26c679a9e46ddc1c1e3c90728d5b7a476700cbdbebaa6c525ec466986a59f708cdaf6d8ef42866d46f50b84cc5c7f6ba66ddd3c6ebfabd3e043d7491b09f2f82111e1969f1538791115b84017e1cf38dfa401a6c3bbf87fa6a99021108042b1d07f39ff0dd3af1256894af6721a88e076b193730037b82ff90b335dc64f99e45f7d3a463cec1974b", 0xd2}, {&(0x7f0000000380)="b7623df91b7680db3b24a65938275b702fd010492e3dc2851c0eac45e4fc2219bbf2d41a114d65f7fa93a7d2a08d09f23bef7876f276762a19a412f7ed188b73b63d1da504b2457c206aefb0145fd4c659d17a74abafb3e1cf8d1dbd15ffc38465fb707bc2380658f9118fc6b381ee90b97d931150c2c9e061b7f2111db5928b95fbc02336591ff8e8098aaecd748d2460fa05574e90404d1f5fa5b1c1fcdc7cffd791896767011db0d072b38c7de8cd80f8ceb049b3791e943c72b09d2a3a794d6c05d0a6b2598fa66b2166de4a97a25bc1786bada0ec9d6bd4663ede9f74b9f4ad4c8df9b50f", 0xe7}, {&(0x7f0000000480)="876ca2adc1321bf4fa01ebef84829d480eb5d4b3f51ea4a691bb76da9dedc9e63c256d87607b3dc66c50ef751bcc9055adc738b16c5b5dc9328be8e76ce98727b36a1010b1f9ae948c1a3feb372075", 0x4f}], 0x5, 0x5) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 324.485333] kernel msg: ebtables bug: please report to author: Wrong len argument 02:06:55 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x300) 02:06:55 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x1, &(0x7f0000000100)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x4000, 0x0) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f0000000080)=0x7) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:55 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)="0006000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:55 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:55 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f0000000040)) 02:06:55 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x101080, 0x0) mkdirat(r2, &(0x7f0000000080)='./file0\x00', 0x4) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:55 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x2) 02:06:55 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="5800000f1400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xa4f3, 0x2000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x6be1f21cba9f2556, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000400)={0x15, 0x110, 0xfa00, {r3, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e22, 0x8, @local, 0x4}, @in6={0xa, 0x4e22, 0x39eb, @ipv4={[], [], @multicast1}, 0x101}}}, 0x118) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:56 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000100)={{{@in6=@mcast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000000040)=0xe8) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000280)={@local, @dev={0xfe, 0x80, [], 0x17}, @ipv4={[], [], @loopback}, 0x9, 0x101, 0x2, 0x100, 0x40, 0x10002, r1}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000240), 0xc) close(r0) 02:06:56 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00+', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:56 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xeae, 0x80000) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000080)={0x0, 0xab82cca}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000100)={r2, @in={{0x2, 0x4e24, @rand_addr=0x3}}, 0x8, 0x7}, 0x90) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x400, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:56 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x7, 0x300) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ppp\x00', 0x200000, 0x0) write$P9_RWSTAT(r2, &(0x7f00000003c0)={0x7, 0x7f, 0x2}, 0x7) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) writev(r1, &(0x7f0000000080)=[{&(0x7f00000001c0)="966e10229e1b59d549465410e0284960aa3d6ce5506f27d6f0722ad2e8c9aec03f73614bca31a43c583ac927c49c30c06979946ed8c31620d6c3937ad3390bdfd8318edd38a751f64895b50a3979be3db8c84550989e3d9b2e657b65926af8f4a91ed104e7ea0c774b36951ebe941b5a61f56f81d2bbd70dbd5966e088c42cd1164c6844d8a75f9deb410e43ba4dfe023a00e69198187100c43f373906cd6c237768546e595323ac046b8bc7c97566e8580cc9163b75a62fc9d150990b39dea97ea79dc654e0b72a845b47f5067866e4acfe3b66eb7e3b1063ff52cabeb48bd55f6cde3830f53dc07d74f389", 0xec}, {&(0x7f0000000700)="21db76691da331e48f89949a32af519837e895379e5ed7bc8837505f4d7b111854e1789a479b9b8327b8e4153778af7b742d6a40754df613bacc08925443260b9652aba21aa446b9d7c218a4a01b05404d1ab6cce3b247bed0109ebc326bd37f3c297c8668ecbee187eed0adf6c135970cedff0e071aed09b81c22caabea95ca670dd8aa655f3169e25bfe786f8e39f27a315287bf73fc49dbb329778385f75a18ed27e1d85fa609a9ac4c36252c52784defc3b03c748be933df43eead643a9c30dd0c9b6e9c62ef1a92e935b014c3fb93554c8078ab386818823c0812ec4a7e09ec06590256291f248bb296dddca4880c86ef3c6a97d38bf71e937d509c4d4cd234a6abdbe7793148b01fdf1a36a876d44c2f16333630775eba1a517d872d8ab2dfdc66b4038b310a0d91e5d88da792edf79ff1d960509266c10d9c5d60348980d11a2a2e097f50e67b4b25e6f910c2b919d0325a338a267b7ae7a69d36719037ea928d69f9b05e7207ec689b413abf16ab3a9e258445932bcd42e18e1e0b96414a5ae45f7741c4fa2b46f4b27598560adb6e247496036ec11d25263d0cbef95cf4c6c06082891c1f9e47a44abd90d732497c041980b09c513f61566f9eeb8f3116351348dab12618995ba880185d2f464eaf118258a9da3b502807f444301e5c88c5cd533382462671e81d91d7191c9555554a31a9b6c70a6599f6502bdba7c20d6d80d48208d4503655cd841e0971c43b8914042f0b2635b33ce7a88f9c90cee1154651a8dc60402f0ab35db766d7095a7ca3bb94bbb6b5655587eb51f38c3fec3306dc579c61f66613d85b11eb0ae9ecb0535b24463fce5b6fd4f14d03329d3082edd58c1719b00f151a56eecea878cc2131eb41b63995c36639e3ad598ea18e45823ac1086d4c10e37a5a3d9a7fc3ab8bd032558afb9103be9b38d9802ea9b57d88c9bb50db31d9c2c541424c0c1413c0a973a840592dbd5a790f1d3dcd00afd0e5f0d861378a22ed5718a535f77d31253d2e35e46a423a63069216e2c43c1ff91570b4c18c353ac998952d37aa4faf108540507d5ef94fe86ca289323109bc362da9d8b26073579bbf22a2a4299785bda9f55f6c3cb393240332beba394ed1d7f7b1671f25b91ee8ecfb6c8a30e61a628ef28911f4e37d381da0a7366fc40fb37efae4b4e04167fb326490d900122e289d9eb0e3937f8ae36474a85ebe3f8f978b3ad4558ef0ed3a890b99c3d87ecc46b624060376d3ca6092a2847980875432d5357772c04627a83fc68b3f4686417f1ee28a536f2f59ac40db8fc61a51ded6b9d9b1a67177dc28a494499b3a4879e7d8bc53e1cb5519805ffbb2d383f6a7a029a32306b3601926f6ba49dd53783b4df569366b8d05cd037b76233b7742d81684b46ffadf95892f167c2b6cec9faa436dac742383a95a6006a45427939e166f7107c96d9dfd41f333293260657a86c050ad5a7404a0d5ad0b5d0d32d53fcc990684a78684d50e3ba41b8fee0088fee25a505a415a75e126dc312c8ae7b8abe7b6c174cf3765cb9acaf4b9c4cbc51959e528b0abbe45db5d4b5e3f379b0d80aefd1fa68433cad55768827e1922fac8a49cbb45fb8a412cd5e318a82991b99413975f006644a5de7ebd4a095c82da04f8ed6af12d27259bae9390ba177e33ba475c757feb4ad543320752c799af06013131dd1ff174cce6b11af1987b386aca67bd65d46d92da6a34d74dca5b4b5017d98c6a595c9b76c75309a314d87ee2bdbd87b772a3b79de8485db811a3ff23cda948da3f6b8be2542567effc5915a11d330d29fc50555d6b20a249f1603ca65fc0e21948229a5b58ba025167ff61144a6bb1280f92ff268d2dc6b09305b0066509c83b6911c8be3815cdbafe542a1f8114530e12e777943f79bb0a68d7da96c93028063fd3c9864e383d5427ebcd87fb4703bddb111e15e19a80ee0268cf21cb29a45d8ce238c6efd98a273db768f3d1bf5603da6ab4a82a18d050a3d810ac1c22052170f54ac2defb1f65807920918e83f2d21ed16f8f21ce12236aba2aac5b57e60d59136ad4b9a7a7b0b085d83f9e8d6b0632aee162076fbcb3b570fa05b0818bc3684a415c3bfdd65cc74be3a083ed0e03dd19a3c31f071995e35b5fbf61dca0120be1d311492923ec7e2bf4ddf98682fa80b0e3670bf8bab08a36a28f89f6f0610ac7a56edeca1c551d7557e4468863061ffc83b4814e754c2eba789d6140d4e7939c98cc2a08a4e9ec0a47891ceabe373549a752ed4f91f927ebf4d563efc0c8329690d2f5451e1032fc75f0063a38f173dcd00b7a81626fb58c6553484cf55d32dfb1f4c3ecf88e21d7a79bbbd1ae4be310b8470293f51a153d4067d62b10b14534e095ce074afdda8a91bb94d2e47af1a75b155da8f0d8294b3e3aeb74aba37ddd164aed6c2d515b06c8aa5b59778c918cdd3f2c212a25cad380a1e33b49b101bdef0e37ea8864dd472a8f1848e08c2aadf01fdaf947dfb84926e89871580031053f3f71b298d3ad628e1907be511ffd55b71643517bea862e32f60e2b64a1ecf57cc91925ea522cc2a16cf6465bc4ce9ca210a2b618e6b168c66fbdd3f3bc63bb734b078bf18a24ac9c355ae9f7468b4b39811487c1b58ceb2d153265c4fda3c12bfc77553e8e533c8c12097118bd1887f4fcf2978f0f716fa3d5b0e95481140e3728c57cd3c96f16a0b0befa7404f031053f21899d8b94d2de0da5830d185dabcff15cd04ef36e3f5dc17c2a3a2298bcc91f0f8a12b3d4b5205aecbcd9234dbb2ea94e9afd17c4f7d33a81ee3286b49cf2f8e56d5b2fba2a2793d4ffb6036fca53cd18b64867dd33c751603a3e231cb5651a27083a2b3dedf446b11e6a50817470cf1bf95fc858d8dab56b8b4376d1a194600e84d6028ed80eea70edcbab33682970beeb012c705f6dd1847931964fcd588339d6d9a0c227c852ed820ac40f10f9dd0d7912df3194094a5cccd7d1d6077f92532020d5e5836bfe11fbfb02285e5d83aa38743fe081c8279bb56045ae862837f43205c9c5f5cb1609f9d22284bdf6d2c70eecac85c853ea5d13f0747d98c2b8763bc90183e8b402f093e108a188fd2f47c5728996db5bfaf764bb436105febd40eec976de6315c1b03cf26cb8288fbe652d9b45af4aa5279524ae4c001dc6a82bb00ab2a4294b1c86764c64666691b6e5ddfb7c0662c6e365834b9914281155600ed05ea51d9b9e7d71eb8458fc4b3422710615b5cea9881896985cf8dc8acd780cd289149713c629172ec153e8eb81cd3bd6310956836a43e8795d3711a85592e910ccfff000510ccd2b32543fdb8f6ec23bb7e7ecb6e19bce0e34720030d4d75559ca29587da2bbb5cc08d61546f044ebf4ce37749d72bc631af957df75a1d42522fb6e1377d752ff564c3b2b50425ddf84328c6661c25d65bda1bf27cd9989dff59d154b3711bd51d05330f0e4c94468c6eead201d0eece8da6d54db0912b7087aff75c3f08e60bc615e048d0176127f7d1cb26b761e32c8f90af4ac248256f53d0db5521f5610eaa5c25b37468c25fe797ac845d90a16fb7b3c956ca5b23f82688f4ee56f6c66739ca845e4196e26af013f9d03de17c8b7938340211c5abf3524dacad6299545f1bae6182686d86775249680e8d195b45b9ee25e46e0d1ef286a905b30ea586afaece9278bdec10cdb51eeffc642618b4bf047e8b95a0398a9ed78a5db3368ff051e8fa9e2cf4bce361db2a3030de82dff2b9daa6a7555751bee83a6465e0d5f870e4d61814f348cd651925bdbe4fb518396a61a93ae8a19367f475954b84f446729cdb1b905db129bbf27321e9594dd9422a65baf8337ea653dac72191f2f09e7ea02cbb15eb34a2c485b803deb8c43c00210e52dc5f6a8184842117e817f1705eb7ec8eb7feb9043a2c2d6083c7d6a005e235b1df0bdc8ee00fd627d47ca9df8041dc4939bed77b20cff6baadf66d021b6feae44a1595def25e0a2b3c48f53ba244cacd0e082875a7ad42570fdbeb9f33eba04dfcfb1897127c8c0cb04580c01bf0449effcc5aeeaa571f2211450dbb593001139e03fcfdc39f60b9b64bfd376cf494334ee7c749ebea3464e644bfe9862176c33af4758a0bf3149b7ca36ff5bc17f8596ec42904b4cf7da29b0a2f5d9e5465e09d7e21d9da351835c2cf1c87cb6eae6f6231d4c54ee67330f35531d529c9ccde18ddc306b66e87fafc05149a99df8bba2a0c823df3374200f8bdc9224e042e1415233d96c28b66ef7143e8c9a0c3d3b357022d52d4bd4a87341dfe4d5a6aaa5968408cb86e1b70e0e19f9cf3a548e143fe734258fdcad1e7f8b34b2776558f8cea653f6f1b181c25c393f233280ba8cafbab4d9da0cd84b18d1f6574dc418f9d0523777c4682f2644c70ea85fb69af14a6cf4b002ebf00d9ad61b54873d5570eea23b47177af456618e7ac3785ed9e52aa807eed01bd7faeab22d7666fa106a608eadb29979897a70e3a93db87e7a3df20c16bc7c3740191b4c7e919d3e20c56667db6bfbdba728c5811b9ce1c20dd13dcae3bd6e8ba318c5beb83cb9c39fa440f9bbc63acc9343677734593ce2457e9c2d5b134e1d0aec8c98ee517547476331f715e31262daba7f1ceb64a17242c43076df0a2bff839253f365c1234026d0eac089595574a42861c286470ea25863ab7197a48bad13d6a3a2f78ef1e1af3e9777d199633b4fc63dae951b9d7a310a5681f0803e4d31beaee97cff254265e851a563cd211d1d57cd98e9fb42cc8c0479bce37a1a873e3863c2310e078212b7e20734e2b0004d6d5564731458a402e90cdb19ee5316e59f36c85e9c79760c1d878405f714b0be8abe7905e79ab3a6e04be216082c6d9efa772e9d9d7c7382590da49588e345f80c1e73588051a28710c22b16c6116ccec93c155dd130e2d446b27c99bff665973e7d84912f0b0207d393bd6d5a85de13e1a7b376ccbb534e792ee385fcd37f67c1b6c2984912f5cddd507488602f093d036b2112c449e7d14b9c13937cad7c82e0bf44bce2780e271cf4070cdd47bda8b45db5e0d9e3aa703af187a2030b732cc397f5eca12bea9d52de5f9ab1cdd85b5e521941bafce05b735d8a5a5da8f5bc29d3ec75160c627d9b58737b9018f5c69198ac7cbfa2ed7123888288695bd2954c525d916c629696529e172dc3bf5e1ecdf98917eb7ab19cd08f5fd10b9fd4d941d876eb901c3402bcd83b5de003edfcd75bb5d153acb3ad7732825adb715c94e3c185d7fd541664cdc501549874d35292e23ac7dfbea71275b2fe732e4005c33057b7d9d52f09c7ffefb96b6adbce6081f0aafbf8291b6d6762416f06d30e5883c551f02f4b3691418545a002341399820d3554368832bb33442cdf833cd732028586bef48656b80e167fd002075194489e778175a518b36715afce47aada000f2c920e1cbb29280c684c9af0201560b85b864662e8734ece49f342ad13a793da7b3d7de22c3fa48ce93c94865d2c87101d39ae99573233675be1cdd104bd1e27541ef38b61fb511c941f2613166fa939ef4aeb834d12d42ec970b190ff0e255c7c8ea5b465abbbf3527fdf1058d193882a547511d2821c53613b097ffe2144c96f45b1131f39b7263315fd7562af95f7a5f294df8066ce47d5fae40598c240a8f7564e2084c0901e51cbecc74525a4f9f9b653534c3c274f83f5b07f1b99581efbf69195abcffbb94a794a9c747109d0b262ee6da2ce909ee51bcd83472c1fb8f565b5a6d80f437d5e5bf2f0ef0ba16f18e3", 0x1000}, {&(0x7f00000002c0)="5b9d6a8aaf3fc7689e8f11cc2fa68c77acec4625830a5325bdbca7c2a35fca700aa357f0ee496d7088d7167bf4cf5857b6509f43d15472b650abfefc8d01c7cafe8a409f7db84202e00c4655d91b27a77f4f276e68be148ead727bdc34f7d735d23542a4372232874232412edceb176eea64b28d64217e695a6c7776be49a295c11e197daddd880515fb6774a06b82734f1e75c7ddcb2174c4b2dd76ec045401915c40a8bc7e5847f7fce754365ef77516b86d5e03bea363b78f3a310f41c9d121911f7e23d78c9c1e677c6fe44670874ef8ff8be1d5b3", 0xd7}, {&(0x7f0000001700)="b4d4cc4a3d4958462e3ba554bbf90854ca568a604284079b569f3ab341579abf01f2bd45744dea85f57bd28932f6b23bf926f1b887f89f5a8c23f51a1a95c82080bbc828cfa8e5144e87958add627d4181f9b3d2aa00014b299c90f07d81090ae44cd02a578b12e995cb2255914ae9533085bb82881d820ca1c06f80c0939628abbed64ec03f5ae765d73caf68ef8ebc9e0eeb51b3015ede9d8f3f274347e7fa8ec7743ed48abcb9aea6d0113525fc35e8b5f4a076e1394d085512333ab48d2518a02339c3b5a7b6795694aed0df92eb06fb6a77664f52aef060cfcf95c7f030eb3240b9ac0a4a4582dd0f94bdb288140cc8d7c4a7748c15e49f5d332f5d30a792d1e5f619f3a4a25a3a9460d3d4b1e1e0f986e06976017f7a44381ab66a8efffabdea69e0a9524e715084404b049842b75741ddca35de09d6c06899ce589bac34af7a4405c420eede81d47535b4eee71c764d5dd39fa49e5fc8d131fe4f6b4df3e4e720747890a03144691437aaa0c1004a02760267ce9048f0bd13449ceb586b14dda959e3baed9750ff37e85e23a8f5db6563c66d2ba10ce8e190d526ab367f416db5c2bda5b5cf8bd8ad98cb1efe768296cd968adb5cfc80fb43c886d0fb3276b7bb6b746c7aed850e55351bc1d47af2bc4ae04204cf25e215a93c7e510ec83bf342ad3885955228830156d7f9315fc71d5828966efcd2e6ff8efd181f008aca1279596893a593917de6394458971b333d676a681119693706b6d598878e57ccfedbe1fbd3412836c39162ae667654301be1dff762bfad740f28a30393d274c7990aaeecc6fe87f997f436edbf171b19f6eacc53bc1f79bf5787e24c24a2bce8c08ba72ce5d2da041c8d2a06a435a37e442aa57b14e7406cf7ab6bd26aa2b4bd9076c4edecc30c1a7af00af7d8e47f5ccc65a2f83e46118d6b1accb17fa364bd03350bac817a28a172bff252672c2f321417b6c309ce515f7c562ea2d6034b46adee59a87471271fd58c8db2d90181edf83fd9ed810d3a5d05cee8cc436c9350417d893b2969a662927d98cb3aef1db38da6430b1723259250c6493ed288f9d306f2e3e5501da3a3f834b3f94e07b67f6b885b93b69bfba5c5b89ac76a71383f6c011c111f8a70fee6d79567838d8ac144642a34a9c4a1f705585853df52a895eac8eb293ce49dbd08cdda2c179f9b4c8b417f3b01ab9de52dc752669452e9010f0fdd71f6175a0d202b5c942d059c43c82a02a8ac5f16121fd3f8b9069ef28ee824d4f7ca8538c4ac43b0041421faf59a5baba2f6c38474b44848a5a40c94f9a1d129c3e71cc8e503a0cebb999b19b11bd7d4af4ae042fad3700e5da05b101753889047643b12bb73b400cf64d64e4dbdaf552838bc62e5331a29780a44155e97522393db195e3a94ed2d0b743948f8b307eab5dc365288f267a34302ba318a694f64e8c1e6aefe3fe892683c480b8fa19c7cbe414c9e9ee7c0ba84f4807e6d3bd6fdc70da32009fafbd35c9ce463f4894d4421e0456d85a72355e6764cc97d04f19cafcafcec24f95c2f52853e1ac6ed135f5a260fcb9c4b05e6fa2da26aadc6e4aa12e1943d1bcb670cabfdb08527687978ee8b604f61c3f5c3e32285d19a1eaa25d5ead495d9a481815e2f5bcf0e6fc71b36b777f947ec504643d689e89400494772a07dbd1c69eb3508bdbf268ae46d25e6e260dc1f6de5edf35d5584da3cc304ba8124e55f88fe77b29344d95542f804a42ea4a70a67df866b711893dfc4819c42ec44d7dcd53d12015d8aa1e2c43a4b61daeca6c954619facaed8f64b2dbeb46c2f05d8c547e4ba0b7032ec46a21f136eb613452b546e8a686c878fb87efa45f030686b742a74739386756e76ac14c37ed5480026d8e3c717c82f35a47213896d8b87a7ff0340ef90d69300562447fdb3d2ef8e3ceb429a01da7e1220b8d0f8af78c9b2c3d0fefe3502e321d536217860aedd3902d3662e761c36eff228858b9779fb5e3539585d4771ac4716ff48dfce998ccc9b32fcd461b1d8f0b9d65bf1571a54340215c77d5de372d574d57f84481d3e63eae4bb51c95aa7c1359ac1de1bfd3d6dfc4aca791bf8fa984d043e6bb0199837043280b87d5086d2c27917f0cf296668544e17e39b8d6c0e2e3a6f24930570b98c241de3b60ef28342b4edfd327da3d1aa6a221c3848c88a1223026efe4d7200ab3656425b66814a40cf326777a9c9cfb9df553dee3ebad54c67d4227ead924e9e8f53ed7dd89cd405c9d0a89e973382951405ee3c501028e8ac5dc865a4dd109967a784f14a081e6aa68830be9a81edce247eaad74ae60eb3bd348f39fb166799848b83f3b680505cab33e98504cee634fda7c2ca5b802b78406ca66bdce78106598e3ed4933b2a4b079cf8a9cb85b0c5f8614f5a9fcb9edecc36b61866e5f07f07fcc1aaff4d1f9b597f9266dc5a5a2e52f1664f7ae0ce29af12b06a7b4d9e31f20eae9ca0ca95b7f72a145685af72db86b4dfe8d91f94428a954da74623ae55a4945bba2476000e7781e2c511c38d22775a25a076347c67b0dad4e0925ac23f8f57167a8ecca2c6d527bcf02232d188aaad09d59f40d68d39d3d6951b51d4379966c0af07d29a99cd04160ec3856e23dca1554b087a7e983f1431838b3efdd6f6b3b29d15475c55a760c9f86b7ca2577e22b2f424374ec089b9f6e7d2dfad423cafe7165fd99e8cae0225c0a2668b920ef71f0a6824f7fd716eb1becd04f5bf17c5be8afa90259d8bc9da31f384e68446481f156794914e930450cb995ac19c08926329d8b1eb56afc5e52ee119a9c17e0631c48e212355bdd1e04043165d2e948068838569d2f7af3aa92a65da83d78950551f49e8e094ffd7f9ade2514ba4d85b1590c0c9d96b9e7bec67fb7b25c31d21f23f2cfaead68efccaff0474ae72ddc9248047376a16298ff6d21d00560d0909730f742719a70541d8d5885a360408622b595b720250a429a300fc84a5224e7c014e1b1500d408f1971c7f7c119340bf58633d8cbc33863d46af265ce967f912ecfb66a0597f57155e166a6b28d8aec07d19766e771df3f130a0b1a1998c987a9d26d134250660d180d352f0051ae6fb75f8a63d2ac0cd190d49f2509909c406020f9b2278d1fa542f7e0f031e4e2bca3a6a1d85fe37d7c3c3ea4d8628e61ab36aad10e665a98b3ffee04549b32d4d02fae744de7ece88a657e40e2a4a5bd5564bc303b1e2136356a68611e6e0dc66c824e85b7333e830f880c4329317430627b5b45c5fa7a6a15494534decfb2dc0deccf28d4c9543552062a65a5ea3006344189e6016611a29daf9721fbc31491bb7a614d909de11d119975d85fb35bdb8e74a0479f0b48ce5f1d0e924aada49b7aa3725c41c247856ebb7a9df0d9f89ed6660cf98baf46d0d5a1dd909e89c79bf108c7ac708672fa7140581493cf4d386b7961d5a4cfcb0f1ca864cf185d932f25929a5f86bcdf30a77e04358c114e1bb3b477d7225d56ad5ff9c9888ef2790bc77a41856f8782032c44c9bfbb25b9c70debf5ea26b4688f1cdaa96c9fac9649501cac987ae7314abb0ffa147d0dbc1256c0c620c3bdcef3d3a6525e803e9622093e14553284e6ddd3d88990bf86b272586dd8b7cecc2c6ec80c3191ef42f20d669518d6648b5576b8683756cf6ae7a34f1a25a14b0a252153560a6bcb88c3781cbc79e07330d1154d2045f4ca394bb9970d7f0fcba9ddee8cac77aafd1a00d18cd780bce535c5308d259cc654a6ef76ba9e9641faef2b27420ebbb1d8d7f7c5211e6a80602d11dfc032c3bda60f6a582321f01a2e1b06c707fea8edb8040fc35b111f28f5c9da0da94cb82d196a828aff3a745baf940d6e5a29360c0695454a1149f84092f585ca71cafc3f5715720a3a9720ab8b078d03691dbb706238a095deef735cd19883979216e5b38628661de33279cfdadb4d3e52b8451914ceac2bd9a65b2a036fcaa094a845775820dae6923a37d68ccfa49c10cbc979c294796f260f1fb117b24998ab06a10a046da4ad440176173cbf141966a67c9bf2024fb7c2ed8e739927e2bf96c196fd00713628ecc8eca4fea467067fb5916462d80fb84bd59326430a2ced6698ef90dc714a635cd82d46a76f9fda79c26a7b961772ed6379c77b0b5f248d3d7c6461ac08de3c16ab047be681cfaf8f5764cf70ba9115d2946f80a81f3818608dd6f89113df9e480b68ae244e98291aa7eef2dace05fd2e6196b62df7196c19c4c736d5ff342bb01e3373ffd9c66b6c5f5b9ab91ea16302f243a131fdf1fe43c1324f4faf711c0f40b5182c9ca7a04006e5fe1119579bb08d82007cba0bf4bc56fdc12a52ea6fd0517d7d776a0d1a9a5e30d479c12c9260d3bf976e0ed2c0e0ea7b749f7c6b775b1be9366580315673447340a69ab704c9e099f0fe6e09cf2950baf999be149688991e4221581bb665f910273b96a34f67012e2f39e5723aeef94640fb154a5816249d61f26f78f4e9a82adee3de7eb10865ae81c20cd65842b12939e67dcac1f7991b0275308077d337d83fea6f80eae8808b87bcb7971cdfd54c2ef8bc74382341943b2a85fdb4c4d828c412a1f55c75c8b84de3f97f254eb76e4399ba34b09bc4a391a5492e6b6ad576901eddc4554a2a9ea3a101b996ae300cf1aa2376d495031c61bc38c509fcecaeea435f72cc2d2e69bae1f69a40ecf8340f68939446d624e931947a28562df262f4567fad0bb9d89210630d248ed5969d97e9ebdb5739818f4aaeeb023bde9c5aedbd40123a66ce78cacef917c37d5907f9791cb8aa3743a074cc4bac5c876e79dfb845d9fe3cd3c311b1fbf8a06eab606858068d35799ee7aaeede719306b87318e56484605725d5a5144c08140b9ab22f4c988bb2b28e7ceb40d6163cfecf4d2b3c26358daf860ca42a57e017497a24e8b110887db3d5358a2c23ce16d27139bf070864b00db677d7354773644da478f5356d054234931f5fad83c3f8f7b922f45b1ca7a83a533fbef0c9d65be7df3722a8ed09db004e96852570b138ee030f7dbc4b3949790483c470e4512587c3e5400e22edbac795dc9e098a1fb4f8cbeb0ecd6e80c2a87cdb0728bde6421ae52938e39a9b6d19ed5c91fa397890de313156b69b5eee597d22b14890e955fd00eb9a9d2e5c218b2be69567769967ca63571902c0b86937c9442d3ec84068b3752fa432a2b5ba4fba413a7bbf06930eaf7fea3984a8ee19392645b9b19f627d823d129540dbdf8c405c3b2545a28b687edb68c9f39d45a35c7f7b594a953f9db9b8e6d950ccbe26cdd83e0c461e460059a1608f546fef7ee1f46f6fae5ebd1028c224c451508ae49b186a46be4c5d0c78835cd3b41e1da7e324d15c73dc16ba10e3097215deaf315555b4ef7141b983c01f118239d7f25b9bc6434ccc9d810e3a32083a30735c9b0d3fbe5a6ea9160da097f7e2038f53837fd3b08788af6e6c670f74c9022f1c875c0e70504729511791853816a7efd587b890fda3a3c016d0db22db7a2d7ff3e175deeefa0daae632abfb3eea0ffa894ff4e6d88c01c7865ffe62bfaca7078e8e10fae8a7571e6e5b16798623efae6f82e1dab447903ddc39ac3769d604ebd27f9883d530cbfd7e0ed86ffa52a78b42adf51b2b344d091fe46068447572add49943d14bb705a72c9e1789713cb34f0991e9df8a2a04f67cf170c1f9670c99d98e668ce34de14165758331a78948c1b7a0ba403ca64ec247f7bea7cfe55f66d09c24ce75b762b0dad5f74c1f2fa7a38e254e09800cd", 0x1000}], 0x4) 02:06:56 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=""/213, &(0x7f0000000000)=""/61, &(0x7f0000000040)=""/124, 0x1}) bind$bt_hci(r1, &(0x7f0000000240), 0xc) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000180)={0x0, 0x4}) r3 = semget(0x2, 0x1, 0x798) semctl$SETVAL(r3, 0x0, 0x10, &(0x7f0000000140)=0x5) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f00000001c0)) close(r0) 02:06:56 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00I', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:56 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000040)) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:56 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x3ff, 0x2) fsync(r0) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000600)=ANY=[@ANYRES64=r1, @ANYBLOB="2e09fa6ce9094d16b6c3410fefe5bf1d2227510060cd5aa2cd6302e0bd12611c7a642f9454dc3ed13d090c327b3268583d3ea0eec38c59c3e91ae8c10b228b156bcda6cd3ebe844a5d1e87494b9498228e1eaff3daa947d1a775efbdcd5c87a863cc8423dc0b0dda088f14d640f1cdb67f90dc53f50da76b0e19d1a12450a588d35545b5321e58e1504edf31f5a3a4aa14f1352fc568e6f1a0d80389070df6b30aeccc464218614861e81978301f75f5010675f115a4ca701d1b5f6e0935c44d073b91017d6e6d52d0461f", @ANYRES32=r1, @ANYRESHEX], 0xe9) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000000)={'syzkaller0\x00', 0xf28}) r3 = getpid() r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x23) perf_event_open(&(0x7f0000000140)={0x3, 0x70, 0x9, 0x1f, 0x6, 0x0, 0x0, 0x527e4fc3, 0x100, 0x1, 0x400, 0x7, 0x4, 0x2, 0x6, 0x6, 0xff, 0x80000000, 0x0, 0x3, 0x6, 0xc7fc, 0xd9d6, 0xb64, 0x100000000, 0x7, 0xe63, 0x0, 0x3, 0x6, 0x4, 0x101, 0x6, 0x0, 0x9, 0x1, 0x10001, 0x1, 0x0, 0x2, 0x1, @perf_config_ext={0x40, 0x7}, 0x20000, 0x51, 0x5, 0x7, 0x6, 0x8, 0x6}, r3, 0x6, r4, 0x1) rt_sigsuspend(&(0x7f0000000440), 0x8) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r4, 0x40045730, &(0x7f0000000400)=0x1) ioctl$TCFLSH(r4, 0x540b, 0x12aa0000000000) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000480)='/dev/rfkill\x00', 0x10080, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f00000000c0)=0x5080, 0x4) renameat(r0, &(0x7f0000000240)='./file0\x00', r5, &(0x7f0000000280)='./file0\x00') ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, &(0x7f0000000100)) ioprio_get$pid(0x0, r3) 02:06:56 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="5800003f1400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:56 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000080)={0x3ae17271}, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x7cf, 0x0) 02:06:56 executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x802, 0x0) syncfs(r0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x9, 0x20000) r3 = getpid() sched_rr_get_interval(r3, &(0x7f0000000180)) ioctl$KVM_GET_DEVICE_ATTR(r2, 0x4018aee2, &(0x7f0000000140)={0x0, 0x0, 0x3f, &(0x7f0000000100)=0x1000}) sendto$inet(r1, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r1, &(0x7f00000008c0), 0x2b0, 0x0, &(0x7f0000000080)={0x2, 0x4e22, @broadcast}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r1, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:56 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xd, 0x2, 0xfffffffe) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c000000000000000000000000000000000000000000000000000000000065727370616e300000000000000000007465616d5f736c6176655f3100000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000300000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb00000000a696fc71aff4a200000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000"]}, 0x297) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000100), &(0x7f0000000440)=0x68) rt_sigtimedwait(&(0x7f0000000480), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0xffffffffffffffc0) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f00000000c0)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000016000000afb8e1ffaa312b4ac46a4dd43bee7a2a5d6f865284e000000000"], &(0x7f00000004c0)=0x3a) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x3f, @mcast2, 0x9}, 0x1c) 02:06:56 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00V', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:56 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000200)=0x800) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000100)={{{@in=@broadcast, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast1}}, &(0x7f0000000040)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000280)={{{@in6=@dev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@rand_addr}}, &(0x7f0000000080)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000380)={{{@in6=@remote, @in=@remote, 0x4e20, 0x1f, 0x4e23, 0x0, 0x2, 0xa0, 0x20, 0x88, r1, r2}, {0x6, 0x3c19, 0x3, 0x100, 0x7, 0x3, 0xf0, 0x2}, {0x7, 0x6, 0x3, 0xabf9}, 0x3, 0x0, 0x0, 0x1, 0x3, 0x3}, {{@in=@local, 0x4d2, 0x33}, 0xa, @in6=@mcast2, 0x0, 0x3, 0x3, 0x7, 0xd9ad, 0x9, 0x5}}, 0xe8) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000240), 0xc) close(r0) 02:06:56 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) getresuid(&(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)) r1 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x10001, 0x121000) ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000000140)) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:56 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c000000000000000000000000000000000000000000000000000000000065727370616e300000000000000000007465616d5f736c6176655f3100000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000300000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000001000000feffffff0000000005"]}, 0x291) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:57 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="ff8026259a7341834c18cd6b672372c5ef9b37"], 0x2) write$P9_RCREATE(r0, &(0x7f0000000080)={0x18, 0x73, 0x1, {{0xa4, 0x4, 0x4}}}, 0x18) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000100)=""/252, &(0x7f0000000040)=0xfc) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f00000000c0)={0x6, [0x1, 0x5, 0x5, 0x1, 0xfff, 0x10000]}, &(0x7f0000000280)=0x10) bind$bt_hci(r0, &(0x7f0000000240), 0xc) close(r0) 02:06:57 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000401400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:57 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) [ 325.880918] kernel msg: ebtables bug: please report to author: Wrong len argument [ 325.936612] kernel msg: ebtables bug: please report to author: Wrong len argument 02:06:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x48010, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:57 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="d648ff675356ab8b7033f23a191f8c1d73ca9ddaeafd1b326020b06a6270dd7f8113ce3259fdd3550000000080d72ae2db82b7da03f89e2e6dbd3abafdf58d0cecbef032308e0ff296d656078221c47613ba198558c340bd7f329dd1823e28363b928757277b2d702996043740df4dc393da7caa30fd2ae1fee03c296d7d764cb2da5122c7b15b7f79b9e5d11d4540b2f187fbfcd6e3c3417fcaadd9457adfe9fbf7b492adf23285cbb0e11db0659dfd7190953fab6ce2231ef3fda3aff8ba1d91175c1aaa4efc4104744b3920709535ab8089ed6789179d01618b6d9fdd4eb351f0"], 0x2d) r1 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000000100), &(0x7f0000000140)=0x4) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f00000000c0)=0x6, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000240)={0x1f, 0x0, 0x400000}, 0xc) syz_mount_image$ceph(&(0x7f0000000080)='ceph\x00', &(0x7f0000000180)='\x00', 0x0, 0x6, &(0x7f0000000580)=[{&(0x7f0000000280)="afbc3e0867f4d79b1f5f33981507fe56109e262d604cb3aff7d10649982841841e61aa09aeeda3cfbff9cac0d746544957b77f615f9c90b1b700ce259b76839c0985df318ee7914686070a50c3ff86ad8e60bdbd594b41183976ee164dec8f866e73f03c32a50099c4e3862c3961d95901f24a82c3590a33267f68f4841bd4afc63197d12a0d23844cff80d1fc984dc2f56b779b1c9b051f0e", 0x99, 0xfc}, {&(0x7f0000000340)="402791ebfd84210a82b174b9d6c48b54c828464d51b3db55e80ac71731597449899a3df8ada39eff2cfd464b5675a1f6282b1eb1bc03e426d3ffa87f9881531f22ec5a3d185ac4ea170a6c6554532490a162789ad21dd500c83adec2d9c01a57ca29e183f7f6701903d0214e09379871d2f01ba730dad02ee984ab11922584d7a1dca77f529764cfdec1a55efcaf45b2a484cd6ed4aa96532d32a1c09ddc2a9e5bf656eb118485cb7d954cc011f79c8cd1f8fff94fb4b94c6ea58891fae31b1e1d04", 0xc2, 0x7fff}, {&(0x7f0000000440)="832a3bd59c2e76d109820fae1df20a3614218a8ba83fbf8aa6cc34ed7e85ea704109ebc1c1f67301763a70945392f1cfa1d6d0d981f20e5ecf7386be916d1412d932e2752550250e1058be77c7eac122a9ca504dfa5454af51d64072f10adfaea2070a9c76a4a7381e8f09288e24181d9f7b7207e6bb4a79d2c82f33fc693252a43cdcee452b4fbc79d382893b49365c6b03ba296d8f09b6cf466e8e09f30253fe4ff734e5f4a524de9f29093e4b3c00b1d93647fd77527b3d", 0xb9, 0x2}, {&(0x7f00000001c0)="afaa0abe1186ff1013b98c34a76eeccd74", 0x11, 0x401}, {&(0x7f0000000500)="40eab6a8382216c86c7655e929e24e0ac6e52bd66689765ac0b3da9539ecd6946e14ece483ac86e70b81424b7d511794ea3fcf72fd1dfa08499d7fa6dc6475d9410879dec9508b5e78410a0a9f5c1b578335bba32161f4dd1270a1f2845b92bcc1779fa355f0564e6531973f4c59a0", 0x6f, 0x5}, {&(0x7f0000000200), 0x0, 0x4}], 0x150000, &(0x7f0000000640)='/dev/vhci\x00') close(r0) accept4$alg(r0, 0x0, 0x0, 0x80800) 02:06:57 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00e', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:57 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000100)=0x100000001, 0x265) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000040)=""/106, &(0x7f00000000c0)=0x6a) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x44) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000180)) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:57 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x6000, 0x0) ioctl$KVM_DIRTY_TLB(r1, 0x4010aeaa, &(0x7f00000000c0)={0x40, 0x4}) r2 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f0000000100), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0xffffffffffffff71) 02:06:57 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="5800f0001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:57 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f0000000080), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) [ 326.373798] IPVS: length: 106 != 24 02:06:57 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fd, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) getsockopt$inet_udp_int(r0, 0x11, 0x65, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x11, &(0x7f0000000480)=0x60000000000, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:57 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) r1 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x8, 0x240) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f00000001c0)) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x800, 0x100) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$EBT_SO_GET_INFO(r3, 0x0, 0x80, &(0x7f00000000c0)={'broute\x00'}, &(0x7f0000000140)=0x78) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:57 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00w', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:57 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x100, &(0x7f0000000080)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:57 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff84"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) bind$llc(r0, &(0x7f0000000380)={0x1a, 0x309, 0x80000001, 0x0, 0x3, 0x0, @random="0c6986c51506"}, 0x10) close(r0) r2 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x13, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x5c, 0x0, &(0x7f0000000180)=[@transaction={0x40406300, {0x0, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x58, 0x38, &(0x7f0000000100)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x1, 0x19}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}], &(0x7f0000000080)=[0x30, 0x0, 0x18, 0x0, 0x38, 0x30, 0x70]}}, @dead_binder_done, @free_buffer={0x40086303, r2}], 0xc9, 0x0, &(0x7f0000000280)="2f61e9bba268cc6674dcb7f5e57eb9861f435530bb5a0facf6b9c0830e4654dcf11feb882f882b3fac4e34b545854af30ac8b8e6a3a94c034eb92b25fca98ec9f5f0aad846eddd44a0f9cefa833f3f496a7e69222f06b62fe3a028095e8ce9e588653d8c0274bb790a263d6ece965259dddf00c6e3af953384092519da663d339f55357c86c812185b62f26af2b2cff6baacd0ccecbbc5384d804760bf5c46757bb5e46140a8668e26d1185e58b597bbc9987f21b42216fd232e1f67264bae17deb482b603dc02b144"}) 02:06:57 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x7e) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x25, &(0x7f0000000040)=0x2100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000280), &(0x7f00000002c0)=0x4) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth1_to_bridge\x00', 0x0}) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000180)={{{@in6=@remote, @in=@remote, 0x4e20, 0x7d, 0x4e20, 0x0, 0x2, 0x20, 0xa0, 0x33, r1, r2}, {0x3dd, 0xff, 0x126, 0x101, 0x1, 0x60, 0x4, 0xa0c1}, {0xe389, 0x8c, 0x1, 0x7fffffff}, 0x100000001, 0x0, 0x2, 0x0, 0x0, 0x1}, {{@in6=@remote, 0x4d5, 0x3b}, 0x2, @in6=@mcast1, 0x3506, 0x0, 0x3, 0xde, 0xffff, 0x3, 0x100000001}}, 0xe8) flock(r0, 0x2) 02:06:57 executing program 2: openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) timer_create(0x0, &(0x7f0000000100)={0x0, 0x35, 0x1, @thr={&(0x7f0000000700)="d1b6528d4bb2e8143ca110054867a295d0d134818fb456d1684695404c1e5eb36121cbc69e698c618672275c9710b43efabc251f0809e977bfb870cd1a153db310069e26a4b9689ed02925b4297579d088e73a7d633232829c28b68aeab1f179ce461674e5dfe57572d777940661e001ac8bef5f7b42b87961acca81729a6de9034ce7b889d0aaf3e56d23b3d76ca7bf6064c28da8f6c681379f58a129e070dc8e8f843a11265913b8eb5eb4822f419c88523ee4519b85588ca191703ef8a1f82611fa8fa6f91ecd885667be832d184e942000b2314daad295291633bb7892f84d5529521f101740175faa931c282cc4136dcb6b9b82709339f0de10f0f8f26f19687e0b8f2aea45b7c555bf0d2402f5d10924e1149f57e54aefd43ca7c72737b24d7d557359e35cfc24b19a63fcf1619638bdcb7d30ecc7ca6006bc94dd06864aef89aaed00463852c2c931a3c9441c065f3af320c9552f007147cda3cfa54b5b7578a166acda5c9f7775eebea249a2ccac037052bcf0e6b5e9bd21b0e31da13fd365db9dad876d0c6b2c1c47884925ca02f718e3d3941441baa9122e02c91646b2e8a30e774d1ea6c442040e5b578c14b9df270ccb29d619831046fd7111979b4eafe2a4295ce1ba3efb1fbd908b244247b4616b650078dae5d5a04bcaf9f0f5a7bd5275e8205d07b7d60c2798b12a0f7da403c4d753d7911f826613c6b604cb146b8658f241189bf6f24c24e5fd59efeb9566ca3542937676240444cbae34ed720a444597d8a3cc1003e170c9c50805c5026175a02b8aec1dc7e4107ff955866bd7ce8c1bc77274c74c136b21a466d6533cd0b9cad2bdc33032e8a5a72f16d359ec86a608de92d0117690344565751d8ff60755bc7e43a334b7c20d1c56aac49873a2dadf1e7659dc4554316521185e64f26de4872447257d384732853c592b69299bd24b72643e666fd287a7d251fd812f4cd541f9ea465c4f2db6ffd525d22a2dc507f2409cad901717a8dd72be238aad2a245da3bd8e85bf6db92b798f7029003d321659e6e6fe99ac0cf28a5955b73465483b6957fd605800ec98743fb994b8b62a1eeb0bc3efd3059654623e570af8bd21dd4bceb92d673044c6de246be97a3c5fe903cbe9dd35a8325c1a4254ee243c91f06a6dcce243be5a03c1125d2f1722728de043e997b0e40c3d440cc251d77251fcaf006253d83c0c5d90bdcf545fcbfba40f8a8219ef400da79c0120f83b0025fded2881a44d1e585c7d17c29ae56a6138197a6855cf1bbfff7eece28163f0d3c6a6e8d75f99da3138eb6c07e70fdf6d2abf7709eeaedb1077a243b9665d4965287b73d6863412a22df32dc6762296f9b09d9961bc4b0dd0ffa1a1d1d69b7f82f8d9f6856ab1c7fbc67fb19188664bd8accab028bba107f6035043926842e311c62b9aa19010c7afd609d00c3d5a43dc96590f1b4064665c442589f899bcc58253f4048ed436d176a7ecfe8d06ec9ce67dbf050db44c25c1d0ea206b1f4be6a16061deb0be7d80722b4d0fe911409924b14d7124a3ee6b570b2dd1900232dbfac56472626bfdc3aac24110202ed72f6593154af6559ffd2209b67fa965ba29013e378500a71d330cbcdb8a732a3c8097fda1b9398586bee71d6482ddc5fc5b0a8cc305973039df9bb9550458b950f00c9a391ab0237205fcd59ec1bf43b8c9aa40e782a73cd75382408d759ca5ec035144ba4b844d17695708a310bdbd7e785377f341cd197f592a26aa663a4579755ea06e32d2cbbfe32c1ddede1683f54ad2fcf3ef2d6002d38c325d7cadbb03142f842b69011063986f812707513c8a3084d680a06c6a6d1a663169f8b4255ec3b7c3efa295a6ebdeafe8660f893a3111fa8a3a4d8acc2205503a5f5b4a6b5d7dfcfb4648dc4a6b8a73fc85a2c61e7789d58e094bd27da4db04cc4ae76548b95cf9e5d12862367194180c01991a19ebf90cb061ce785d85e4c3002d226924a11a1204092063354f509026fe30789767ce70016a6d9b7d44e0c1a930c2b2f4e76ee8ebcfac9d4814451ddfc518552f2ca1edbb9a9b6e88607e628c936e161e0fb46db9ca6a9b977de4fb1f42ae6ed7a611003e6c3cf0d26c6fc6d42066aba327dfb16cf25b969d343f59a8138de79e364d3c048846916ca6f01b1889e6c6266363749174fddedb3c134a2e7616e20a04683cabf702ef352206c563afee7d74d284e0226fe25db8783d1a08d33bcf4fa5e1bb90b9740c476de7a42e9af798ef8609bec43a63082cd31809a07ef1c38c4f6f442895e8d8ec111a607ccd91e0216153202f9e258b36e4001f29554380210d3bafeeea60fc9807e73c040b8e9f06b6d277ccb66e82c48346b4ad219842b50a437a74e3b9dee1b6c17cde35e841b9318b80be738e118ae89bebef7ac0c4e4cfe1344d5d31189a0cbe085fefe6462d5e9134020691f00d858288190c3dd3d04810f2a43fcb11b9cb89a0d7a9b5d9ab583e0fa1f8a6c17691538d2b57fd2ba8fe326b7472898bcf7dd0f8aeac6b47378e43e7751f386a0471a2c6bad9492a7eef0da45c141c3ab52fbf54d8a413bbce0d56adf6f67c4f079f7a0e68736dabfbec25fcd4633dfcdd11a264c46e0d8048c503812ac38c40cc2a9a04830db17b8e395806b2b467c40b00604b661c2badc7a07ff46f9197f83b84819c87831fcd6b51e52aa0d00b90f9514a3189210969dfe5c5fe9f907f06e877b6d0a21494c9d118b05cb21a403ba5cad38114096b049f32063ec1bcbf034a6b29be0180fc06b843061a8909450bb566ec6836d6e0097d41c9c70575c068892f24cb09f809ff32276b4195d07eef76f14982b53b766175ea5b15fbc4a300600a5cb09f07214d4079c840790f9323055653fdbded0af11216e61d3b200fd29f159ab0bdc6029a73d87bff82108dc1ca83d42e5a28f06839335cc76ec7b0b3b79a2bde968612eb62e00e951932e64fbb76654f2ece1f10d3da9d91ee30f9da301c6b4a775156abb7960108097155f8e6bd45b28d69d3d7dff1aeea7aaf9343011e4b8fc27cff35b230dd2aeb7181cd1b414ae44b750193a0ef32079a832dc308366b5305c4f0590ec0a155b8139dc673cf1ce56b9aac844fdad6759715226d0ebed374ff06cdf8530f762fd4a995ac1565cba68c93601d680c6336b8ae957cefb68616bd79570217b9f1b7b16571586f716b29d6979810b6049e38f704534372bda6f7a44e7d2b6bb865cff8b5a384b722863ae58749db7ecbf987b308201e0ca14242787eb2eec1f44b337b6d38aade5e1df99fa40d2ff9040c7d0513019b464c0bed3b97fcc1b0492500073ad86a7e413b02884b5fbd43a0efb08dbff45de00f0490a72bfac70e0546110477bbc95701141af7e2988d39fa7d762842db596a8883008cd69352c6ec960bff97ea4873c0722333d538cd4308ddd32168c1896c9650b358b821fc7fc5eb066bd77f0ad5ab9b2fc11245391e1142cb18445469f10ed39ff31c163abda8e1882afeda2e6d6f0a39912bb39498d303e6c16ba1d13097015329ab61cb6f4e370406c33e8ecd3ae70f37c7e236e8dcb79048316b59cf26420d3d6b60692966615052383ff80d453ebb0010531d5d72f6268cb8b9eeefe0e188bae28e021e85e68291f914d685f80a7919598730308abb50a93bd5c2d9032926f2a9a43f566546a24d8402788d90cfc129b1f871ac0b5f21c5aa3b3974daf1da0aaa98a0370ce069bf21e3fab4330dc27db11d0ddef5238131134a5bdef2b1d2e1f97d0b66b4f9ff87b603a5dd3eb7de297c3fcd8523b304d2af4aa2e39e9f08aa46c09aae519df70608b77dffd1e57e8177c8f5d71d57d93764b2b02740f5128117bdfccf201a4b3d6d3d3a2637c06108c6f3f52c6c935c38bd42db4cb8feccb6906165c476fdef574338bd137b7b4cc92a3e01bba255d187348647c5398dedd42821f1f789326fa4e5f8df28ec0cada7e9efb04400dcf96675a54eb6e1b93ec1cd08a72dd4a1cbcf2264cf53ba866d1c1b00f70f82bb9e312776048c0b0fc7f3705b9ee921426db61a944534442c00be8aba5a44f59d3ea7a0c8743534877310a7dc632911db58d7692ef25cfb14d7625385176c30939471e040ef9cf67685402fa0de0129299fee6abe28bafbec5177ee2977107332ff1389514af2e82cf375253def17ab24ba3fab1ac9e31ea127540a04033b9d012bb6fb65978d04618daa7c3fd7fa1d2e5c51f22d0ab13b5bedf519a5f7f74d97428e18c7a8c3aa374d379c19bae1c27892f32206b59cbfdc31a1ef5ea46ea14a1e5719cca553632ed305ea27bec7a6a9c0a9073e5cf260684fff1a62400239554ab4f84fe9edfc8bffc9bd24ad58258906f840a313bec01b4a697561a17a30ba623671f39566540eb0187de76f454686c26270b5433e741b478fd6a7437aa1b28a9f2174646b76526a6c1ef4e4c1a645ef76e798d6ba74ef878363c43ad62037681090571dd33d84cfb9f155a49d52b3248e85b7c5e8a6708fdec760d069bd7ad2dac32d972be421defb1b2d7fdd56157f841501dfdac1aa55a46e96e9fb76cce9657ae58ea4d5f9abd1edaa3b0f1c06c14c9af519cb9ac6df3ec7891dcd1e9e606f9b4e0bfd620e3ce673250bacf04d1ef992bea4e67b8960c977699fdd95c74b423ec4e9543bc8867862890cf60c9851260e96cb7638e1b04bcde0fedb1f80e0255bb7659de873e967bd1732601d8592b8f1337620ae5d94c6bdb2501aeb81c1c33a1bf0ccbc8dd1dbcbdb2617771f12a56f2e0610e1a0d7db577fa2129b170ef6e9b87b7dcc61ef6fb0c79ecdac11567097019c507824f9545ccf38e49d9fac641c364fb773b3b1558c0af10f77eb068a7460abd85aaba0eab9e8652658f0e54b048a44d0f76e63ff3a6649f2ab2b30ed6f0862dc58e4e069b57672747a94bd204c8a37136235bafc81d2c0fbd7cea353936c418ab9ad5bff5704166ca3b178a28d8992104120060fdfa58b47f6bd8dcb2ec40807e9b3852a10ea357fdeef60a84bddb08d136efe860766814a015006f65c07a808f6631c917c66c5a9f8374f4c8ca624d0d8c68c2c8aa5da1c0a7bd1d3536669a1f8d568030db40e7ff75f14aa8099f62058fb9531e0789412927e74e4c9f0b7afa8ee2fc0396f49c86196772c711481693fb5a5c203164649bb5cc1153445aadce61c610ad2f0cad822f7c54ebf81ee98db78eeb77809275d6da397ed0830f410d2be1d26b72d8522cada22787d0ac6ffe70ac41ed2292eabad1b53550148c9b8eb3efd39a67ee1eaa436ca5261d374d92ec351fe5d993718ba6a0ba4b92244ac03eab91ec1bca8e1323fde34abb13f7f0f88674d55fca1681fc83ffe5952713880d0ffce6faf0e48c1c99851f8c5efec29c7afa1588fc78c955e7476a92ab8723769136d1cf162f717ebb580dbebab7e01a235093bb776e1b0ba84e942a571be96b80453b5a872f9bb6aeb6d215e63ccb034bcdc281961ffcd1658a669248072aab9c50c9a7f552ad9ddc0b2a9b344f3772f66914a45665660b2bd85c33d8bba4bef0073a201f265ca9b811dcd9ae29250d0831e210451e75db4b0b78235a29df5703eab6ac82413de2f67d208f8fcb09da499e801dd45fd42dd8091a6831aa8a0bee61c9d753bc9c3bb113c0d7dc5961adbaeae00454b8efcfaa66153fe23edfd2817adcd957dd4b767cf28da09dab85fb43f4529b3cc1fcd39c95395568a992baf732135ba23fa59041444889d2368a6e3cf3a34b8a1ba74f1b7075a5ba148d109316417ca", &(0x7f0000000080)}}, &(0x7f0000000140)=0x0) clock_gettime(0x0, &(0x7f0000000440)={0x0, 0x0}) timer_settime(r0, 0x1, &(0x7f0000000480)={{r1, r2+10000000}, {0x0, 0x989680}}, &(0x7f00000004c0)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r4 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c000000000000000000000000000000000000000000000000000000000065727370616e300000000000000000007465616d5f736c6176655f3100000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000300000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000006172707265706c790000000000000000169a8e08d29b2f0100000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000a617a830be5fae85bd8927f8a0011f6382384ce7c6130d3422fde0cd12b5e31f2dd2a79021a33276"]}, 0x2b8) socket$inet_smc(0x2b, 0x1, 0x0) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r3+10000000}, 0x8) 02:06:57 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80d0fa5e5144afefca2983b41a13f408e3502c6dffc39474a7afe2c2a1215aa49157b839adc081b2254eb1126a7558053a02a67e734076e3ebe3b5de0e34c847ea84752b8a2c85f4bdad53d109f6661940dc7e2ebd92648ca8772d703d734b514a5e5873"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:57 executing program 1: r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x10}, 0x10) fcntl$addseals(r0, 0x409, 0x8) r1 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xffffff94) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(r1, &(0x7f0000000300)=ANY=[], 0xf6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000000)={0xe7d, 0x1, 0x3, 0x583, 0x5}) ioctl$SG_GET_NUM_WAITING(r1, 0x227c, &(0x7f0000000200)) [ 326.660836] EXT4-fs: 20 callbacks suppressed [ 326.660848] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:57 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="58005a021400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 326.701753] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 326.728471] kernel msg: ebtables bug: please report to author: Wrong len argument 02:06:57 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x80245, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000240)={{{@in, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in6=@remote}}, &(0x7f0000000340)=0xe8) r4 = add_key(&(0x7f00000004c0)='asymmetric\x00', &(0x7f0000000500)={'syz', 0x0}, &(0x7f0000000540)="200ffc66d33ae81a71", 0x9, 0xfffffffffffffffc) r5 = add_key$keyring(&(0x7f0000000680)='keyring\x00', &(0x7f00000006c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$instantiate_iov(0x14, r4, &(0x7f0000000640)=[{&(0x7f0000000580)="4300fac980c04d5d1b7570eba6bf8ffaae49bccc69f3d3fd61ca4b2e3a9ffa00d32c7d90415647fd71ef5b7587ccd67eec9dd53d47c77fdbb29510b1a76d7a2841875c90136edcc224c6bfcfd997e9a7acf9fc5b65f9d0a0000ed3906dee5c907a692131516c0e4fc3b5bc9cde6d917701b2d5a8fcbb24050a6f7be241736aa498942643fa012a681d7e453553218fd94f86c0b956ab0940734fbfc24fb4890973ca1df9973486d05c31ca67fbe124fccccd471130b9332b83e7", 0xba}], 0x1, r5) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, r2, 0x3}, 0xffffffffffffff5c) close(r0) write$P9_RUNLINKAT(r0, &(0x7f0000000080)={0x7, 0x4d, 0x2}, 0x7) readlinkat(r0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=""/34, 0x22) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x800442d3, &(0x7f0000000200)={0x1ff, 0x0, 0x31a, @remote, 'ifb0\x00'}) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000003c0), &(0x7f0000000140)=0xb0) mount$9p_virtio(&(0x7f0000000100)='/dev/vhci\x00', &(0x7f0000000380)='./file0\x00', &(0x7f0000000400)='9p\x00', 0x1001000, &(0x7f0000000440)=ANY=[@ANYBLOB='trans=virtio,p\x00\x00\x00\x00\x00\x00\x00', @ANYRESHEX=r3, @ANYBLOB=',uid>', @ANYRESDEC=r3, @ANYBLOB=',uid>', @ANYRESDEC=r3, @ANYBLOB=',\x00']) 02:06:57 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00F', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) [ 326.788303] kernel msg: ebtables bug: please report to author: Wrong len argument 02:06:57 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000080)) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:57 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x10100, 0x0) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) r1 = accept4(r0, 0x0, &(0x7f0000000100), 0x80000) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000140)=[@in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e21}, @in={0x2, 0x4e21}, @in={0x2, 0x4e20, @broadcast}, @in6={0xa, 0x4e23, 0x9, @local, 0x9}, @in={0x2, 0x4e24, @remote}, @in6={0xa, 0x4e23, 0x5000, @dev={0xfe, 0x80, [], 0x1f}, 0x1}, @in={0x2, 0x4e23, @rand_addr=0xfffffffffffffff8}, @in={0x2, 0x4e22, @multicast2}], 0xa8) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000040)={r0}) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000200)) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000080)=0x2, 0x4) 02:06:58 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0xffffff94) r1 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x8, 0x20500) ioctl$DRM_IOCTL_AGP_ENABLE(r1, 0x40086432, &(0x7f0000000080)=0x8001) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter, &(0x7f0000000180), &(0x7f0000000300)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_elf64(r1, &(0x7f0000000180)=ANY=[@ANYPTR=&(0x7f00000001c0)=ANY=[@ANYRES32=r1], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYRES64=0x0, @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYRESHEX]], @ANYRESHEX=r0, @ANYRES64=r1], 0x2a) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227c, &(0x7f0000000200)) 02:06:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000140)="eaf4ffffffcb0066ba2100b851db0000efb805000000b90050231e0f01d9660f3a406b582ac4c2f9a8aa07000000da930e00000066baa100edc4c3214c460fa4260f23d0660f3880474d", 0x4a}], 0x1, 0x0, &(0x7f0000000140), 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x24, r3, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x20}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8004}, 0x8000) ioctl$KVM_RUN(r2, 0xae80, 0x0) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) get_thread_area(&(0x7f0000000240)={0x82, 0x20001000, 0x400, 0x2, 0x0, 0x8000, 0xffffffffffffa418, 0x1, 0xa2, 0x6}) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:58 executing program 1: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=""/213, &(0x7f0000000000)=""/61, &(0x7f0000000040)=""/124, 0x1}) bind$bt_hci(r1, &(0x7f0000000240), 0xc) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000180)={0x0, 0x4}) r3 = semget(0x2, 0x1, 0x798) semctl$SETVAL(r3, 0x0, 0x10, &(0x7f0000000140)=0x5) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f00000001c0)) close(r0) 02:06:58 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) accept4$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14, 0x80000) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f00000001c0)={{0x2, 0x4e22, @multicast1}, {0x1, @broadcast}, 0x2, {0x2, 0x4e23, @local}, 'vlan0\x00'}) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x3ff, 0x404801) 02:06:58 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7df014368d5eee7b7f80"], 0x2) open(&(0x7f0000000080)='./file0\x00', 0x50082, 0x101) ioctl$VT_DISALLOCATE(r0, 0x5608) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) [ 326.992897] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 327.059184] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:58 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="f305d68209a66004a776243c1d2c1d98f519ad8fc1000056d30724b3c676e783cc757b50220847f2a2bde525146de35cd251f15df0b21be0173c0f3cdd91688d1067a344e9269401862b622593b9bceadad4293481fc0c0b6d434e25f30000f1ffffff000000a3b2ee805fbce29bc935f1962cb044bb"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) lsetxattr$security_evm(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.evm\x00', &(0x7f0000000280)=@v2={0x5, 0x1, 0x5, 0x1f, 0xfc, "2c27e72558a49eba9c047372e8d4146d931f61145ffcc91aa74803541bfe93d842f705a53562d130012c07f9d5bed89d8a58eeced0ac482e7dbc456f29586568b7ef1dd11069f83a7ff769c731b9a89095efa8ea57993a432ad42a478623a98510509cb32e4a4b502ee532b9ee601ce527ac70fdf6cbaefe0157275ee9ff8cec9520905dec2533c594c88fdf93e2b2d72a3b98b256f8f4079c89224a3f8dac3661d3a341c30d1662fa2196c358cd7af924d1145307bf307677208d2c6dbf3e7c01754018138da40aa941fd0d1b08eebd73636f636daf4a5aa91ba43c2515a5f9d9d8b4552cf4fba3254d711c6d1734481fb054d4fccf419fe248e1a1"}, 0x106, 0x2) ioctl$sock_bt_hci(r0, 0x400448e7, &(0x7f0000000140)="92d0e9a72dde512d2df78c2d52afedd418b7") 02:06:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000f01400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:58 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00J', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:58 executing program 1: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=""/213, &(0x7f0000000000)=""/61, &(0x7f0000000040)=""/124, 0x1}) bind$bt_hci(r1, &(0x7f0000000240), 0xc) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000180)={0x0, 0x4}) r3 = semget(0x2, 0x1, 0x798) semctl$SETVAL(r3, 0x0, 0x10, &(0x7f0000000140)=0x5) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f00000001c0)) close(r0) 02:06:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0xfc) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100), 0x111}}, 0x20) sendto$inet(r0, &(0x7f0000000040)="bbccb4e98f6ef898f7bd026f4ad2878f1665e876f115bfccee764153aeca2052afd93ca8c51401613d186f0f832b5f2c2bf7759b5ef547816fa932fbf0d3f96514fd75d837637966cb0ea18194fe6a2c941e91c6845e9a32", 0x58, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:58 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vhci\x00', 0x40, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000180)=0xc) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000440)=0x20) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000300)=0xc) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000), 0x13f, 0xe}}, 0x20) getgroups(0x1, &(0x7f0000000340)=[0x0]) lsetxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='system.posix_acl_default\x00', &(0x7f0000000380)={{}, {0x1, 0x5}, [{0x2, 0x3, r1}, {0x2, 0x4, r2}, {0x2, 0x2, r3}], {0x4, 0x5}, [{0x8, 0x1, r4}], {0x10, 0x3}, {0x20, 0x4}}, 0x44, 0x1) write$P9_RLERRORu(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="ff808950a62a7f63a176c1ef348fe36fa902ef45b992f3d13d55a424e14c156aedc82300647b75c4d2a775d9a070ab8fc77c9a7a85dbc0345808324c9ac70782284260e32dbfa98d22a375028451dba69cb1d9d76e88791d47b15ffdd7bb270d38c94f075e5034a16e32cec8facd0a41f5aab318f505199ac0c0216a6bd8707b63c2574cf4f16235b33964aa6fa975e0dfdbad998be9725889b74cb7bd56e982fbd94c7e8faa3cd4439e1905651af55c9e3e86a261e791affeb62756d8fad2163ae2fccba7bff43c2c24a8e3a1bc52031ad8996bb463135debe0cf55c9bd98a6bbc7414a83c5d10980a0037507cf3f8f1b8e9cb3069987946d3a5ec13a953ac27f7cc892c29091ab764b7bd99cd1729ca2fffb93fccc73eaeadceba1eb0c3f7bd3db9480fff35e79c430ca5d964fa22c211edfd39eba5532470ecea02dd660b4be1acbc25d8b29fe99c8cc9c4dc2a0f9301d69282a6c262eaf568d4cf6460000000000000000000000"], 0x2) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000240), 0xc) close(r0) 02:06:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0xffffffffffff0928, 0x4900) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[{0x7, 0x8}, {0x6, 0x1}, {}, {0x2, 0x2}], 0x4) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000140)="db6349f8150176198cfe604af77cd69e757cb6b8cd09a3371d2e5c55342f865de66f55e5f4543166fabb10f72aab9b13996ab20e0569e5e124ff6269d158966f5394f7cc3efefffc8d83548dcaad926c839fdd0c14badf97bc69bcdcb4d9a4f37ec5d930baac125daed8e2b383297ee3704367e6c525fe90b8396c53cb9c6431fdb200489d2e2349c337f88e970dbdf1f103147d2400d028757216b0cf475b0065d0c9e38eac18f8b5dfe873a85b5759655bbf13326e3c31b04a794e800b294cabb6b391316547fe039173a1cb841816219e53147fd019bdfbc34603581c", 0xfffffffffffffea7, 0x0, &(0x7f0000000240)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r1, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:58 executing program 2: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = socket(0xb, 0xffffffffffffffe, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000700)=ANY=[@ANYBLOB="0000004975c4416589c7590000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000500000000000000000065716c000000ff0300000000000000000000000000000000000000000000000065727370616e300000000000000000007465616d5f736c6176655f3100000000aaaaaaaaaabb000000000000aaaaaaaaaaaa0000000000000000e00000005001000088010000706b74747970650000000000000000000000000000000000000000000000000008000000000000000000000000000000636f6e6e627974657300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000015000300000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c2000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000191000000000000000000000000000000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00000000d2584ba5a793b909f1a628ed595e4681e932e3bef62684d04681b85aabb27ce6809fcaefb1465d5b5671a4efce454b6466d015ac5a168c51560fa7a41d76b815a346f03e4418dbce34d00b23088efe4ee3bfac2cf639e3458d410460102751e7bf1f79a5f0eafb2c9d85ed93aaf789b0bb43e2d127b564e40c3683de6b36930889b1324f992fde21178e142fd7b85c8eea2d"]}, 0x322) rt_sigtimedwait(&(0x7f00000000c0), 0x0, &(0x7f0000000180)={0x0, r0+10000000}, 0x8) 02:06:58 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) timerfd_gettime(r0, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth1\x00', 0x0}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f00000002c0)={r2, 0x7, 0x1, 0x6, 0xc2, 0x9, 0x5}) 02:06:58 executing program 1: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=""/213, &(0x7f0000000000)=""/61, &(0x7f0000000040)=""/124, 0x1}) bind$bt_hci(r1, &(0x7f0000000240), 0xc) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000180)={0x0, 0x4}) r3 = semget(0x2, 0x1, 0x798) semctl$SETVAL(r3, 0x0, 0x10, &(0x7f0000000140)=0x5) ioctl$BLKBSZGET(r0, 0x80081270, &(0x7f00000001c0)) close(r0) [ 327.322094] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:58 executing program 2: clone(0x8002102002004, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000040)) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000680)=@nat={'nat\x00', 0x19, 0x1, 0x218, [0x20000440, 0x0, 0x0, 0x20000470, 0x20000628], 0x0, &(0x7f0000000400), &(0x7f0000000440)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'eql\x00', '\x00', 'erspan0\x00', 'team_slave_1\x00', @remote, [], @local, [], 0xe0, 0x150, 0x188, [@pkttype={'pkttype\x00', 0x8}, @connbytes={'connbytes\x00', 0x18, {{0x0, 0x0, 0x3}}}]}, [@snat={'snat\x00', 0x10, {{@link_local}}}, @arpreply={'arpreply\x00', 0x10}]}, @arpreply={'arpreply\x00', 0x10, {{@remote}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe}]}, 0x290) rt_sigtimedwait(&(0x7f0000000100)={0xa81}, 0x0, &(0x7f0000000180)={0x77359400}, 0x8) [ 327.396608] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x400, 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x400, 0x0) read$FUSE(r1, &(0x7f0000001580), 0x1000) pread64(r0, &(0x7f0000000080)=""/1, 0x1, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) 02:06:58 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x00\v', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r1, 0x40012}], 0x1, 0xff) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="58000f001400add427323b470c458c5602067fffffff81004e220000e00000020b4824ca945f64009400050028925aa80000000000000080000efffe1b0000000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) 02:06:58 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000040)={0x3, 0xb7, 0x409, 0xffff, 0x0, 0x5a, 0x1000}, 0xc) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xfffffffffffffe36) close(r0) 02:06:58 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff90"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) 02:06:58 executing program 1: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) write$P9_RLERRORu(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="ff80"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) close(r0) timerfd_gettime(r0, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth1\x00', 0x0}) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f00000002c0)={r2, 0x7, 0x1, 0x6, 0xc2, 0x9, 0x5}) [ 327.630589] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:58 executing program 3: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x246, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000100)={0x6, {{0xa, 0x4e24, 0x0, @empty, 0xb87}}, {{0xa, 0x4e22, 0x2, @mcast1, 0x2}}}, 0x108) write$P9_RLERRORu(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="ff80e3c854041e6c181606086ea2eee6ed6289081a2a7e96a9c69c0017e5c967147e2f18f9e034629bd0afefe6d6f61d2e3b81c3bf13ecdc48821eca2035fa561ab7b8054941f986d1c413b23b3e051a25531128a18dc7b2ce259247e9a0f87e4d0ce4652e4e5f3320267bce"], 0x2) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240), 0xc) lstat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000380)='./file0\x00', 0xfffffffffffff800, 0x9, &(0x7f0000000a40)=[{&(0x7f00000003c0)="dc07970404274967fe58b49f7fd6d26549f741e90d3fe2bc660fe5c428f20e3612734b00e310cfd586d7964f66786ff3b7ab957481d217783a2a6a6ad8365339", 0x40, 0x9d3e}, {&(0x7f0000000400)="cb0e9c1e04578bb4752d582d7dbf41fa122406bc44b7d80e4ca7076903d13c5abf7ebd6a52cb35dc7c6ce07ba3642700e9f8306a3c92721de374b64996ff601604fbd18eebf2c267106131164097ae6fd95528b558aaa32bdc22711262496330d82ba7c05ec20bffc978de6a34e27ea2", 0x70, 0x5}, {&(0x7f0000000480)="b41140721803d5b4013497f100993adf907856794b2bb5608251c5729151174258a508d0783b8a729310b25aa0b3156193cae9db573b2b4070b2b35db41a896f38e2b56770d8da59a6b56d3045eec9350be280972b07b28fd1b50caa9309d34b9be9e5c4d12e95398a334fb90c7515c9829e4df9820a8e", 0x77, 0x2}, {&(0x7f0000000500)="4395552441c640f02ce40b3bbd5582c925291decd3e8e2624de2324b097719a25b56bc6b35f4d39a77772b714d7f84af90c45da4574bc3e303d100a50d5395414a85617c4cd74c04e0f89f827e17000d1f6b66d5c5e1ce60b908cfb9f2e1bff175fadd918e88630b44623fe9f3b7504b1c713f2bf3083b7976c89348d20cdcf31c726043f0923eddcb49ab7aa084ef173c825e8b085da0538499ba4b769078d15d4d91cc", 0xa4, 0x100000000}, {&(0x7f00000005c0)="8d246076aa894146014ec5476ed7a05e128dc0d991308d244aadf4fa0c625fdcc965ef684d085c9f13272047dd93d9b103070cceecf8c39110871ca6cc761473127c0d088398c257b383e51b71810d521ad941706ce33a57816af96411162162f9e3236028e13910cf464205a30d68d4a3955fd1bd2e22131d50e1bb0181b221dcdc629a9c40caaa17b139a95c3b54635cb69622dcc441b427214aba9a21671d7d474ceddffae24f634f872f4a6377b8d1509c715fcf848b4216b31329d3de5511e6167c296f0beabb06224d3f7563f0affb08242bbee7335d0c0db6d18711", 0xdf, 0x8}, {&(0x7f00000006c0)="cc246b36a304cb32a4ab0ac0818a5a65d34151f39fb49b9db51d047c6a93c55ef2fdcd9c2b1fefa0de4b95e5cf03a286acb358639829774703481f704fccd95aa96c8e7e90729cd583b42455f8671d5e48ceb817fcd449122acab19d42ec5f644e3cdd3c3d7c281e3c86056494506028a192cfee0e57af813467f3cdefa30336cd15afbd9539d4c3ca7f17136c93990b97a081a7219cab597a991a915e94dd9fafb93f2402718cb68e5cb5e5b0ae3586258e7b46467234908b0d70d1cc5fa57b123a3731b0ef70486b899f218be242043ba98f547c6b3a8620cd3a9b76c68f4ba36c6ea463964675dd556eb3416d38", 0xef, 0x5}, {&(0x7f00000007c0)="79b0c3e2745e8ccc82d01533f74010dfb67795659b7ea92c8b753ba47170169ba44db0bcac18e0edf02f2bb410b1aca783548f97dcf5f1657157ec7b60d8e08e5fd993969ce1024043ce79b5efd2da60bcc0190f24138dc22c1d4b3baa6c49d91e177508a33b917ac6a866a56f0c9c958e9488bb4383fb8f7d2b1baad14ebc03064bfdc9ab65db3edaa26fa2e195367d2e4fdf47f5b4a780d3", 0x99, 0x800000000}, {&(0x7f0000000880)="e5077cb99bf5ababc7a1eefe2f840b7ea126604b8ca031bf415bcbcfe8a12aa1d9c2ed3347f8ded9116061b7f441e2a6e7b1423843dfd293a53095c10692ab656cc381b4c47b150af0d2592078a25ac463996d33f4b15fc0bd4f606517f896b932d14edeae023fbdb1f600dad5cd141f980a816991c4853c5441fbaa011e9512ace86b89266ec49ff3f89f60fe1c05820d4989", 0x93, 0x1000}, {&(0x7f0000000940)="7b61a9a07df3711bd57c41a88283261f03c2c94392a4052dfe2a01d6c2fd88abe7cec7566ecc3d86b1f942b6724d71140cc2c280c925c5ece099eab7990fc0373243b18c37ad17c0ee7029e846fc6eaba4e49793af7a697dc58656c80679bfaec43298ffb8458081db7cfdea96541654771fe8c4e9dd6f9917e3c463c2c47537105a4ebd1be312c0afdbdd0ffc7ed8f3ed24272f056d124d5ce88aaec720b8103829a9d574d754456f11f581503a6a6a85d012c379d9561abf5b1c96b2116e0479f23c7456c12d4ad3a36a9fe5c0c1ed1ca6544c9ee2", 0xd6, 0x6}], 0x20012, &(0x7f0000000c00)={[], [{@permit_directio='permit_directio'}, {@fowner_gt={'fowner>', r2}}, {@pcr={'pcr', 0x3d, 0x32}}, {@subj_type={'subj_type', 0x3d, '/dev/vhci\x00'}}]}) close(r0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x101}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000280)={r3, 0x100, 0x3, 0xd1ab, 0x7fff, 0x9}, &(0x7f00000002c0)=0x14) 02:06:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0xffffffffffffffff, @loopback}, 0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x3, 'team_slave_0\x00', 0x2}, 0x18) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x20041, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f0000000100)={0x0, 0x5ee8}) ioctl$int_in(r0, 0x5452, &(0x7f0000000180)=0x7) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) socketpair(0x5, 0x5, 0x35, &(0x7f0000000040)) [ 327.700839] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 02:06:58 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='\x00\x00\x00\x003', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) 02:06:58 executing program 1: write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000480)={0x16, 0x98, 0xfa00, {&(0x7f0000000340), 0x2, 0xffffffffffffffff, 0x0, 0x0, @ib={0x1b, 0x0, 0x0, {"6d3a03a22ad13804238c25806cdd75ac"}}}}, 0xa0) fchmodat(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0x0) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x39, &(0x7f0000000a80), &(0x7f0000000580)=0x8) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x40, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='pids.current\x00', 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000240)=0x53, 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0x50, &(0x7f0000000680)}, 0xfffffffffffffe3c) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(0xffffffffffffffff, 0xc04c5349, &(0x7f0000000600)={0xfffffffffffff800, 0x73e, 0xff}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x200041, 0x0) chdir(&(0x7f00000002c0)='./file0/file0/file0\x00') r2 = socket$inet6(0xa, 0x200000000000001, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000280)={0x80000001, 0x0, 0x2, 0x100000000}) ioctl$DRM_IOCTL_SG_FREE(r1, 0x40106439, &(0x7f0000000300)={0x1, r3}) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000000540)=0x7, 0x4) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) io_cancel(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000000680)}, &(0x7f00000000c0)) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000700)=0x6, 0xffffffa5) setsockopt$inet_buf(r2, 0x0, 0x100000040, &(0x7f0000000040), 0x8) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000180)={0x0, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, {0x2, 0x4e24, @multicast2}, {0x2, 0x3ff, @multicast2}, 0x8, 0x0, 0x5, 0x8, 0x0, &(0x7f0000000140)='ip6tnl0\x00', 0x0, 0x8}) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r2, 0x84, 0x7, &(0x7f0000000380), &(0x7f0000000400)=0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @loopback}], 0x1c) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) syz_mount_image$hfsplus(&(0x7f0000000740)='hfsplus\x00', &(0x7f0000000780)='./file0\x00', 0xeb0, 0x5, &(0x7f0000000980)=[{&(0x7f00000007c0)="d1e5329f062ef20cf8ebc498164d086d0edd8c5f269378e6db9032f2cd92abef62ca2c2c58a3db22c120e2c993613e891d6be47866bf467b350e9e77fff9c147346aae78b8b4c9c405630ae05380140edceffe3d76e470bcae09edb251268b20da4faeaf9f44fe88c89b9f27dbb6e4c1465c28d2b75720ff471bc8c48043cede8936c263149fd63809c8b89eda62f233d3a7f86dbbdede36fa42e31236081aa7ec7520465e", 0xa5, 0x6}, {&(0x7f0000000880)="10299777c59af06b94a8c94b5fed2515335a798ce193f8cebe112daa1fd202900585f2007715a5026ac9f98a15e2608bca2ffdb675cfa7eacdee34105bc61aaa71dc7d93ed7137cb24e55931a7eb5a1899a8e51fd5eafab4e53b6556eec70dd3b75c6634130202088515855063ed4527", 0x70, 0x2}, {&(0x7f0000000900), 0x0, 0x20}, {&(0x7f0000000b80)="a4b355bbbdaf462fd0dfee545ecc5f6bb3d62d663cfaf917b4048441f4ed7fcc5a3e289e7b2e5453c2ec4837792a9c95b8b712f95ed95810fa8ef25061210e1531c389ba7b58c3abbc9aec15106d541c2f51d0c6fd893218d2c4c08bb61ef3f3f2f5656860e7db57b4248676a8275c703fb65ed7905c3b944cd95573feab8f14c2cdab16e574dde0887c1adf39149fa2bf36462f5ea376914efe0f469f9314e540f776e24a12a80b12010651c6d0cfb297152528466b6c9b7b3caeeafe2eaf66483641090e0704db1df7e812aa0bb50ac4850dd836b43604a203447887dd4585dc28b665dcda10e98a21500bb11993474c4637be0cb3925cbb1108025fde6bc4aab13dc652275172ae2831cb1846a90f12a26ddf1ae543ac112930fae60e31fe7e4f8fce7f12f4af9f2998648288b6609079e3fa83adcd5b81b5f841223ec3b2e3c02521d7ea387ea37374cde09313dca7ddb2eb85a7851b4e98bdae35f236e77e6ddbee32e10298d81940f59a5495f2ecb43c9ad20e5f930b7de88cd9b208b0f053c43bc68f99b179bd95047deb5ee03a4dee866694237c248704e37bd93b7a58a3f78d8b87752de96ffd5762675794280ed600190d75bcabe83a0f197e6fa9158948f8d03fd9277a5973a82ce141e66e62de2d7e2f4d623350f4e9e8097bc5345cfcd372261fcaac6b4fa465adf279df56b498f9d5a8cefab8cc70ddb3aa99cc3e47aed4b1b6fd26b49b1ee5c06936f3a768b396fa121e60e2388d9132f11beb90365a5051b067926b5bd7e54127caa6646f64b879c7d9ea0580872b8f5b6ebcf7aef7fd85b5537007065c2e6865c5b49a65abc67e561fb15e2ffccb6508b78ffc98709bccd755fb3ded1b7b945eeabeabd318e82bf9b69c5c5a34e21920f0311552b7c82762228054b462b67648c167034d22141e9f943f6b0df7258c018fa4c30869de293fe017119c1450cff66acc296af517bea047f2aafbb375555b4a8a8e7636e7f46529e0325fe33776eeae607360d9550bd42600d0cd7153bcf603b31a78c4a15b0fd5de4e2f2efe88ac3bfb7b8c5b76e9b86ec9bcb2ee377a9232705638ffaaa2e1bad001099241ac6541aef2678e1a404d323ad49e994c9526b26c35b076ba9ad62f1549f5e398463db5a0f9696c0f8756526bd6e4e3b42ac603f35dca4c3ec96351fb3b1131a1bed7a8b5f3b5baab90e270647909653b9a2d1077f161b8d317f10448e329474275741b5afddcb355de78e87f2b37d42aac93dd3a4d79532adcda98e035c1ddbd9979b16a150fd5659682e4d77995d7a079292b818c24240d4d9c4207b438ed8b3868a86c57ae8e1163458e78d4bfd10787b774d8a8179cd619567861339f95080b4847fec6284945478870a6c9be39964026df0225af2768eebc4de396d44b5db19d3051a2a0de58c5d7345ce331ab08390205def30917e3ec17a1dec71314558f0fba414656510d205e8ca30a102311b0567acaf7ea37cdf368c78cad7ccb7b8e7b94144b622ea508fd09800a33deed140c72129dccdc932e5202beba7a4990a7a3a659a8f6c321e6975e0ac7aceee54b58a3e6fca1896b618d08250097ee25a4d021b7dfa5f7b2e53552e78170ba7a339060ab91582c0505450b54da031c1551773a41a9b132ccf1b5c59e61bded6d190835a8180c0d5b1aeaf3ebddd6c440063fddc6e737eba3636d4ea136b0045393f0f7a504c7495ae8b940cb66ef3a666572751fabc0ffc8cfd0f3d5bb6782af29fb795d517ef170a76909c55b2b74afde018de35047c4460882fcb8f18dfad75f4141f35a0b7f0898a6ef46f8f7827afea4cf2e49e920d68434094bd97a8869b0d99949b77c3e4672493fbe02ed4799ff5fb7ee2bd03f42a11a6998591fd08871912faf8d0f0489b5dedb58b0393166994f08ed9ef943c54b9d1bbf70a8b2c423d913fc92a8a06502a1675f135aed9b4b8d06954e8bbccab993c7dcc49ae4844b563c5668555f9188144b9bdd640901b7e9315a14fd67b45b58b0e238bdb847dc556b980bf6f0fb3043b001af925fac44c1bd285dd2b89d3d8b4e6cf443115e6d16b6cf279f0b029568b531ca7df379c8af4af481b71c27d3d0386c033a19e7fa42acc399feeadca268b0299798251c28da658f6d27e387f28b41825a32cceed80a821908755511e34b89b0f1df18323f07ad98a2e81ce24d261ec305caff0a31727d7745e5bf3a2dfd953ceb6e8393b2f8d85f7100c285cee3f0097c3b8487bfdf61dc9d53392effeffdff6ca47d8225a2e3d14f6c67ca61ea3abe8a5b416a699e2efcf6b6dc2fdced7be2d285fe41d3de1a5a53e4b5c0c48f44726f366b9df2c558fe808658b032811f75598f1672ffe06b88b996fb688e929455cfbb521d0e29fccf26f09195065e166a5c824e5fea82af138ece17d7938e4d78ad9e78ab04e8a8bacae73e192a45b04f03e368b62e8ece95741e51f038e74f37a185f7270a295adb4cadbd216dde2512701f4f6b5f34835675cccbdc92680711e684063e255e837d9c7a83fe71e5771f591f72d32db6d06951f318b87f31ecc060f532ac2337acb25fec43049c8ef285b23f30647ca792283745ad8f0a21d251a46e1eac8f2c562add627069efd7a84c34f1eb62884dc2b224629942b1fba7ee8c667cdcc366963dddcf74ff70503033b60cd53f0f38cc77e5178d6164e639545d5befaf1b6c27d2d7912a270a044d4660b7d06bfca9b483cfc0c8faca9b1979952a1787042f90f997be20b0466aea448e0021eb6d16179bc86ab6dc33221d87130f467139fe7f41bb2e341978fbed60d39a39c3380b7ef64586b2f7adf22274e9e767b40d6be436ebd4b0da0483832c9cab87ae103b836fd9b462187a1dc05dd028662cc1cacd8e4c65c8fb1f4269b7a446304affe386e04f5417c089c0516c626b7de0e9e485f7095cf6ad203562b63d546ffb5b6e2c2d6a7b1416d5d4fbf5bfcc272aa7296a2c27222250f8bb4a6aeac98b4687f4bbc352c0ea63f5305a037e01dfc46c0b67ca2779737c8d3aab98cea599bbe470ff3826f9b1c2268f1435feb61707b28cb0125da551ba5efa2224c3e0efa1a8f4cc98d39916f80bfb0dca82e43f8f4b5e8652d708efc8e9c89b861e12ac3c2ae700e065fe88829b8129749fd06b8b8a9b130d52a59a92caae04f00c1151194f5359d22571eff9a9bc6d5d973e372c899009ff7c9e36e479cc677c04ff5a679579f39ecde63d3f6c99d952e8eec895d80d0ba95f6a4a687790881de01f8851ae70dd5b5d633c5c896dbb16561df13432a89d51c88e6d42063a105550cb21ac6eb879fa165a4c2e94706c043c347b7924b54978db279d81f4fae76b150f38865f2a7fdff8f3ffb4b800cd31eef008b0a40a72573ed5bf5c496d4fb322f1d40c7a3d75b9be3f32f3ad79fb0c8e0052bcf391225e2569fe4d511814c6752e1a93ae45b5e8580b355cdb314bc793e18d7ecdfe1ea9fb440305d0b34741bb6d46c8dd0d10aab4704aa0c391b727ed9aef6fa3c025deafdafef9d3cbb4e08175107ac45713f924df06fe780302624bfbc06c85772630645099f9fdf603cd1567aa34d63d14d8bf459901809246fda61c875e9625728a5ced9783a957de68520ada35acefa8d31315477d8a94189c2c2691c14f2eb1998a927db45777ce8eb08fe0293fb09ee3d87a851b3429aff93db8802f1853ee64cfc63551b2189d08afc3e38cb5a725232d3d3f179fb558b8947b3bf9502cb9cc45c1ee1ef721b872771e3a08932bebc2ac5695481d9bd9b21fa0d2bdf0ff347e15b4ed532810303860fefcad2a1fbf8cda3a7fd4224c0ed3939d59c1bd1971dd0a7b5b2e17259b35901e28157389c2706ae6a7f8362bb6c6439b31b3d344d8372428ecd7db6f2a85cd8656d4e0a2f94bd7619d2488e701b296987cc207746a709e769965f89b27c6433b9c6961520ff9c97a49a4f40ac185b154f7f5935c8febe0af0d83c91b1864105358b2469705d889e56f3204d3cc7e39bd9564d1c0fdfb79aea8112b8f8524ad7d3fe115a801d70a798b2771c4d565cde8bc69ba48af1b820e5fffe79ca6b4f9981f15a80bf2bb4b0c05a2eb8c6a85f77858bc99c151848e77a6b6a828d238d71ccdea692e871730811d788bb3370e8f68526db0317db45019989c832df0297e404c40766afa4bd962e282c395156c6ddc78206374989ab378bc74ce09b723e3cb23b8ec3cf86ad00a2f142ee557892599cfcd1fe6e101462943f06685ded9b717a8acf048fd9677561b9a51d67cb8861f43496503011fb4d6afee3d9dae77e1b12c2b07bc5cc37bd4d275964462bba7d1ba6a677ffb0b3dcd801a583b4c7df3f81cd402a307445c2b4fd114804306feffc2fc726b75b4b388de42feb9b34df4493859bce4b922da80ac20142ef2d01f6eeac5583bd96528a373891d7491eacd771c92a7ce206f611b10df912e994dd081f7b63b1b964ea9e38faff9caf5bc90d1ae05ac4294659ad6f4314bc0c4ff5f69de1d181bc711a9ae3674f05a41e89e6f92921e4f15552ed634cdc633272ee1fe70649464cfc9110eb4959a619dc42f51682dc78898c5d8f3905c2927c14b9e1ec473e5a5083d2bbf282635e657cea760a163f80ba98d57dc72608c3f38fd798ad499ab25c7134a64a943aa810fddb782cd6e682490dc5934aad13a4b7041143a72e944799a673ed702ea9a3179f3d9cfe62df42af066f2e4c6b6450e028f1824abf019dbdb2b6c49032a403f05108c54d3a39f6cb74d1651ac672a006c4ae5700c3fcd2655589873e5a5bc3cf4350bbcd74b176834a3df71486794dff9433ec56cb0ef37ba011e6f9ed9fbaa92a9a029343d4e41f4203418169482c5492e7a25367fc5a93d0e1342e71fc1d0e5727d9f4af3c619f3d28b35d5a739c5bf0fd05ad94cdace6a97648ed51c696ce721c60114197086201bd517b0a02104e7943d880e01ef190d273c7faa3984fc6099686b082ea26dbc38bf4937b4d96df4e637face519476bff9a7f078f68d7d69b63ec5cb4a03a670a0762de76dd8bfed7cb92fa331e300bf445415a979dbf26e530c37f35f263ce36a716deb31d0f2bb9f8ca99d0514d52b369035d52c3c23e8baa7c0d09c391771538188e35401bdf88c30d09e39a6a08b6c23c540e904d8774dfb129c13fc2ae9d12c6be87be91ef79c06c5273fcb13737270608ba0a3e05cec3b5b9a6f54f67b162d6e40b3593eb091a96325a6a9c3f6a8a8125b154d36133d77b27ef2647ecb178ebf63fc4eb3a104e16764a22f9f7e1b75febef31ccbaf8d86edec801bfb3eccb2746e674b03b9b8a3bdb7503506d5c9fe65c6aa6a16c17766eb8dba44847ea7fd31b0f6f949fbbf0246882149697f66e7f6bd270e1b559256ca8ceda1aacbedd0dcbd3f29b5ab4bb4af2a5fafd37082ae2bc281ce76841cce215d6bb97cc59837e471d3a09d3d0d72d1abd9042e7a0f299a94211727c162002d0c9510bd6383120295616b742161447b597cc2002bbcb82acc8ed6109aaf0efe3f065e367de4a1ce967a3575198b886efbe08d979227a82e5683ad6211d16cecf31b6abc7a65563616d0afa5707511e74cb34a2f22e760309981f25f4f3de67d06c51260110cf955798615b980f9ae83f24c18b9d6648b7365203942e8adc1b8b37c0b64425e8dbe6652d2160eee52f39ddcb7d6fd5d3b514e6912ddad59e1d7fb069129260ae215f94970b4443b9c9c6a5363819291eae55171c7dfbb785e4d394f3b3c3b0a9bbc9ef7edce2a26ed2f1667bb0b41", 0x1000, 0x7}, {&(0x7f0000000940)="d6724cc9c89ae6cfee459a5fcbe386b60b", 0x11, 0x80000000}], 0x2, &(0x7f0000000a00)=ANY=[@ANYBLOB='force,force,ses\t\x00\x00\x00\x00\x00\x00\x0000000000001,permit_directio,rootcontext=user_u,\x00\x00\x00\x00\x00']) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) faccessat(0xffffffffffffffff, &(0x7f0000000440)='./file0/file0/file0\x00', 0x0, 0x100) 02:06:58 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r0, &(0x7f0000000300), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000008c0), 0x0, 0x0, &(0x7f0000000540)={0x2, 0x0, @broadcast}, 0x10) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x480000, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f0000000480)=0x100000001, 0x4) readv(r1, &(0x7f0000000000)=[{&(0x7f0000000580)=""/4096, 0x1000}], 0x1) r2 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x65, 0x81ffe) recvfrom$unix(r2, &(0x7f0000000080)=""/8, 0x8, 0x100, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e22}, 0x6e) [ 327.875940] ================================================================== [ 327.883607] BUG: KASAN: use-after-free in kobject_put+0xcb/0xe0 [ 327.889706] Read of size 1 at addr ffff88017d4c1d0c by task syz-executor3/11847 [ 327.897157] [ 327.898818] CPU: 0 PID: 11847 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #69 [ 327.906108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 327.915470] Call Trace: [ 327.915499] dump_stack+0x1c4/0x2b4 [ 327.915525] ? dump_stack_print_info.cold.2+0x52/0x52 [ 327.915543] ? printk+0xa7/0xcf [ 327.915564] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 327.915594] ? vhci_close_dev+0x50/0x50 [ 327.926975] print_address_description.cold.8+0x9/0x1ff [ 327.926995] ? vhci_close_dev+0x50/0x50 [ 327.927011] kasan_report.cold.9+0x242/0x309 [ 327.927024] ? kobject_put+0xcb/0xe0 [ 327.927047] __asan_report_load1_noabort+0x14/0x20 [ 327.944619] hfsplus: unable to parse mount options [ 327.948382] kobject_put+0xcb/0xe0 [ 327.948401] ? vhci_close_dev+0x50/0x50 [ 327.948417] put_device+0x20/0x30 [ 327.948433] hci_free_dev+0x19/0x20 [ 327.948450] vhci_release+0x7e/0xf0 [ 327.948466] __fput+0x385/0xa30 [ 327.948489] ? get_max_files+0x20/0x20 [ 327.992562] ? trace_hardirqs_on+0xbd/0x310 [ 327.992578] ? kasan_check_read+0x11/0x20 [ 327.992594] ? task_work_run+0x1af/0x2a0 [ 327.992611] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 327.992628] ? kasan_check_write+0x14/0x20 [ 327.992684] ? do_raw_spin_lock+0xc1/0x200 [ 328.001145] ____fput+0x15/0x20 [ 328.001163] task_work_run+0x1e8/0x2a0 [ 328.001183] ? task_work_cancel+0x240/0x240 [ 328.001205] ? copy_fd_bitmaps+0x210/0x210 [ 328.001221] ? do_syscall_64+0x9a/0x820 [ 328.001242] exit_to_usermode_loop+0x318/0x380 [ 328.010772] ? syscall_slow_exit_work+0x520/0x520 [ 328.010789] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 328.010820] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 328.010865] do_syscall_64+0x6be/0x820 [ 328.010895] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 328.010932] ? syscall_return_slowpath+0x5e0/0x5e0 [ 328.010964] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 328.019421] ? trace_hardirqs_on_caller+0x310/0x310 [ 328.019439] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 328.019459] ? prepare_exit_to_usermode+0x291/0x3b0 [ 328.019482] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 328.019507] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 328.019521] RIP: 0033:0x457569 [ 328.019540] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 328.026693] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 328.026709] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000457569 [ 328.026717] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 328.026727] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 328.026736] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 328.026745] R13: 00000000004ef912 R14: 00000000004cc460 R15: 00000000ffffffff [ 328.026769] [ 328.026790] Allocated by task 11850: [ 328.026826] save_stack+0x43/0xd0 [ 328.026849] kasan_kmalloc+0xc7/0xe0 [ 328.026868] kmem_cache_alloc_trace+0x152/0x750 [ 328.035407] hci_alloc_dev+0x228/0x2120 [ 328.035422] __vhci_create_device+0x102/0x580 [ 328.035435] vhci_write+0x2de/0x470 [ 328.035450] __vfs_write+0x6b8/0x9f0 [ 328.035464] vfs_write+0x1fc/0x560 [ 328.035478] ksys_write+0x101/0x260 [ 328.035492] __x64_sys_write+0x73/0xb0 [ 328.035518] do_syscall_64+0x1b9/0x820 [ 328.035532] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 328.035536] [ 328.035542] Freed by task 11847: [ 328.035554] save_stack+0x43/0xd0 [ 328.035583] __kasan_slab_free+0x102/0x150 [ 328.235740] kasan_slab_free+0xe/0x10 [ 328.239549] kfree+0xcf/0x230 [ 328.242675] bt_host_release+0x19/0x30 [ 328.246574] device_release+0x7e/0x210 [ 328.250473] kobject_put.cold.9+0x287/0x2e4 [ 328.254804] put_device+0x20/0x30 [ 328.258266] hci_unregister_dev+0x71d/0x990 [ 328.262596] vhci_release+0x76/0xf0 [ 328.266225] __fput+0x385/0xa30 [ 328.269522] ____fput+0x15/0x20 [ 328.272809] task_work_run+0x1e8/0x2a0 [ 328.276710] exit_to_usermode_loop+0x318/0x380 [ 328.281300] do_syscall_64+0x6be/0x820 [ 328.285198] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 328.290393] [ 328.292034] The buggy address belongs to the object at ffff88017d4c0c40 [ 328.292034] which belongs to the cache kmalloc-8192 of size 8192 [ 328.304888] The buggy address is located 4300 bytes inside of [ 328.304888] 8192-byte region [ffff88017d4c0c40, ffff88017d4c2c40) [ 328.316972] The buggy address belongs to the page: [ 328.321907] page:ffffea0005f53000 count:1 mapcount:0 mapping:ffff8801da802080 index:0x0 compound_mapcount: 0 [ 328.331897] flags: 0x2fffc0000008100(slab|head) [ 328.336583] raw: 02fffc0000008100 ffffea0006dc4b08 ffff8801da801b48 ffff8801da802080 [ 328.344475] raw: 0000000000000000 ffff88017d4c0c40 0000000100000001 0000000000000000 [ 328.352355] page dumped because: kasan: bad access detected [ 328.358061] [ 328.359695] Memory state around the buggy address: [ 328.364633] ffff88017d4c1c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 328.372005] ffff88017d4c1c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 328.379371] >ffff88017d4c1d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 328.386728] ^ [ 328.390360] ffff88017d4c1d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 328.397748] ffff88017d4c1e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 328.405107] ================================================================== [ 328.412491] Disabling lock debugging due to kernel taint [ 328.424013] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 328.426278] Kernel panic - not syncing: panic_on_warn set ... [ 328.426278] [ 328.439465] CPU: 1 PID: 11847 Comm: syz-executor3 Tainted: G B 4.19.0-rc8+ #69 [ 328.448128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 328.457482] Call Trace: [ 328.460084] dump_stack+0x1c4/0x2b4 [ 328.463725] ? dump_stack_print_info.cold.2+0x52/0x52 [ 328.468925] ? vhci_close_dev+0x50/0x50 [ 328.472904] panic+0x238/0x4e7 [ 328.476107] ? add_taint.cold.5+0x16/0x16 [ 328.480266] ? preempt_schedule+0x4d/0x60 [ 328.484426] ? ___preempt_schedule+0x16/0x18 [ 328.488866] ? trace_hardirqs_on+0xb4/0x310 [ 328.493204] ? vhci_close_dev+0x50/0x50 [ 328.493967] kobject: 'loop5' (0000000069099610): kobject_uevent_env [ 328.497192] kasan_end_report+0x47/0x4f [ 328.497208] kasan_report.cold.9+0x76/0x309 [ 328.497220] ? kobject_put+0xcb/0xe0 [ 328.497239] __asan_report_load1_noabort+0x14/0x20 [ 328.503835] kobject: 'loop5' (0000000069099610): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 328.507624] kobject_put+0xcb/0xe0 [ 328.507640] ? vhci_close_dev+0x50/0x50 [ 328.507666] put_device+0x20/0x30 [ 328.507684] hci_free_dev+0x19/0x20 [ 328.544596] vhci_release+0x7e/0xf0 [ 328.548259] __fput+0x385/0xa30 [ 328.551580] ? get_max_files+0x20/0x20 [ 328.555478] ? trace_hardirqs_on+0xbd/0x310 [ 328.559823] ? kasan_check_read+0x11/0x20 [ 328.563980] ? task_work_run+0x1af/0x2a0 [ 328.568054] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 328.573514] ? kasan_check_write+0x14/0x20 [ 328.577774] ? do_raw_spin_lock+0xc1/0x200 [ 328.582114] ____fput+0x15/0x20 [ 328.585402] task_work_run+0x1e8/0x2a0 [ 328.589305] ? task_work_cancel+0x240/0x240 [ 328.593636] ? copy_fd_bitmaps+0x210/0x210 [ 328.597888] ? do_syscall_64+0x9a/0x820 [ 328.601911] exit_to_usermode_loop+0x318/0x380 [ 328.606527] ? syscall_slow_exit_work+0x520/0x520 [ 328.611387] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 328.616940] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 328.622491] do_syscall_64+0x6be/0x820 [ 328.626387] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 328.631764] ? syscall_return_slowpath+0x5e0/0x5e0 [ 328.636704] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 328.641562] ? trace_hardirqs_on_caller+0x310/0x310 [ 328.646588] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 328.651617] ? prepare_exit_to_usermode+0x291/0x3b0 [ 328.656668] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 328.661536] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 328.666733] RIP: 0033:0x457569 [ 328.669945] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 328.688852] RSP: 002b:00007f486e07bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 328.696564] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000457569 [ 328.703838] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 328.711107] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 328.718381] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f486e07c6d4 [ 328.725669] R13: 00000000004ef912 R14: 00000000004cc460 R15: 00000000ffffffff [ 328.733992] Kernel Offset: disabled [ 328.737619] Rebooting in 86400 seconds..