&(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 765.118416][T25972] input: syz1 as /devices/virtual/input/input4466 [ 765.231245][ T26] audit: type=1804 audit(1574053099.411:1783): pid=25971 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/574/file0" dev="sda1" ino=17161 res=1 [ 765.288048][T25971] input: syz1 as /devices/virtual/input/input4468 04:58:19 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) 04:58:19 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r1, 0x1, &(0x7f0000000140)) r2 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r4 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r6 = fcntl$getown(r5, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r6, r4, 0x0, 0x0, 0x0}, 0x30) r7 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r8 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r7, r8, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r9 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r9, 0x80080080044df9, &(0x7f0000000040)) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r10, 0x0, &(0x7f0000000100)) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = accept(r11, 0x0, &(0x7f0000000300)) r13 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r14, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r14, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r14, 0x5501, 0x0) r15 = socket$inet(0x2, 0x6, 0x0) bind$inet(r15, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r16 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r17 = socket$inet(0x2, 0x6, 0x0) bind$inet(r17, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r18, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r18, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r18, 0x5501, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r20, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r20, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r20, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r21, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r12, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r10, r13, r14, 0xffffffffffffffff, r15, r16]}}, @rights={{0x20, 0x1, 0x1, [r17, r9, r18, r19]}}, @cred={{0x1c, 0x1, 0x2, {r21, r22, r23}}}], 0x68}, 0xc034) r24 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r24, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r25 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r25, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r26 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r26, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 765.390562][T25982] input: syz1 as /devices/virtual/input/input4470 [ 765.464382][T25971] input: syz1 as /devices/virtual/input/input4471 04:58:19 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r3 = fcntl$getown(r2, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r3, r1, 0x0, 0x0, 0x0}, 0x30) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r5 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r5, 0x80080080044df9, &(0x7f0000000040)) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r6, 0x0, &(0x7f0000000100)) r7 = socket$inet(0x2, 0x6, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r7, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r8, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r8, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r8, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r10 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={0xffffffffffffffff, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 765.687858][ T26] audit: type=1804 audit(1574053099.871:1784): pid=25995 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/645/file0" dev="sda1" ino=17147 res=1 04:58:19 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 765.775750][ T26] audit: type=1804 audit(1574053099.871:1785): pid=25990 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/645/file0" dev="sda1" ino=17147 res=1 [ 765.847739][T25990] input: syz1 as /devices/virtual/input/input4473 [ 765.914394][ T26] audit: type=1804 audit(1574053100.021:1786): pid=25994 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/662/file0" dev="sda1" ino=17148 res=1 04:58:20 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 765.964055][T26003] input: syz1 as /devices/virtual/input/input4476 [ 765.982322][T25994] input: syz1 as /devices/virtual/input/input4475 [ 766.034506][T25997] input: syz1 as /devices/virtual/input/input4479 [ 766.037467][T25990] input: syz1 as /devices/virtual/input/input4477 [ 766.242329][T26009] input: syz1 as /devices/virtual/input/input4481 04:58:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={0xffffffffffffffff, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 04:58:20 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r3 = fcntl$getown(r2, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r3, r1, 0x0, 0x0, 0x0}, 0x30) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r5 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r5, 0x80080080044df9, &(0x7f0000000040)) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r6, 0x0, &(0x7f0000000100)) r7 = socket$inet(0x2, 0x6, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r7, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r8, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r8, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r8, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r10 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={0xffffffffffffffff, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 766.494345][ T26] audit: type=1804 audit(1574053100.671:1787): pid=26019 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/575/file0" dev="sda1" ino=17249 res=1 04:58:20 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0x0, 0x0}, 0x10) [ 766.620823][T26019] input: syz1 as /devices/virtual/input/input4483 04:58:20 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r1, 0x1, &(0x7f0000000140)) r2 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r4 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r6 = fcntl$getown(r5, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r6, r4, 0x0, 0x0, 0x0}, 0x30) r7 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r8 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r7, r8, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r9 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r9, 0x80080080044df9, &(0x7f0000000040)) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r10, 0x0, &(0x7f0000000100)) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = accept(r11, 0x0, &(0x7f0000000300)) r13 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r14, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r14, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r14, 0x5501, 0x0) r15 = socket$inet(0x2, 0x6, 0x0) bind$inet(r15, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r16 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r17 = socket$inet(0x2, 0x6, 0x0) bind$inet(r17, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r18, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r18, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r18, 0x5501, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r20, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r20, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r20, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r21, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r12, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r10, r13, r14, 0xffffffffffffffff, r15, r16]}}, @rights={{0x20, 0x1, 0x1, [r17, r9, r18, r19]}}, @cred={{0x1c, 0x1, 0x2, {r21, r22, r23}}}], 0x68}, 0xc034) r24 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r24, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r25 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r25, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r26 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r26, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 766.689793][T26020] input: syz1 as /devices/virtual/input/input4485 [ 766.796824][T26031] input: syz1 as /devices/virtual/input/input4486 04:58:21 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:21 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0x0, 0x0}, 0x10) [ 767.050618][ T26] audit: type=1804 audit(1574053101.231:1788): pid=26047 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/646/file0" dev="sda1" ino=17110 res=1 04:58:21 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r1, 0x1, &(0x7f0000000140)) r2 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r4 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r6 = fcntl$getown(r5, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r6, r4, 0x0, 0x0, 0x0}, 0x30) r7 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r8 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r7, r8, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r9 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r9, 0x80080080044df9, &(0x7f0000000040)) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r10, 0x0, &(0x7f0000000100)) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = accept(r11, 0x0, &(0x7f0000000300)) r13 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r14, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r14, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r14, 0x5501, 0x0) r15 = socket$inet(0x2, 0x6, 0x0) bind$inet(r15, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r16 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r17 = socket$inet(0x2, 0x6, 0x0) bind$inet(r17, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r18, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r18, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r18, 0x5501, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r20, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r20, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r20, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r21, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r12, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r10, r13, r14, 0xffffffffffffffff, r15, r16]}}, @rights={{0x20, 0x1, 0x1, [r17, r9, r18, r19]}}, @cred={{0x1c, 0x1, 0x2, {r21, r22, r23}}}], 0x68}, 0xc034) r24 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r24, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r25 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r25, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r26 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r26, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") socket$isdn(0x22, 0x3, 0x24) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 767.140118][T26044] input: syz1 as /devices/virtual/input/input4488 04:58:21 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r3 = fcntl$getown(r2, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r3, r1, 0x0, 0x0, 0x0}, 0x30) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r5 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r5, 0x80080080044df9, &(0x7f0000000040)) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r6, 0x0, &(0x7f0000000100)) r7 = socket$inet(0x2, 0x6, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r7, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r8, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r8, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r8, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r10 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 767.353756][T26042] input: syz1 as /devices/virtual/input/input4490 [ 767.413804][T26045] input: syz1 as /devices/virtual/input/input4492 04:58:21 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0x0, 0x0}, 0x10) [ 767.492673][ T26] audit: type=1804 audit(1574053101.671:1789): pid=26059 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/576/file0" dev="sda1" ino=17117 res=1 04:58:21 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x0) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 767.534975][T26052] input: syz1 as /devices/virtual/input/input4493 [ 767.607011][ T26] audit: type=1804 audit(1574053101.731:1790): pid=26058 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/576/file0" dev="sda1" ino=17117 res=1 [ 767.680520][T26058] input: syz1 as /devices/virtual/input/input4495 [ 767.790749][T26059] input: syz1 as /devices/virtual/input/input4497 04:58:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 767.879590][T26076] input: syz1 as /devices/virtual/input/input4498 04:58:22 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r1, 0x1, &(0x7f0000000140)) r2 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r4 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r6 = fcntl$getown(r5, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r6, r4, 0x0, 0x0, 0x0}, 0x30) r7 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r8 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r7, r8, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r9 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r9, 0x80080080044df9, &(0x7f0000000040)) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r10, 0x0, &(0x7f0000000100)) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = accept(r11, 0x0, &(0x7f0000000300)) r13 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r14, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r14, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r14, 0x5501, 0x0) r15 = socket$inet(0x2, 0x6, 0x0) bind$inet(r15, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r16 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r17 = socket$inet(0x2, 0x6, 0x0) bind$inet(r17, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r18, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r18, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r18, 0x5501, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r20, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r20, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r20, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r21, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r12, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r10, r13, r14, 0xffffffffffffffff, r15, r16]}}, @rights={{0x20, 0x1, 0x1, [r17, r9, r18, r19]}}, @cred={{0x1c, 0x1, 0x2, {r21, r22, r23}}}], 0x68}, 0xc034) r24 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r24, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r25 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r25, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r26 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r26, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:22 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 768.015019][T26075] input: syz1 as /devices/virtual/input/input4500 04:58:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 04:58:22 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r1, 0x1, &(0x7f0000000140)) r2 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r4 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r6 = fcntl$getown(r5, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r6, r4, 0x0, 0x0, 0x0}, 0x30) r7 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r8 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r7, r8, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r9 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r9, 0x80080080044df9, &(0x7f0000000040)) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r10, 0x0, &(0x7f0000000100)) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = accept(r11, 0x0, &(0x7f0000000300)) r13 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r14, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r14, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r14, 0x5501, 0x0) r15 = socket$inet(0x2, 0x6, 0x0) bind$inet(r15, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r16 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r17 = socket$inet(0x2, 0x6, 0x0) bind$inet(r17, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r18, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r18, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r18, 0x5501, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r20, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r20, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r20, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r21, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r12, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r10, r13, r14, 0xffffffffffffffff, r15, r16]}}, @rights={{0x20, 0x1, 0x1, [r17, r9, r18, r19]}}, @cred={{0x1c, 0x1, 0x2, {r21, r22, r23}}}], 0x68}, 0xc034) r24 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r24, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r25 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r25, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r26 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r26, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") socket$isdn(0x22, 0x3, 0x24) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:22 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r3 = fcntl$getown(r2, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r3, r1, 0x0, 0x0, 0x0}, 0x30) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r5 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r5, 0x80080080044df9, &(0x7f0000000040)) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r6, 0x0, &(0x7f0000000100)) r7 = socket$inet(0x2, 0x6, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r7, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r8, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r8, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r8, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r10 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 768.388781][ T26] audit: type=1804 audit(1574053102.571:1791): pid=26087 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/647/file0" dev="sda1" ino=17100 res=1 04:58:22 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 768.446044][T26089] input: syz1 as /devices/virtual/input/input4502 04:58:22 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x0) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 768.629362][T26087] input: syz1 as /devices/virtual/input/input4504 04:58:23 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 768.844082][T26106] input: syz1 as /devices/virtual/input/input4506 [ 768.868560][T26093] input: syz1 as /devices/virtual/input/input4505 [ 768.874797][T26098] input: syz1 as /devices/virtual/input/input4507 [ 768.977045][T26099] input: syz1 as /devices/virtual/input/input4511 [ 769.019774][T26112] input: syz1 as /devices/virtual/input/input4510 04:58:23 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:23 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r3 = fcntl$getown(r2, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r3, r1, 0x0, 0x0, 0x0}, 0x30) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r5 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r5, 0x80080080044df9, &(0x7f0000000040)) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r6, 0x0, &(0x7f0000000100)) r7 = socket$inet(0x2, 0x6, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r7, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r8, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r8, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r8, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r10 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 769.435872][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 769.435893][ T26] audit: type=1804 audit(1574053103.611:1795): pid=26123 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir451960367/syzkaller.8vRdNE/625/file0" dev="sda1" ino=17121 res=1 04:58:23 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x0) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 769.488370][T26125] input: syz1 as /devices/virtual/input/input4514 [ 769.504878][ T26] audit: type=1804 audit(1574053103.661:1796): pid=26129 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/648/file0" dev="sda1" ino=17329 res=1 04:58:23 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 769.598982][T26128] input: syz1 as /devices/virtual/input/input4515 [ 769.631622][T26129] input: syz1 as /devices/virtual/input/input4517 04:58:23 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\xeb') sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f0000000640)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x140002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x14c80) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_gettime(0x0, &(0x7f0000000080)) [ 769.738607][T26123] input: syz1 as /devices/virtual/input/input4519 [ 769.752928][T26132] input: syz1 as /devices/virtual/input/input4521 [ 769.984275][T26144] input: syz1 as /devices/virtual/input/input4522 04:58:24 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 770.154225][ T26] audit: type=1804 audit(1574053104.341:1797): pid=26146 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/665/file0" dev="sda1" ino=17174 res=1 04:58:24 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r1, 0x1, &(0x7f0000000140)) r2 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r4 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r6 = fcntl$getown(r5, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r6, r4, 0x0, 0x0, 0x0}, 0x30) r7 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r8 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r7, r8, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r9 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r9, 0x80080080044df9, &(0x7f0000000040)) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r10, 0x0, &(0x7f0000000100)) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = accept(r11, 0x0, &(0x7f0000000300)) r13 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r14, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r14, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r14, 0x5501, 0x0) r15 = socket$inet(0x2, 0x6, 0x0) bind$inet(r15, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r16 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r17 = socket$inet(0x2, 0x6, 0x0) bind$inet(r17, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r18, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r18, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r18, 0x5501, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r20, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r20, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r20, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r21, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r12, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r10, r13, r14, 0xffffffffffffffff, r15, r16]}}, @rights={{0x20, 0x1, 0x1, [r17, r9, r18, r19]}}, @cred={{0x1c, 0x1, 0x2, {r21, r22, r23}}}], 0x68}, 0xc034) r24 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r24, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r25 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r25, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r26 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r26, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") socket$isdn(0x22, 0x3, 0x24) socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:24 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r1, 0x1, &(0x7f0000000140)) r2 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r4 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r6 = fcntl$getown(r5, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r6, r4, 0x0, 0x0, 0x0}, 0x30) r7 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r8 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r7, r8, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r9 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r9, 0x80080080044df9, &(0x7f0000000040)) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r10, 0x0, &(0x7f0000000100)) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = accept(r11, 0x0, &(0x7f0000000300)) r13 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r14, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r14, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r14, 0x5501, 0x0) r15 = socket$inet(0x2, 0x6, 0x0) bind$inet(r15, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r16 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r17 = socket$inet(0x2, 0x6, 0x0) bind$inet(r17, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r18, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r18, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r18, 0x5501, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r20, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r20, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r20, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r21, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r12, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r10, r13, r14, 0xffffffffffffffff, r15, r16]}}, @rights={{0x20, 0x1, 0x1, [r17, r9, r18, r19]}}, @cred={{0x1c, 0x1, 0x2, {r21, r22, r23}}}], 0x68}, 0xc034) r24 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r24, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r25 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r25, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r26 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r26, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") socket$isdn(0x22, 0x3, 0x24) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 770.267548][T26146] input: syz1 as /devices/virtual/input/input4524 [ 770.311132][T26158] input: syz1 as /devices/virtual/input/input4525 [ 770.317183][T26151] input: syz1 as /devices/virtual/input/input4527 04:58:24 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:24 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x0) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:24 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:25 executing program 2: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 770.800108][T26167] input: syz1 as /devices/virtual/input/input4529 [ 770.861042][T26176] input: syz1 as /devices/virtual/input/input4530 [ 770.964634][ T26] audit: type=1804 audit(1574053105.101:1798): pid=26170 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/579/file0" dev="sda1" ino=17117 res=1 [ 770.968643][T26167] input: syz1 as /devices/virtual/input/input4533 [ 771.025217][T26182] input: syz1 as /devices/virtual/input/input4535 [ 771.048270][T26170] input: syz1 as /devices/virtual/input/input4534 [ 771.162128][T26174] input: syz1 as /devices/virtual/input/input4539 04:58:25 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 771.203805][T26192] input: syz1 as /devices/virtual/input/input4537 [ 771.312210][T26190] input: syz1 as /devices/virtual/input/input4540 04:58:25 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:25 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r1, 0x1, &(0x7f0000000140)) r2 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r4 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r6 = fcntl$getown(r5, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r6, r4, 0x0, 0x0, 0x0}, 0x30) r7 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r8 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r7, r8, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r9 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r9, 0x80080080044df9, &(0x7f0000000040)) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r10, 0x0, &(0x7f0000000100)) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = accept(r11, 0x0, &(0x7f0000000300)) r13 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r14 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r14, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r14, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r14, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r14, 0x5501, 0x0) r15 = socket$inet(0x2, 0x6, 0x0) bind$inet(r15, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r16 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r17 = socket$inet(0x2, 0x6, 0x0) bind$inet(r17, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r18 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r18, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r18, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r18, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r18, 0x5501, 0x0) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r20, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r20, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r20, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r21, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r12, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r10, r13, r14, 0xffffffffffffffff, r15, r16]}}, @rights={{0x20, 0x1, 0x1, [r17, r9, r18, r19]}}, @cred={{0x1c, 0x1, 0x2, {r21, r22, r23}}}], 0x68}, 0xc034) r24 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r24, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r25 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r25, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r26 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r26, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") socket$isdn(0x22, 0x3, 0x24) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:25 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 771.681958][T26204] input: syz1 as /devices/virtual/input/input4543 [ 771.692693][T26209] input: syz1 as /devices/virtual/input/input4544 04:58:25 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:26 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\xeb') sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f0000000640)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x140002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x14c80) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) timer_gettime(r1, &(0x7f0000000080)) 04:58:26 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:26 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r3 = fcntl$getown(r2, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r3, r1, 0x0, 0x0, 0x0}, 0x30) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r5 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r5, 0x80080080044df9, &(0x7f0000000040)) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r6, 0x0, &(0x7f0000000100)) r7 = socket$inet(0x2, 0x6, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r7, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r8, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r8, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r8, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r10 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 772.205735][ T26] audit: type=1804 audit(1574053106.391:1799): pid=26218 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/580/file0" dev="sda1" ino=17168 res=1 [ 772.246522][T26221] input: syz1 as /devices/virtual/input/input4547 [ 772.309363][ T26] audit: type=1804 audit(1574053106.431:1800): pid=26217 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir451960367/syzkaller.8vRdNE/627/file0" dev="sda1" ino=17164 res=1 04:58:26 executing program 2: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 772.350548][T26223] input: syz1 as /devices/virtual/input/input4548 [ 772.380154][T26217] input: syz1 as /devices/virtual/input/input4549 [ 772.398917][T26240] input: syz1 as /devices/virtual/input/input4550 [ 772.489691][T26239] input: syz1 as /devices/virtual/input/input4555 [ 772.508158][T26222] input: syz1 as /devices/virtual/input/input4553 [ 772.511047][T26228] input: syz1 as /devices/virtual/input/input4557 [ 772.529363][ T26] audit: type=1804 audit(1574053106.431:1801): pid=26223 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/650/file0" dev="sda1" ino=17177 res=1 [ 772.572443][T26218] input: syz1 as /devices/virtual/input/input4556 04:58:27 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r3 = fcntl$getown(r2, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r3, r1, 0x0, 0x0, 0x0}, 0x30) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r5 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r5, 0x80080080044df9, &(0x7f0000000040)) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r6, 0x0, &(0x7f0000000100)) r7 = socket$inet(0x2, 0x6, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r7, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r8, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r8, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r8, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r10 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 772.871866][T26251] input: syz1 as /devices/virtual/input/input4560 04:58:27 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 773.064125][T26259] input: syz1 as /devices/virtual/input/input4562 04:58:27 executing program 0: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 773.177854][T26260] input: syz1 as /devices/virtual/input/input4564 [ 773.338744][T26266] input: syz1 as /devices/virtual/input/input4566 04:58:27 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:27 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:27 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r3 = fcntl$getown(r2, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r3, r1, 0x0, 0x0, 0x0}, 0x30) r4 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r4, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r5 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r5, 0x80080080044df9, &(0x7f0000000040)) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r6, 0x0, &(0x7f0000000100)) r7 = socket$inet(0x2, 0x6, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r7, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r8 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r8, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r8, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r8, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r8, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r10 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r10, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:27 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:28 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:28 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 773.969909][T26272] input: syz1 as /devices/virtual/input/input4568 [ 773.978422][ T26] audit: type=1804 audit(1574053108.151:1802): pid=26274 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/581/file0" dev="sda1" ino=17148 res=1 [ 774.016939][T26276] input: syz1 as /devices/virtual/input/input4570 [ 774.104490][T26281] input: syz1 as /devices/virtual/input/input4569 [ 774.297653][T26285] input: syz1 as /devices/virtual/input/input4573 04:58:28 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 774.353694][ T26] audit: type=1804 audit(1574053108.521:1803): pid=26283 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/669/file0" dev="sda1" ino=17184 res=1 [ 774.382923][T26274] input: syz1 as /devices/virtual/input/input4576 04:58:28 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 774.485520][ T26] audit: type=1804 audit(1574053108.621:1804): pid=26293 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/652/file0" dev="sda1" ino=17191 res=1 04:58:28 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 774.559883][T26283] input: syz1 as /devices/virtual/input/input4577 [ 774.568532][T26293] input: syz1 as /devices/virtual/input/input4578 [ 774.677897][T26297] input: syz1 as /devices/virtual/input/input4580 [ 774.838059][T26308] input: syz1 as /devices/virtual/input/input4582 04:58:29 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 774.922920][T26283] input: syz1 as /devices/virtual/input/input4583 [ 775.059916][T26312] input: syz1 as /devices/virtual/input/input4585 [ 775.110056][ T26] audit: type=1804 audit(1574053109.291:1805): pid=26307 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir451960367/syzkaller.8vRdNE/629/file0" dev="sda1" ino=17193 res=1 [ 775.193807][T26307] input: syz1 as /devices/virtual/input/input4587 04:58:29 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:29 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 775.320351][T26311] input: syz1 as /devices/virtual/input/input4589 [ 775.407299][ T26] audit: type=1804 audit(1574053109.591:1806): pid=26324 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/582/file0" dev="sda1" ino=17195 res=1 [ 775.510699][T26324] input: syz1 as /devices/virtual/input/input4590 04:58:29 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 775.584798][T26325] input: syz1 as /devices/virtual/input/input4592 [ 775.608982][ T26] audit: type=1804 audit(1574053109.791:1807): pid=26333 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/653/file0" dev="sda1" ino=17186 res=1 [ 775.619957][T26334] input: syz1 as /devices/virtual/input/input4593 04:58:29 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 775.865168][T26330] input: syz1 as /devices/virtual/input/input4594 04:58:30 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 775.957783][T26333] input: syz1 as /devices/virtual/input/input4597 [ 776.017572][T26342] input: syz1 as /devices/virtual/input/input4598 04:58:30 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:30 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 776.232596][ T26] audit: type=1804 audit(1574053110.411:1808): pid=26348 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/670/file0" dev="sda1" ino=17075 res=1 04:58:30 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 776.325084][T26350] input: syz1 as /devices/virtual/input/input4600 [ 776.434518][ T26] audit: type=1804 audit(1574053110.621:1809): pid=26355 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir451960367/syzkaller.8vRdNE/630/file0" dev="sda1" ino=17125 res=1 [ 776.484058][T26348] input: syz1 as /devices/virtual/input/input4602 [ 776.551657][T26364] input: syz1 as /devices/virtual/input/input4604 04:58:30 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 776.601695][T26355] input: syz1 as /devices/virtual/input/input4603 [ 776.683512][T26356] input: syz1 as /devices/virtual/input/input4608 [ 776.762569][T26363] input: syz1 as /devices/virtual/input/input4609 04:58:31 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 776.860890][T26362] input: syz1 as /devices/virtual/input/input4606 [ 776.987596][T26362] input: syz1 as /devices/virtual/input/input4612 04:58:31 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:31 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 777.286168][ T26] audit: type=1804 audit(1574053111.471:1810): pid=26380 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/654/file0" dev="sda1" ino=17190 res=1 [ 777.287140][T26386] input: syz1 as /devices/virtual/input/input4613 04:58:31 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 777.353429][T26382] input: syz1 as /devices/virtual/input/input4614 04:58:31 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 777.600355][T26380] input: syz1 as /devices/virtual/input/input4617 [ 777.615631][ T26] audit: type=1804 audit(1574053111.801:1811): pid=26402 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/671/file0" dev="sda1" ino=17204 res=1 [ 777.688466][ T26] audit: type=1804 audit(1574053111.831:1812): pid=26394 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/671/file0" dev="sda1" ino=17204 res=1 [ 777.759974][T26394] input: syz1 as /devices/virtual/input/input4618 04:58:32 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 777.801364][T26400] input: syz1 as /devices/virtual/input/input4619 [ 777.846688][T26392] input: syz1 as /devices/virtual/input/input4620 [ 777.861008][ T26] audit: type=1804 audit(1574053111.911:1813): pid=26396 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir451960367/syzkaller.8vRdNE/631/file0" dev="sda1" ino=17203 res=1 [ 777.944618][T26396] input: syz1 as /devices/virtual/input/input4623 [ 778.053931][T26394] input: syz1 as /devices/virtual/input/input4625 [ 778.206606][T26410] input: syz1 as /devices/virtual/input/input4626 04:58:32 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 778.251067][T26419] input: syz1 as /devices/virtual/input/input4627 [ 778.335799][T26409] input: syz1 as /devices/virtual/input/input4630 04:58:32 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:32 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:32 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 778.699739][T26426] input: syz1 as /devices/virtual/input/input4631 [ 778.745334][T26429] input: syz1 as /devices/virtual/input/input4632 [ 778.778352][T26430] input: syz1 as /devices/virtual/input/input4634 04:58:33 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:33 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 779.074500][T26440] input: syz1 as /devices/virtual/input/input4636 04:58:33 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 779.227624][T26438] input: syz1 as /devices/virtual/input/input4638 04:58:33 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:33 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 779.448369][T26434] input: syz1 as /devices/virtual/input/input4640 [ 779.502443][T26455] input: syz1 as /devices/virtual/input/input4641 [ 779.533287][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 779.533397][ T26] audit: type=1804 audit(1574053113.711:1817): pid=26447 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/585/file0" dev="sda1" ino=16546 res=1 [ 779.672674][T26447] input: syz1 as /devices/virtual/input/input4643 [ 779.732863][T26451] input: syz1 as /devices/virtual/input/input4646 [ 779.746243][T26452] input: syz1 as /devices/virtual/input/input4644 [ 779.767584][ T26] audit: type=1804 audit(1574053113.781:1818): pid=26452 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/672/file0" dev="sda1" ino=16657 res=1 [ 779.828193][T26461] input: syz1 as /devices/virtual/input/input4648 [ 779.840474][T26456] input: syz1 as /devices/virtual/input/input4649 [ 779.848454][ T26] audit: type=1804 audit(1574053113.811:1819): pid=26462 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/656/file0" dev="sda1" ino=16769 res=1 04:58:34 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 779.889923][T26462] input: syz1 as /devices/virtual/input/input4651 [ 779.942256][T26469] input: syz1 as /devices/virtual/input/input4652 04:58:34 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:34 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:34 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 780.364977][T26482] input: syz1 as /devices/virtual/input/input4654 [ 780.503118][ T26] audit: type=1804 audit(1574053114.681:1820): pid=26486 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir451960367/syzkaller.8vRdNE/633/file0" dev="sda1" ino=16929 res=1 [ 780.597309][T26486] input: syz1 as /devices/virtual/input/input4656 [ 780.683963][T26496] input: syz1 as /devices/virtual/input/input4657 [ 780.708215][T26488] input: syz1 as /devices/virtual/input/input4659 04:58:34 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:35 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) r32 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) ioctl$BLKPG(r32, 0x1269, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000800)}) [ 780.804322][ T26] audit: type=1804 audit(1574053114.991:1821): pid=26495 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/586/file0" dev="sda1" ino=16977 res=1 04:58:35 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 780.934889][T26491] input: syz1 as /devices/virtual/input/input4661 [ 780.950672][ T26] audit: type=1804 audit(1574053115.031:1822): pid=26491 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/586/file0" dev="sda1" ino=16977 res=1 [ 781.036658][T26495] input: syz1 as /devices/virtual/input/input4663 04:58:35 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 781.270662][T26507] input: syz1 as /devices/virtual/input/input4664 04:58:35 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 781.313605][T26509] input: syz1 as /devices/virtual/input/input4665 [ 781.332645][ T26] audit: type=1804 audit(1574053115.511:1823): pid=26504 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/657/file0" dev="sda1" ino=16673 res=1 [ 781.431614][ T26] audit: type=1804 audit(1574053115.561:1824): pid=26508 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/673/file0" dev="sda1" ino=16657 res=1 [ 781.432378][T26514] input: syz1 as /devices/virtual/input/input4666 [ 781.462849][T26504] input: syz1 as /devices/virtual/input/input4668 [ 781.485415][T26521] input: syz1 as /devices/virtual/input/input4669 [ 781.576892][T26508] input: syz1 as /devices/virtual/input/input4671 04:58:35 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:36 executing program 4: vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 781.917698][ T26] audit: type=1804 audit(1574053116.101:1825): pid=26528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir451960367/syzkaller.8vRdNE/634/file0" dev="sda1" ino=16737 res=1 [ 781.985914][T26528] input: syz1 as /devices/virtual/input/input4674 [ 782.063587][T26532] input: syz1 as /devices/virtual/input/input4676 04:58:36 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 782.142309][T26540] input: syz1 as /devices/virtual/input/input4677 [ 782.234737][T26535] input: syz1 as /devices/virtual/input/input4678 04:58:36 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) r32 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) ioctl$BLKPG(r32, 0x1269, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000800)}) 04:58:36 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 782.407068][T26549] input: syz1 as /devices/virtual/input/input4681 04:58:36 executing program 4: vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 782.615463][ T26] audit: type=1804 audit(1574053116.801:1826): pid=26556 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/674/file0" dev="sda1" ino=16881 res=1 04:58:36 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:36 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 782.738932][T26558] input: syz1 as /devices/virtual/input/input4683 [ 782.848685][T26552] input: syz1 as /devices/virtual/input/input4684 04:58:37 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 782.933197][T26556] input: syz1 as /devices/virtual/input/input4688 [ 782.955578][T26557] input: syz1 as /devices/virtual/input/input4686 04:58:37 executing program 4: vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 783.262235][T26566] input: syz1 as /devices/virtual/input/input4691 [ 783.336337][T26568] input: syz1 as /devices/virtual/input/input4693 [ 783.422262][T26579] input: syz1 as /devices/virtual/input/input4694 [ 783.438735][T26576] input: syz1 as /devices/virtual/input/input4695 04:58:37 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 783.588087][T26585] input: syz1 as /devices/virtual/input/input4697 04:58:37 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 783.722361][T26576] input: syz1 as /devices/virtual/input/input4700 04:58:38 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 783.828357][T26593] input: syz1 as /devices/virtual/input/input4701 04:58:38 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 783.981165][T26592] input: syz1 as /devices/virtual/input/input4703 04:58:38 executing program 4: accept$unix(0xffffffffffffffff, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 784.203589][T26610] input: syz1 as /devices/virtual/input/input4704 [ 784.247276][T26598] input: syz1 as /devices/virtual/input/input4705 04:58:38 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) r32 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) ioctl$BLKPG(r32, 0x1269, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000800)}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 784.290818][T26599] input: syz1 as /devices/virtual/input/input4707 04:58:38 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:38 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 784.647353][T26609] input: syz1 as /devices/virtual/input/input4709 [ 784.693086][T26618] input: syz1 as /devices/virtual/input/input4710 [ 784.717715][T26611] input: syz1 as /devices/virtual/input/input4712 [ 784.871897][T26631] input: syz1 as /devices/virtual/input/input4714 04:58:39 executing program 2: memfd_create(&(0x7f0000000000)='/dew/vga\xc6\xa5L[iter\x00;+7\xaaz\x1d\xbcO!/\x12\b\xf0C\x00\x00 \x00\x00\x00\x00\x00\x00\x00\xdf\x00\x00\x00\x00\x00\x00\x00\x00_\x9a\xaa\x94\xc8\x90\xb0\xfd\xb4', 0x6) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff3fffffffffff, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_bt_cmtp_CMTPCONNDEL(0xffffffffffffffff, 0x400443c9, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl(r1, 0x4122, 0x0) bind$inet(r1, &(0x7f00005d5ff3), 0x10) sendto$inet(r0, 0x0, 0x0, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000defffc), 0x4) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-net\x00', 0x2, 0x0) preadv(r2, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/50, 0x32}], 0x1, 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000440)=ANY=[@ANYRES16=r2], 0x1) r3 = memfd_create(&(0x7f0000ee4000)='/dev/vga_arbiter\x00', 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') sendfile(r3, r4, 0x0, 0x401) r5 = socket$inet6(0xa, 0x3, 0x6) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x810, r5, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000080)={@loopback, 0x800, 0x0, 0x100000003, 0x1, 0x0, 0x0, 0x400000000}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000300)={@mcast2, 0x10000, 0x0, 0x102, 0x8000003}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x0, 0x0, 0x1, 0x3}, 0x20) connect$inet6(r5, &(0x7f0000000500)={0xa, 0x0, 0x40f7, @mcast2, 0x7ff}, 0x9) r6 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f0000000240)=0x202, 0x4000000000dc) syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') ioctl$KVM_S390_UCAS_UNMAP(r6, 0x4018ae51, &(0x7f00000000c0)={0x8000, 0x7ff, 0x2}) r7 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl(r7, 0x4122, 0x0) r8 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl(r8, 0x4122, 0x0) sendmsg$NBD_CMD_RECONFIGURE(r6, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xfffffdc7, &(0x7f00000004c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r7, @ANYPTR=&(0x7f00000005c0)=ANY=[@ANYPTR64=&(0x7f00000006c0)=ANY=[@ANYRESHEX=r0, @ANYPTR, @ANYRESDEC, @ANYPTR64, @ANYRES64=0x0, @ANYRES32=0x0]]], 0x3}, 0x1, 0x0, 0x0, 0x8000}, 0x8040) r9 = memfd_create(&(0x7f0000ee4000)='/dev/vga_arbiter\x00', 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') sendfile(r9, r10, 0x0, 0x401) r11 = memfd_create(&(0x7f0000ee4000)='/dev/vga_arbiter\x00', 0x0) r12 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') sendfile(r11, r12, 0x0, 0x401) r13 = memfd_create(&(0x7f0000ee4000)='/dev/vga_arbiter\x00', 0x0) r14 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') sendfile(r13, r14, 0x0, 0x401) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x202, 0x0) syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0xb7, 0x80000) r15 = socket$inet6(0xa, 0x3, 0x6) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x810, r15, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r15, 0x29, 0x20, &(0x7f0000000080)={@loopback, 0x800, 0x0, 0x100000003, 0x1, 0x0, 0x0, 0x400000000}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r15, 0x29, 0x20, &(0x7f0000000300)={@mcast2, 0x10000, 0x0, 0x102, 0x8000003}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r15, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x0, 0x0, 0x1, 0x3}, 0x20) connect$inet6(r15, &(0x7f0000000500)={0xa, 0x0, 0x40f7, @mcast2, 0x7ff}, 0x9) r16 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r15, r16, &(0x7f0000000240)=0x202, 0x4000000000dc) r17 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') ioctl$KVM_S390_UCAS_UNMAP(r16, 0x4018ae51, &(0x7f00000000c0)={0x8000, 0x7ff, 0x2}) sendmsg$NBD_CMD_RECONFIGURE(r16, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r17, 0xc05, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x8040) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xc14020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, r17, 0x10, 0x70bd2b, 0x25dfdbfd}, 0x123}, 0x1, 0x0, 0x0, 0xc056}, 0x4004080) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x5, 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000340)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa120001ed34a5448f1a073627bc43780419924f019a98cd571103d4a5d8c3815918ea56f5d7c920f392da99003a829aa55836a9fa38316497ea766bf75f039a2c869faa573c408969004b2b1e26242f05935d84f5b70328e06a6a24d069e642f68a7d14df4addeef3ed6bfa2355c6fe005ca28c1be3ac21b7a16111cce445f9fd5479b83bcabed77f6e6682cf5e7249e95c835bada6ed67726cc5043b3d053f1701e8ec037ebf92a083683715a857330387ce298edacd602d81ff8eb7c6ca1a2a1b493dcca10137008126d8e7"], 0x0) [ 784.952223][T26626] input: syz1 as /devices/virtual/input/input4715 [ 784.957685][ T26] kauditd_printk_skb: 6 callbacks suppressed [ 784.957704][ T26] audit: type=1804 audit(1574053119.121:1833): pid=26628 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/660/file0" dev="sda1" ino=16785 res=1 04:58:39 executing program 4: accept$unix(0xffffffffffffffff, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 785.100698][T26628] input: syz1 as /devices/virtual/input/input4717 [ 785.111877][ T26] audit: type=1804 audit(1574053119.181:1834): pid=26623 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/589/file0" dev="sda1" ino=16530 res=1 [ 785.147581][T26634] input: syz1 as /devices/virtual/input/input4719 [ 785.147908][T26623] input: syz1 as /devices/virtual/input/input4720 04:58:39 executing program 5: memfd_create(&(0x7f0000000000)='/dew/vga\xc6\xa5L[iter\x00;+7\xaaz\x1d\xbcO!/\x12\b\xf0C\x00\x00 \x00\x00\x00\x00\x00\x00\x00\xdf\x00\x00\x00\x00\x00\x00\x00\x00_\x9a\xaa\x94\xc8\x90\xb0\xfd\xb4', 0x6) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff3fffffffffff, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_bt_cmtp_CMTPCONNDEL(0xffffffffffffffff, 0x400443c9, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl(r1, 0x4122, 0x0) bind$inet(r1, &(0x7f00005d5ff3), 0x10) sendto$inet(r0, 0x0, 0x0, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000defffc), 0x4) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-net\x00', 0x2, 0x0) preadv(r2, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/50, 0x32}], 0x1, 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000440)=ANY=[@ANYRES16=r2], 0x1) r3 = memfd_create(&(0x7f0000ee4000)='/dev/vga_arbiter\x00', 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') sendfile(r3, r4, 0x0, 0x401) r5 = socket$inet6(0xa, 0x3, 0x6) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x810, r5, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000080)={@loopback, 0x800, 0x0, 0x100000003, 0x1, 0x0, 0x0, 0x400000000}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000300)={@mcast2, 0x10000, 0x0, 0x102, 0x8000003}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x0, 0x0, 0x1, 0x3}, 0x20) connect$inet6(r5, &(0x7f0000000500)={0xa, 0x0, 0x40f7, @mcast2, 0x7ff}, 0x9) r6 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r5, r6, &(0x7f0000000240)=0x202, 0x4000000000dc) syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') ioctl$KVM_S390_UCAS_UNMAP(r6, 0x4018ae51, &(0x7f00000000c0)={0x8000, 0x7ff, 0x2}) r7 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl(r7, 0x4122, 0x0) r8 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl(r8, 0x4122, 0x0) sendmsg$NBD_CMD_RECONFIGURE(r6, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xfffffdc7, &(0x7f00000004c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r7, @ANYPTR=&(0x7f00000005c0)=ANY=[@ANYPTR64=&(0x7f00000006c0)=ANY=[@ANYRESHEX=r0, @ANYPTR, @ANYRESDEC, @ANYPTR64, @ANYRES64=0x0, @ANYRES32=0x0]]], 0x3}, 0x1, 0x0, 0x0, 0x8000}, 0x8040) r9 = memfd_create(&(0x7f0000ee4000)='/dev/vga_arbiter\x00', 0x0) r10 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') sendfile(r9, r10, 0x0, 0x401) r11 = memfd_create(&(0x7f0000ee4000)='/dev/vga_arbiter\x00', 0x0) r12 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') sendfile(r11, r12, 0x0, 0x401) r13 = memfd_create(&(0x7f0000ee4000)='/dev/vga_arbiter\x00', 0x0) r14 = syz_open_procfs(0x0, &(0x7f0000000000)='net/sockstat6\x00') sendfile(r13, r14, 0x0, 0x401) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x202, 0x0) syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0xb7, 0x80000) r15 = socket$inet6(0xa, 0x3, 0x6) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x810, r15, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r15, 0x29, 0x20, &(0x7f0000000080)={@loopback, 0x800, 0x0, 0x100000003, 0x1, 0x0, 0x0, 0x400000000}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r15, 0x29, 0x20, &(0x7f0000000300)={@mcast2, 0x10000, 0x0, 0x102, 0x8000003}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r15, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x0, 0x0, 0x1, 0x3}, 0x20) connect$inet6(r15, &(0x7f0000000500)={0xa, 0x0, 0x40f7, @mcast2, 0x7ff}, 0x9) r16 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r15, r16, &(0x7f0000000240)=0x202, 0x4000000000dc) r17 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') ioctl$KVM_S390_UCAS_UNMAP(r16, 0x4018ae51, &(0x7f00000000c0)={0x8000, 0x7ff, 0x2}) sendmsg$NBD_CMD_RECONFIGURE(r16, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r17, 0xc05, 0x70bd27, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x8040) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xc14020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, r17, 0x10, 0x70bd2b, 0x25dfdbfd}, 0x123}, 0x1, 0x0, 0x0, 0xc056}, 0x4004080) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x5, 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000340)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa120001ed34a5448f1a073627bc43780419924f019a98cd571103d4a5d8c3815918ea56f5d7c920f392da99003a829aa55836a9fa38316497ea766bf75f039a2c869faa573c408969004b2b1e26242f05935d84f5b70328e06a6a24d069e642f68a7d14df4addeef3ed6bfa2355c6fe005ca28c1be3ac21b7a16111cce445f9fd5479b83bcabed77f6e6682cf5e7249e95c835bada6ed67726cc5043b3d053f1701e8ec037ebf92a083683715a857330387ce298edacd602d81ff8eb7c6ca1a2a1b493dcca10137008126d8e7"], 0x0) 04:58:39 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 785.535503][T26656] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 785.568491][T26653] input: syz1 as /devices/virtual/input/input4722 [ 785.781931][T26661] input: syz1 as /devices/virtual/input/input4724 04:58:40 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) r32 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) ioctl$BLKPG(r32, 0x1269, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000800)}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:40 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:40 executing program 4: accept$unix(0xffffffffffffffff, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:40 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:40 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 786.228868][ T26] audit: type=1804 audit(1574053120.411:1835): pid=26665 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir429391430/syzkaller.wG7C2m/590/file0" dev="sda1" ino=16817 res=1 [ 786.248616][T26674] input: syz1 as /devices/virtual/input/input4726 [ 786.284447][T26673] input: syz1 as /devices/virtual/input/input4727 [ 786.365198][T26670] input: syz1 as /devices/virtual/input/input4730 [ 786.408478][T26665] input: syz1 as /devices/virtual/input/input4731 04:58:40 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 786.440188][ T26] audit: type=1804 audit(1574053120.491:1836): pid=26670 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/661/file0" dev="sda1" ino=16593 res=1 [ 786.515683][T26671] input: syz1 as /devices/virtual/input/input4733 04:58:40 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 786.659879][ T26] audit: type=1804 audit(1574053120.761:1837): pid=26679 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/677/file0" dev="sda1" ino=17144 res=1 [ 786.764455][T26685] input: syz1 as /devices/virtual/input/input4734 [ 786.784150][T26679] input: syz1 as /devices/virtual/input/input4735 [ 786.875061][T26682] input: syz1 as /devices/virtual/input/input4738 04:58:41 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 787.070969][T26693] input: syz1 as /devices/virtual/input/input4739 04:58:41 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 787.167814][T26699] input: syz1 as /devices/virtual/input/input4741 04:58:41 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 787.219755][T26706] input: syz1 as /devices/virtual/input/input4742 04:58:41 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 787.311953][ T26] audit: type=1804 audit(1574053121.491:1838): pid=26704 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/662/file0" dev="sda1" ino=17224 res=1 [ 787.381459][T26704] input: syz1 as /devices/virtual/input/input4745 04:58:41 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:41 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 787.655335][T26713] input: syz1 as /devices/virtual/input/input4746 [ 787.715723][ T26] audit: type=1804 audit(1574053121.881:1839): pid=26716 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir136013735/syzkaller.n2BcoC/678/file0" dev="sda1" ino=17129 res=1 04:58:42 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 787.864442][T26723] input: syz1 as /devices/virtual/input/input4748 [ 787.913545][T26716] input: syz1 as /devices/virtual/input/input4749 [ 788.050325][T26716] input: syz1 as /devices/virtual/input/input4752 04:58:42 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 788.131945][T26730] input: syz1 as /devices/virtual/input/input4753 [ 788.219019][ T26] audit: type=1804 audit(1574053122.391:1840): pid=26741 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/663/file0" dev="sda1" ino=16641 res=1 04:58:42 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 788.267373][T26741] input: syz1 as /devices/virtual/input/input4755 [ 788.306832][ T26] audit: type=1804 audit(1574053122.421:1841): pid=26733 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir451960367/syzkaller.8vRdNE/639/file0" dev="sda1" ino=16593 res=1 [ 788.328643][T26733] input: syz1 as /devices/virtual/input/input4756 04:58:42 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 788.451385][T26739] input: syz1 as /devices/virtual/input/input4758 [ 788.581398][T26733] input: syz1 as /devices/virtual/input/input4760 [ 788.614083][T26751] input: syz1 as /devices/virtual/input/input4761 04:58:42 executing program 2: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:43 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 788.875623][T26759] input: syz1 as /devices/virtual/input/input4763 [ 788.918112][T26757] input: syz1 as /devices/virtual/input/input4765 [ 788.948452][T26766] input: syz1 as /devices/virtual/input/input4766 04:58:43 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) r32 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) ioctl$BLKPG(r32, 0x1269, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000800)}) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:43 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 789.170646][ T26] audit: type=1804 audit(1574053123.351:1842): pid=26773 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/664/file0" dev="sda1" ino=17225 res=1 [ 789.187276][T26773] input: syz1 as /devices/virtual/input/input4769 04:58:43 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 789.356304][T26772] input: syz1 as /devices/virtual/input/input4771 04:58:43 executing program 1: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) r32 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) ioctl$BLKPG(r32, 0x1269, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000800)}) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) [ 789.589648][T26788] input: syz1 as /devices/virtual/input/input4772 04:58:43 executing program 2 (fault-call:4 fault-nth:0): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 789.658549][T26777] input: syz1 as /devices/virtual/input/input4773 [ 789.734168][T26787] input: syz1 as /devices/virtual/input/input4774 [ 789.874480][T26779] input: syz1 as /devices/virtual/input/input4778 [ 789.889106][T26799] FAULT_INJECTION: forcing a failure. [ 789.889106][T26799] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 789.946695][T26799] CPU: 1 PID: 26799 Comm: syz-executor.2 Not tainted 5.4.0-rc7+ #0 [ 789.954732][T26799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 789.964887][T26799] Call Trace: [ 789.968883][T26799] dump_stack+0x11d/0x181 [ 789.973295][T26799] should_fail.cold+0xa/0x1a [ 789.977946][T26799] should_fail_alloc_page+0x50/0x60 [ 789.983179][T26799] __alloc_pages_nodemask+0xd2/0x310 [ 789.988700][T26799] alloc_pages_vma+0x2a6/0x3a0 [ 789.993498][T26799] do_huge_pmd_anonymous_page+0x2ca/0xfe0 [ 789.999236][T26799] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 790.005024][T26799] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 790.011440][T26799] __handle_mm_fault+0x1aca/0x2c70 [ 790.016597][T26799] handle_mm_fault+0x21b/0x530 [ 790.021494][T26799] __do_page_fault+0x456/0x8d0 [ 790.026362][T26799] do_page_fault+0x38/0x194 [ 790.031096][T26799] page_fault+0x34/0x40 [ 790.035344][T26799] RIP: 0010:__put_user_4+0x1c/0x30 [ 790.040751][T26799] Code: 1f 00 c3 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 1c 25 40 6c 01 00 48 8b 9b 18 0b 00 00 48 83 eb 03 48 39 d9 73 3f 0f 1f 00 <89> 01 31 c0 0f 1f 00 c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 [ 790.060456][T26799] RSP: 0018:ffffc90000e33b88 EFLAGS: 00010297 [ 790.066545][T26799] RAX: 0000000000000027 RBX: 00007fffffffeffd RCX: 0000000020d30b88 [ 790.074530][T26799] RDX: 0000000000000000 RSI: ffffffff814ba427 RDI: ffffc90000d69010 [ 790.082518][T26799] RBP: ffffc90000e33d20 R08: 0000000000000000 R09: 0000c90000d69010 [ 790.090579][T26799] R10: 00008880a27a9eb0 R11: 0000c90000d69013 R12: ffff8880a27a9e00 [ 790.094204][T26794] input: syz1 as /devices/virtual/input/input4779 [ 790.098554][T26799] R13: 0000000000000027 R14: 0000000000000001 R15: ffffc90000d69000 [ 790.098596][T26799] ? bpf_prog_get_info_by_fd.isra.0+0x1817/0x1a60 [ 790.098662][T26799] ? bpf_prog_get_info_by_fd.isra.0+0x1831/0x1a60 [ 790.125948][T26799] ? mntput+0x66/0x90 [ 790.130212][T26799] bpf_obj_get_info_by_fd+0x16d/0x4b0 [ 790.135735][T26799] ? __read_once_size.constprop.0+0x12/0x20 [ 790.141648][T26799] ? check_stack_object+0xda/0x110 [ 790.146870][T26799] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 790.152835][T26799] ? __check_object_size+0x5f/0x346 [ 790.158063][T26799] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 790.165755][T26799] __do_sys_bpf+0x109f/0x2b90 [ 790.170562][T26799] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 790.176885][T26799] ? __sb_end_write+0xbe/0x100 [ 790.181703][T26799] __x64_sys_bpf+0x4c/0x60 [ 790.186111][T26799] do_syscall_64+0xcc/0x370 [ 790.190710][T26799] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 790.197993][T26799] RIP: 0033:0x45a639 [ 790.201878][T26799] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 790.221778][T26799] RSP: 002b:00007f6fef225c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 790.221796][T26799] RAX: ffffffffffffffda RBX: 00007f6fef225c90 RCX: 000000000045a639 [ 790.221805][T26799] RDX: 0000000000000010 RSI: 0000000020000280 RDI: 000000000000000f 04:58:44 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 790.221814][T26799] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 790.221823][T26799] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6fef2266d4 [ 790.221832][T26799] R13: 00000000004c0b15 R14: 00000000004d3318 R15: 0000000000000005 [ 790.292714][T26798] input: syz1 as /devices/virtual/input/input4781 04:58:44 executing program 2 (fault-call:4 fault-nth:1): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 04:58:44 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 790.561598][T26813] FAULT_INJECTION: forcing a failure. [ 790.561598][T26813] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 790.580185][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 790.580206][ T26] audit: type=1804 audit(1574053124.761:1847): pid=26809 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/665/file0" dev="sda1" ino=17225 res=1 [ 790.590123][T26813] CPU: 1 PID: 26813 Comm: syz-executor.2 Not tainted 5.4.0-rc7+ #0 [ 790.618880][T26813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 790.628941][T26813] Call Trace: [ 790.632255][T26813] dump_stack+0x11d/0x181 [ 790.636676][T26813] should_fail.cold+0xa/0x1a [ 790.641349][T26813] should_fail_alloc_page+0x50/0x60 [ 790.646565][T26813] __alloc_pages_nodemask+0xd2/0x310 [ 790.651916][T26813] alloc_pages_current+0xd1/0x170 [ 790.657033][T26813] pte_alloc_one+0x18/0x50 [ 790.661460][T26813] do_huge_pmd_anonymous_page+0x394/0xfe0 [ 790.667502][T26813] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 790.670344][T26810] input: syz1 as /devices/virtual/input/input4782 [ 790.673318][T26813] __handle_mm_fault+0x1aca/0x2c70 [ 790.673409][T26813] handle_mm_fault+0x21b/0x530 [ 790.690110][T26813] __do_page_fault+0x456/0x8d0 [ 790.694901][T26813] do_page_fault+0x38/0x194 [ 790.699428][T26813] page_fault+0x34/0x40 [ 790.703685][T26813] RIP: 0010:__put_user_4+0x1c/0x30 [ 790.708912][T26813] Code: 1f 00 c3 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 8b 1c 25 40 6c 01 00 48 8b 9b 18 0b 00 00 48 83 eb 03 48 39 d9 73 3f 0f 1f 00 <89> 01 31 c0 0f 1f 00 c3 66 90 66 2e 0f 1f 84 00 00 00 00 00 65 48 [ 790.729135][T26813] RSP: 0018:ffffc90000e3bb88 EFLAGS: 00010297 [ 790.735207][T26813] RAX: 0000000000000027 RBX: 00007fffffffeffd RCX: 0000000020d30b88 [ 790.743286][T26813] RDX: 0000000000000000 RSI: ffffffff814ba427 RDI: ffffc90000d9f010 [ 790.751396][T26813] RBP: ffffc90000e3bd20 R08: 0000000000000000 R09: 0000c90000d9f010 [ 790.759555][T26813] R10: 00008880a2735cb0 R11: 0000c90000d9f013 R12: ffff8880a2735c00 [ 790.767632][T26813] R13: 0000000000000027 R14: 0000000000000001 R15: ffffc90000d9f000 [ 790.767673][T26813] ? bpf_prog_get_info_by_fd.isra.0+0x1817/0x1a60 [ 790.767776][T26813] ? bpf_prog_get_info_by_fd.isra.0+0x1831/0x1a60 [ 790.785684][T26816] input: syz1 as /devices/virtual/input/input4783 [ 790.788738][T26813] ? mntput+0x66/0x90 [ 790.788788][T26813] bpf_obj_get_info_by_fd+0x16d/0x4b0 [ 790.804713][T26813] ? __read_once_size.constprop.0+0x12/0x20 [ 790.810641][T26813] ? check_stack_object+0xda/0x110 [ 790.815779][T26813] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 790.821696][T26813] ? __check_object_size+0x5f/0x346 [ 790.821780][T26813] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 790.833214][T26813] __do_sys_bpf+0x109f/0x2b90 [ 790.835614][T26824] input: syz1 as /devices/virtual/input/input4786 [ 790.837921][T26813] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 790.838019][T26813] ? __sb_end_write+0xbe/0x100 [ 790.855371][T26813] __x64_sys_bpf+0x4c/0x60 [ 790.859813][T26813] do_syscall_64+0xcc/0x370 [ 790.864345][T26813] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 790.866495][T26820] input: syz1 as /devices/virtual/input/input4787 [ 790.870244][T26813] RIP: 0033:0x45a639 [ 790.870271][T26813] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 790.870280][T26813] RSP: 002b:00007f6fef225c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 04:58:44 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 790.870296][T26813] RAX: ffffffffffffffda RBX: 00007f6fef225c90 RCX: 000000000045a639 [ 790.870504][T26813] RDX: 0000000000000010 RSI: 0000000020000280 RDI: 000000000000000f [ 790.870553][T26813] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 790.908895][T26813] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6fef2266d4 [ 790.908989][T26813] R13: 00000000004c0b15 R14: 00000000004d3318 R15: 0000000000000005 04:58:45 executing program 2 (fault-call:4 fault-nth:2): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 04:58:45 executing program 5: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) r32 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) sysinfo(&(0x7f00000007c0)=""/154) ioctl$BLKPG(r32, 0x1269, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000800)}) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) fchownat(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x0, 0x0, 0x1000) 04:58:45 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 04:58:45 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:45 executing program 1 (fault-call:12 fault-nth:0): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f0000003040)=ANY=[@ANYBLOB="edbf259659a927b189010f39ae2a60746a05319327c0430989e8c7a3bcab51e6d5e0399d5ab0f0dd9c1993f023cdd83d99be6dc910c758347383efb902eaa2531cca225c5e8f52bb64e8ab0c5c2133eca46d8b0fc8058d59e4e8eeee18e7925adb55f9849ca8f72f30eb257d494222a539c1bc74ba1f1c224101f0fb99e1f560f800005f2a96c496c46d744817c0cacf1fce1b9644ac2ec6976c20c27242e24e22ec0efacab07631c8da72b239c20b8388206c6b27978d3b57e94e6d9e1f618ce44648634f1aeb2dbbcac7b7cc0124df89ed1b1b673e2a9b6169ca54b13bc54961a99c5d88daec3373a1b26b9e7ce92f3a62088c73a115edf765db4b2da7c962ac5965e7a555c6d4ce51e51a2e802fb4fa922171e4e0ebee1f7d5f5bbaa71254fb83381263bb65c1f1bb5f6a218aea3fcc0c5d33d4ff5ad2b6d92551c82dad13f40f897838104a45c81b7f25eabc531455e36917a44c1c6e7f3fb292a3bd814d99163ab35fe4d3a97ed1532e024e1d4a25a69a9a39873774db5efe32f6e7435b569fd393d50ee32ef9b810e792786429a85b315684aef7afbd1c5c947d35b58154bc000000000000000000000017fb91ffc6017e37bd7536225baf00e5ecdb4b2eee16173fca0f3c1ba71a461c580b3f4e38aefc9c76ab758748662f8b8f9363558f35f43f7b802dc98bcf0911a831a121a9d600e9a7be51dcbff5"], 0xa) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(0xffffffffffffffff, &(0x7f0000000180)="2000000012005f", 0x7) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 04:58:45 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0x2, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 04:58:45 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 791.476057][ T26] audit: type=1804 audit(1574053125.661:1848): pid=26836 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir451960367/syzkaller.8vRdNE/641/file0" dev="sda1" ino=17224 res=1 [ 791.583086][T26836] input: syz1 as /devices/virtual/input/input4790 [ 791.593294][ T26] audit: type=1804 audit(1574053125.731:1849): pid=26849 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/666/file0" dev="sda1" ino=16657 res=1 [ 791.596053][T26851] FAULT_INJECTION: forcing a failure. [ 791.596053][T26851] name failslab, interval 1, probability 0, space 0, times 1 04:58:45 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:45 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0x3, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 791.721580][T26844] input: syz1 as /devices/virtual/input/input4791 [ 791.742994][T26836] input: syz1 as /devices/virtual/input/input4793 [ 791.881051][T26852] input: syz1 as /devices/virtual/input/input4795 [ 791.913854][T26851] CPU: 0 PID: 26851 Comm: syz-executor.1 Not tainted 5.4.0-rc7+ #0 [ 791.920712][T26844] input: syz1 as /devices/virtual/input/input4796 [ 791.921793][T26851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 791.921798][T26851] Call Trace: [ 791.921828][T26851] dump_stack+0x11d/0x181 [ 791.921851][T26851] should_fail.cold+0xa/0x1a [ 791.921995][T26851] __should_failslab+0xee/0x130 [ 791.955774][T26851] should_failslab+0x9/0x14 [ 791.960332][T26851] kmem_cache_alloc_node_trace+0x3b/0x670 [ 791.966294][T26851] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 791.972694][T26851] ? __this_cpu_preempt_check+0x4a/0x170 [ 791.978428][T26851] __get_vm_area_node+0x121/0x280 [ 791.983508][T26851] __vmalloc_node_range+0xe5/0x4c0 [ 791.988630][T26851] ? netlink_sendmsg+0x2f0/0x770 [ 791.993590][T26851] ? netlink_sendmsg+0x2f0/0x770 [ 791.998578][T26851] vmalloc+0x65/0x80 [ 792.002571][T26851] ? netlink_sendmsg+0x2f0/0x770 [ 792.007503][T26851] netlink_sendmsg+0x2f0/0x770 [ 792.012458][T26851] ? aa_sock_msg_perm.isra.0+0xa5/0x140 [ 792.018133][T26851] ? netlink_unicast+0x430/0x430 [ 792.023086][T26851] sock_sendmsg+0x9f/0xc0 [ 792.028018][T26851] kernel_sendmsg+0x4d/0x70 [ 792.032524][T26851] sock_no_sendpage+0xda/0x110 [ 792.037369][T26851] kernel_sendpage+0x7b/0xc0 [ 792.041954][T26851] ? sock_kfree_s+0x60/0x60 [ 792.046507][T26851] sock_sendpage+0x6c/0x90 [ 792.050961][T26851] ? kernel_sendpage+0xc0/0xc0 [ 792.055726][T26851] pipe_to_sendpage+0x102/0x180 [ 792.060621][T26851] __splice_from_pipe+0x248/0x480 [ 792.065648][T26851] ? direct_splice_actor+0xc0/0xc0 [ 792.070866][T26851] splice_from_pipe+0xbb/0x100 [ 792.075624][T26851] ? direct_splice_actor+0xc0/0xc0 [ 792.080740][T26851] generic_splice_sendpage+0x45/0x60 [ 792.086971][T26851] ? splice_from_pipe+0x100/0x100 [ 792.091992][T26851] do_splice+0x497/0xbe0 [ 792.096296][T26851] __x64_sys_splice+0x20a/0x220 [ 792.101210][T26851] do_syscall_64+0xcc/0x370 [ 792.105736][T26851] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 792.111650][T26851] RIP: 0033:0x45a639 [ 792.115592][T26851] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 792.135256][T26851] RSP: 002b:00007f1dd931dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 792.143660][T26851] RAX: ffffffffffffffda RBX: 00007f1dd931dc90 RCX: 000000000045a639 [ 792.151621][T26851] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 792.159588][T26851] RBP: 000000000075bf20 R08: 0000000080000001 R09: 0000000000000000 [ 792.167552][T26851] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1dd931e6d4 [ 792.175517][T26851] R13: 00000000004ca5d1 R14: 00000000004e1790 R15: 0000000000000007 [ 792.223799][T26851] syz-executor.1: vmalloc: allocation failure: 4224 bytes, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 792.292181][T26851] CPU: 0 PID: 26851 Comm: syz-executor.1 Not tainted 5.4.0-rc7+ #0 [ 792.300120][T26851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 792.310182][T26851] Call Trace: [ 792.313504][T26851] dump_stack+0x11d/0x181 [ 792.317849][T26851] warn_alloc.cold+0x72/0xcf [ 792.322555][T26851] __vmalloc_node_range+0x373/0x4c0 [ 792.327772][T26851] ? netlink_sendmsg+0x2f0/0x770 [ 792.332728][T26851] vmalloc+0x65/0x80 [ 792.336686][T26851] ? netlink_sendmsg+0x2f0/0x770 [ 792.341663][T26851] netlink_sendmsg+0x2f0/0x770 [ 792.346468][T26851] ? aa_sock_msg_perm.isra.0+0xa5/0x140 [ 792.352031][T26851] ? netlink_unicast+0x430/0x430 [ 792.357115][T26851] sock_sendmsg+0x9f/0xc0 [ 792.361440][T26851] kernel_sendmsg+0x4d/0x70 [ 792.364349][T26869] input: syz1 as /devices/virtual/input/input4798 [ 792.366156][T26851] sock_no_sendpage+0xda/0x110 [ 792.366266][T26851] kernel_sendpage+0x7b/0xc0 [ 792.382230][T26851] ? sock_kfree_s+0x60/0x60 [ 792.386781][T26851] sock_sendpage+0x6c/0x90 [ 792.386800][T26851] ? kernel_sendpage+0xc0/0xc0 [ 792.386817][T26851] pipe_to_sendpage+0x102/0x180 [ 792.386848][T26851] __splice_from_pipe+0x248/0x480 [ 792.386863][T26851] ? direct_splice_actor+0xc0/0xc0 [ 792.386889][T26851] splice_from_pipe+0xbb/0x100 [ 792.416188][T26851] ? direct_splice_actor+0xc0/0xc0 [ 792.421313][T26851] generic_splice_sendpage+0x45/0x60 [ 792.426618][T26851] ? splice_from_pipe+0x100/0x100 [ 792.431688][T26851] do_splice+0x497/0xbe0 [ 792.435976][T26851] __x64_sys_splice+0x20a/0x220 [ 792.440848][T26851] do_syscall_64+0xcc/0x370 [ 792.445355][T26851] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 792.451854][T26851] RIP: 0033:0x45a639 [ 792.455857][T26851] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 792.475473][T26851] RSP: 002b:00007f1dd931dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 792.483885][T26851] RAX: ffffffffffffffda RBX: 00007f1dd931dc90 RCX: 000000000045a639 04:58:46 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0x4, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 792.491862][T26851] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 792.499823][T26851] RBP: 000000000075bf20 R08: 0000000080000001 R09: 0000000000000000 [ 792.507915][T26851] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1dd931e6d4 [ 792.516001][T26851] R13: 00000000004ca5d1 R14: 00000000004e1790 R15: 0000000000000007 [ 792.534982][T26851] Mem-Info: [ 792.539467][T26851] active_anon:176323 inactive_anon:253 isolated_anon:0 [ 792.539467][T26851] active_file:8052 inactive_file:36812 isolated_file:0 [ 792.539467][T26851] unevictable:0 dirty:368 writeback:0 unstable:0 [ 792.539467][T26851] slab_reclaimable:5729 slab_unreclaimable:16228 [ 792.539467][T26851] mapped:59279 shmem:302 pagetables:1460 bounce:0 [ 792.539467][T26851] free:1567704 free_pcp:1083 free_cma:0 04:58:46 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 792.609142][T26851] Node 0 active_anon:701112kB inactive_anon:1012kB active_file:32072kB inactive_file:147248kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:237116kB dirty:1472kB writeback:0kB shmem:1208kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 458752kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no 04:58:46 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0x5, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 04:58:46 executing program 5: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 792.693839][T26851] Node 1 active_anon:0kB inactive_anon:0kB active_file:136kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no 04:58:47 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) [ 792.894868][T26885] input: syz1 as /devices/virtual/input/input4800 [ 792.920324][T26851] Node 0 DMA free:15908kB min:188kB low:232kB high:276kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 04:58:47 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0x6, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 04:58:47 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 793.152474][T26889] input: syz1 as /devices/virtual/input/input4802 [ 793.160436][T26851] lowmem_reserve[]: 0 2910 3617 3617 [ 793.200822][ T26] audit: type=1804 audit(1574053127.381:1850): pid=26895 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/667/file0" dev="sda1" ino=17236 res=1 [ 793.228037][T26851] Node 0 DMA32 free:2446724kB min:35372kB low:44212kB high:53052kB active_anon:179288kB inactive_anon:184kB active_file:2092kB inactive_file:120960kB unevictable:0kB writepending:1236kB present:3129332kB managed:2982556kB mlocked:0kB kernel_stack:768kB pagetables:2956kB bounce:0kB free_pcp:1472kB local_pcp:1120kB free_cma:0kB [ 793.247128][T26895] input: syz1 as /devices/virtual/input/input4804 [ 793.345069][T26904] input: syz1 as /devices/virtual/input/input4806 [ 793.364588][ T26] audit: type=1804 audit(1574053127.521:1851): pid=26894 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/667/file0" dev="sda1" ino=17236 res=1 [ 793.455948][T26851] lowmem_reserve[]: 0 0 707 707 [ 793.471818][T26901] input: syz1 as /devices/virtual/input/input4807 [ 793.500754][T26851] Node 0 Normal free:10568kB min:8600kB low:10748kB high:12896kB active_anon:517644kB inactive_anon:832kB active_file:29980kB inactive_file:26292kB unevictable:0kB writepending:240kB present:786432kB managed:724536kB mlocked:0kB kernel_stack:3176kB pagetables:2848kB bounce:0kB free_pcp:2804kB local_pcp:1436kB free_cma:0kB [ 793.565648][T26851] lowmem_reserve[]: 0 0 0 0 [ 793.572734][T26851] Node 1 Normal free:3806008kB min:45944kB low:57428kB high:68912kB active_anon:0kB inactive_anon:0kB active_file:136kB inactive_file:0kB unevictable:0kB writepending:0kB present:3932160kB managed:3870256kB mlocked:0kB kernel_stack:8kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 793.614747][T26851] lowmem_reserve[]: 0 0 0 0 [ 793.619383][T26851] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 793.635349][T26851] Node 0 DMA32: 340*4kB (UME) 154*8kB (UME) 40*16kB (UM) 19*32kB (UE) 8*64kB (UE) 9*128kB (UME) 5*256kB (UM) 4*512kB (UME) 5*1024kB (UME) 4*2048kB (UM) 592*4096kB (M) = 2446976kB [ 793.653977][T26851] Node 0 Normal: 16*4kB (UME) 29*8kB (UME) 40*16kB (UME) 31*32kB (UME) 15*64kB (UME) 6*128kB (ME) 7*256kB (ME) 6*512kB (ME) 2*1024kB (M) 0*2048kB 0*4096kB = 10568kB [ 793.671351][T26851] Node 1 Normal: 4*4kB (ME) 3*8kB (ME) 5*16kB (UE) 6*32kB (UME) 2*64kB (UE) 3*128kB (UM) 2*256kB (ME) 1*512kB (U) 1*1024kB (M) 1*2048kB (M) 928*4096kB (M) = 3806008kB [ 793.688378][T26851] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 793.698043][T26851] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 793.718308][T26851] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 793.728116][T26851] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 793.737660][T26851] 45167 total pagecache pages [ 793.742428][T26851] 0 pages in swap cache [ 793.747187][T26851] Swap cache stats: add 0, delete 0, find 0/0 [ 793.753264][T26851] Free swap = 0kB [ 793.757024][T26851] Total swap = 0kB [ 793.760747][T26851] 1965979 pages RAM 04:58:47 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f0000003040)=ANY=[@ANYBLOB="edbf259659a927b189010f39ae2a60746a05319327c0430989e8c7a3bcab51e6d5e0399d5ab0f0dd9c1993f023cdd83d99be6dc910c758347383efb902eaa2531cca225c5e8f52bb64e8ab0c5c2133eca46d8b0fc8058d59e4e8eeee18e7925adb55f9849ca8f72f30eb257d494222a539c1bc74ba1f1c224101f0fb99e1f560f800005f2a96c496c46d744817c0cacf1fce1b9644ac2ec6976c20c27242e24e22ec0efacab07631c8da72b239c20b8388206c6b27978d3b57e94e6d9e1f618ce44648634f1aeb2dbbcac7b7cc0124df89ed1b1b673e2a9b6169ca54b13bc54961a99c5d88daec3373a1b26b9e7ce92f3a62088c73a115edf765db4b2da7c962ac5965e7a555c6d4ce51e51a2e802fb4fa922171e4e0ebee1f7d5f5bbaa71254fb83381263bb65c1f1bb5f6a218aea3fcc0c5d33d4ff5ad2b6d92551c82dad13f40f897838104a45c81b7f25eabc531455e36917a44c1c6e7f3fb292a3bd814d99163ab35fe4d3a97ed1532e024e1d4a25a69a9a39873774db5efe32f6e7435b569fd393d50ee32ef9b810e792786429a85b315684aef7afbd1c5c947d35b58154bc000000000000000000000017fb91ffc6017e37bd7536225baf00e5ecdb4b2eee16173fca0f3c1ba71a461c580b3f4e38aefc9c76ab758748662f8b8f9363558f35f43f7b802dc98bcf0911a831a121a9d600e9a7be51dcbff5"], 0xa) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(0xffffffffffffffff, &(0x7f0000000180)="2000000012005f", 0x7) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 04:58:47 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:47 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0x7, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 04:58:47 executing program 5: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) [ 793.764608][T26851] 0 pages HighMem/MovableOnly [ 793.769294][T26851] 67665 pages reserved [ 793.773347][T26851] 0 pages cma reserved 04:58:48 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:48 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0x8, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 793.999522][T26921] input: syz1 as /devices/virtual/input/input4809 04:58:48 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f0000003040)=ANY=[@ANYBLOB="edbf259659a927b189010f39ae2a60746a05319327c0430989e8c7a3bcab51e6d5e0399d5ab0f0dd9c1993f023cdd83d99be6dc910c758347383efb902eaa2531cca225c5e8f52bb64e8ab0c5c2133eca46d8b0fc8058d59e4e8eeee18e7925adb55f9849ca8f72f30eb257d494222a539c1bc74ba1f1c224101f0fb99e1f560f800005f2a96c496c46d744817c0cacf1fce1b9644ac2ec6976c20c27242e24e22ec0efacab07631c8da72b239c20b8388206c6b27978d3b57e94e6d9e1f618ce44648634f1aeb2dbbcac7b7cc0124df89ed1b1b673e2a9b6169ca54b13bc54961a99c5d88daec3373a1b26b9e7ce92f3a62088c73a115edf765db4b2da7c962ac5965e7a555c6d4ce51e51a2e802fb4fa922171e4e0ebee1f7d5f5bbaa71254fb83381263bb65c1f1bb5f6a218aea3fcc0c5d33d4ff5ad2b6d92551c82dad13f40f897838104a45c81b7f25eabc531455e36917a44c1c6e7f3fb292a3bd814d99163ab35fe4d3a97ed1532e024e1d4a25a69a9a39873774db5efe32f6e7435b569fd393d50ee32ef9b810e792786429a85b315684aef7afbd1c5c947d35b58154bc000000000000000000000017fb91ffc6017e37bd7536225baf00e5ecdb4b2eee16173fca0f3c1ba71a461c580b3f4e38aefc9c76ab758748662f8b8f9363558f35f43f7b802dc98bcf0911a831a121a9d600e9a7be51dcbff5"], 0xa) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(0xffffffffffffffff, &(0x7f0000000180)="2000000012005f", 0x7) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0xf08, 0x0) [ 794.241645][T26916] input: syz1 as /devices/virtual/input/input4811 [ 794.270194][T26934] input: syz1 as /devices/virtual/input/input4812 04:58:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0x9, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 794.280333][ T26] audit: type=1804 audit(1574053128.461:1852): pid=26926 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/668/file0" dev="sda1" ino=17254 res=1 [ 794.352743][T26926] input: syz1 as /devices/virtual/input/input4814 [ 794.397936][T26931] input: syz1 as /devices/virtual/input/input4817 04:58:48 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:48 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:48 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f0000003040)=ANY=[@ANYBLOB="edbf259659a927b189010f39ae2a60746a05319327c0430989e8c7a3bcab51e6d5e0399d5ab0f0dd9c1993f023cdd83d99be6dc910c758347383efb902eaa2531cca225c5e8f52bb64e8ab0c5c2133eca46d8b0fc8058d59e4e8eeee18e7925adb55f9849ca8f72f30eb257d494222a539c1bc74ba1f1c224101f0fb99e1f560f800005f2a96c496c46d744817c0cacf1fce1b9644ac2ec6976c20c27242e24e22ec0efacab07631c8da72b239c20b8388206c6b27978d3b57e94e6d9e1f618ce44648634f1aeb2dbbcac7b7cc0124df89ed1b1b673e2a9b6169ca54b13bc54961a99c5d88daec3373a1b26b9e7ce92f3a62088c73a115edf765db4b2da7c962ac5965e7a555c6d4ce51e51a2e802fb4fa922171e4e0ebee1f7d5f5bbaa71254fb83381263bb65c1f1bb5f6a218aea3fcc0c5d33d4ff5ad2b6d92551c82dad13f40f897838104a45c81b7f25eabc531455e36917a44c1c6e7f3fb292a3bd814d99163ab35fe4d3a97ed1532e024e1d4a25a69a9a39873774db5efe32f6e7435b569fd393d50ee32ef9b810e792786429a85b315684aef7afbd1c5c947d35b58154bc000000000000000000000017fb91ffc6017e37bd7536225baf00e5ecdb4b2eee16173fca0f3c1ba71a461c580b3f4e38aefc9c76ab758748662f8b8f9363558f35f43f7b802dc98bcf0911a831a121a9d600e9a7be51dcbff5"], 0xa) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(0xffffffffffffffff, &(0x7f0000000180)="2000000012005f", 0x7) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000002, 0x0) 04:58:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 794.816065][T26959] input: syz1 as /devices/virtual/input/input4818 04:58:49 executing program 5: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:49 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f0000003040)=ANY=[@ANYBLOB="edbf259659a927b189010f39ae2a60746a05319327c0430989e8c7a3bcab51e6d5e0399d5ab0f0dd9c1993f023cdd83d99be6dc910c758347383efb902eaa2531cca225c5e8f52bb64e8ab0c5c2133eca46d8b0fc8058d59e4e8eeee18e7925adb55f9849ca8f72f30eb257d494222a539c1bc74ba1f1c224101f0fb99e1f560f800005f2a96c496c46d744817c0cacf1fce1b9644ac2ec6976c20c27242e24e22ec0efacab07631c8da72b239c20b8388206c6b27978d3b57e94e6d9e1f618ce44648634f1aeb2dbbcac7b7cc0124df89ed1b1b673e2a9b6169ca54b13bc54961a99c5d88daec3373a1b26b9e7ce92f3a62088c73a115edf765db4b2da7c962ac5965e7a555c6d4ce51e51a2e802fb4fa922171e4e0ebee1f7d5f5bbaa71254fb83381263bb65c1f1bb5f6a218aea3fcc0c5d33d4ff5ad2b6d92551c82dad13f40f897838104a45c81b7f25eabc531455e36917a44c1c6e7f3fb292a3bd814d99163ab35fe4d3a97ed1532e024e1d4a25a69a9a39873774db5efe32f6e7435b569fd393d50ee32ef9b810e792786429a85b315684aef7afbd1c5c947d35b58154bc000000000000000000000017fb91ffc6017e37bd7536225baf00e5ecdb4b2eee16173fca0f3c1ba71a461c580b3f4e38aefc9c76ab758748662f8b8f9363558f35f43f7b802dc98bcf0911a831a121a9d600e9a7be51dcbff5"], 0xa) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(0xffffffffffffffff, &(0x7f0000000180)="2000000012005f", 0x7) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000003, 0x0) 04:58:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xb, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 794.925662][T26966] input: syz1 as /devices/virtual/input/input4820 04:58:49 executing program 0: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r2, 0x1, &(0x7f0000000140)) r3 = open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r5 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r7 = fcntl$getown(r6, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r7, r5, 0x0, 0x0, 0x0}, 0x30) r8 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r9 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4002, 0x0) write$FUSE_DIRENT(r8, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r8, r9, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r10 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r10, 0x80080080044df9, &(0x7f0000000040)) r11 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r11, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r11, 0x0, &(0x7f0000000100)) r12 = socket$inet(0x2, 0x6, 0x0) bind$inet(r12, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r13 = accept(r12, 0x0, &(0x7f0000000300)) r14 = syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r15 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r15, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r15, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r15, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r15, 0x5501, 0x0) r16 = socket$inet(0x2, 0x6, 0x0) bind$inet(r16, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r17 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r18 = socket$inet(0x2, 0x6, 0x0) bind$inet(r18, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r19 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) write$uinput_user_dev(r19, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r19, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r19, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r19, 0x5501, 0x0) r20 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r20, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd]}, 0x45c) ioctl$UI_SET_RELBIT(r20, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r20, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r20, 0x5501, 0x0) r21 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r21, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r21, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) ioctl$sock_SIOCGPGRP(r21, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r22, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000a80)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000b80)=0xd2) lstat(0x0, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r13, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000480)="57c233c336f91f59c58d910a44298c5a5abbbbb18481bf7ac4071da84ddc3690a6461d461dd7580a7bde911ebe176e73ba375d3c30df92d75fd83aa08d78b1518987ae35c462a7209d13df65006c440e9964d3873f95582eec0156551cffe6f5cbdfdb213bc7fc3267faeb710d6fd1e74a07555c1282497494ff12650130f3fdd826f08d1821fb96e0879305ff63f01f4e8e6d24c7cdcbc3ec1d140653a2e7e2c3e2f70f9cabadfc531a700cad449b6714e97d36ea4cae81e779437665a584dc89991879c1d004287ac169f38e37a7064c737e16846622bf2818d97b710778be138be1a1", 0xe4}, {&(0x7f0000000580)="4ccd2ce6a966096e2938016fc1cd74275fa3efd85930b9a794f91f5c5a380dbdd4039010d93b89a0429c48a68fe28db2ffe96f4ccd1253dcdda3c844f4ac4a497156b9e29a6836d010ff04c210425bf82fc917da7396869c075555ad29570fe32fa7af477f6a1c19", 0x68}, {&(0x7f0000000680)="5f60fa001f8cabae9a586310be964c6386defd280160d48111bee997c17659fa7e1725214e1f8b4de1f20d72c342ae9ae2e9729ee19df2903dd0507f80d73a4442497c9db7a0c0243f3c0703ede8838c8c19e13e2bff70d5b236d49fa78a807b7f23e31777c068235fc4529b3063177a06615b850af7ff99581076ec9b0ad2d2675d0ba8764a4c32b834e9c8e6ed3f994bc8e67eaaf59ca8eef4aed0639ac65cea2a00714b905fa0bf396612d2f164f390a1a7b5c1c0f4a2bb1bfd2886b55ad8b9def85f6d96e1d8aac7ec1ad898e354b3", 0xd1}, {&(0x7f0000000880)="695b501e90c1cebfc1d4e7fae75e716c997c72fde8fa788794a432683eb1267d7225793d38df2872bf8c3295e9767b1f386ba3081d59232bb17fb04b825f67806a51739571e71309befa4bd7ab5b1ce0", 0x50}, {&(0x7f0000000900)="f6ca9610ddb24c02f80ba46afb29616f15352b19afb56c73873e75fd79373cfe879e69d6bfa4c8a061c2434883ddd01d32e47003d4ff7c86c893e5c72f39f7cbabc68af0904e20c5ba0bfc26d748794f1643b8e098f447bd61a4c072f31d010c037cd6e621aadd1b53c6f68158733ee46a0a4c55aee281753a4bd389343088df", 0x80}], 0x5, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [r11, r14, r15, 0xffffffffffffffff, r16, r17]}}, @rights={{0x20, 0x1, 0x1, [r18, r10, r19, r20]}}, @cred={{0x1c, 0x1, 0x2, {r22, r23, r24}}}], 0x68}, 0xc034) r25 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) getsockopt$ax25_int(r25, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) r26 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vhci\x00', 0x500022) r27 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r27, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r28 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r28, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r29 = socket$isdn(0x22, 0x3, 0x24) r30 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r30, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") sendmmsg$unix(r4, &(0x7f0000000680)=[{&(0x7f0000000200)=@file={0x1, './bus\x00'}, 0x6e, &(0x7f0000000540)=[{&(0x7f0000000400)="b68eb0eaca1a593a612ea877ce99d47681f2ccef9a103690e53f0edd88e18341e8b0c1ea5b0b205bef5df5435d", 0x2d}, {&(0x7f0000000440)="23cde4fe1a8603dbca30be942d48f3ce85a9e94ce678e734c20c2f28f8d3e8f0d8ad95fd60e4e1c8dd527c3883457ade20139859b832de92902c172a8ea60f4d83c29df022a4b90e8cee5ca6d45d3e646bd598dd20ab80c2ca38e21441821a9d", 0x60}], 0x2, &(0x7f00000005c0)=[@cred={{0x1c, 0x1, 0x2, {r7, 0xffffffffffffffff, r24}}}, @rights={{0x2c, 0x1, 0x1, [r3, r25, 0xffffffffffffffff, r1, r26, r27, r3]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r28, 0xffffffffffffffff, r29, r30, r3, r3, r0]}}], 0x88, 0x88000}], 0x1, 0x800) fcntl$setlease(r3, 0x400, 0x1) r31 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x14003000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1787b4f0e17c8b296746df0319265a685b076f3fbc9b5482547d3af55385db1e4cf1c0a2514158e8f8261a7bafa53b91a9a575f95fa335124b9a6093f1fdd6fb273677937a10387129d2a3688cf8d9ea354236413a3f234fcc86e04360544fdffc037b9d64aa4f5fbe37cfd519a01894cca037447e18173173888ad34d9caf317954732c28062c7a96698c36c28f8f0e4b24fb8bae748657d7fbbde489462bbbd2cc1fa10efb432705a480dc7e59e4c39ee39a23b0dc7e86fc21fce18d87d4f75c04feb77caa660fbf7366ed05f5b28158174992f8188501580b3bcc5788dd8689690a204e5e1d11072688d37212422fb764071efffffcb9ac82a5aa12e3a57cc8a0a7a1e999a535e90f20b1bf9c32e4557a235df4d6d8f3d4c97a3c97b2ce905dffd343326f1f79474d1b92092c6e945984ecdecc828a15e2a5d44ec195eda1a58e2de8909eb0054e663ec4054c7ee25d6edccea92a3e54b06fdd617362445510ddc00d291f0a959b2586c800ae480fcd7e69dd66960ffdfdb1", @ANYRES16=0x0, @ANYBLOB="000029bd7000fedbdf25010000000000000002410000001000137564703a73797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2800}, 0x100400c0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x80080000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r31, 0x0, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24001040) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000002c0)=@isdn, 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:49 executing program 3: r0 = accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000003c0)='./bus\x00', 0x0) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, 0x0, 0x0) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x0, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x0, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) r10 = socket$inet(0x2, 0x6, 0x0) bind$inet(r10, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r11 = socket$inet(0x2, 0x6, 0x0) bind$inet(r11, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r12, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r12, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r12, 0x5501, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r13, 0x29, 0x21, &(0x7f0000000040)={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa4ffffff]}}, 0x20) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) recvfrom$unix(r0, &(0x7f0000000140)=""/127, 0x7f, 0x0, 0x0, 0x0) 04:58:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xc, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 795.234125][T26975] input: syz1 as /devices/virtual/input/input4822 04:58:49 executing program 4: accept$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x1, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) ioctl(r0, 0x1, &(0x7f0000000140)) open(&(0x7f0000ba0000)='./file0\x00', 0xfc, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x200600) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5d7d49e24e0d83077d44", @ANYRES32=0x0], 0x2}}, 0x0) r4 = fcntl$getown(r3, 0x9) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={r4, r2, 0x0, 0x0, 0x0}, 0x30) r5 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x1) sendfile(r5, 0xffffffffffffffff, 0x0, 0x7fffffff) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42000) r6 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r6, 0x80080080044df9, &(0x7f0000000040)) r7 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r7, 0x80080080044df9, &(0x7f0000000040)) getsockname$packet(r7, 0x0, &(0x7f0000000100)) r8 = socket$inet(0x2, 0x6, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) accept(r8, 0x0, &(0x7f0000000300)) syz_open_dev$vcsa(&(0x7f0000000a00)='/dev/vcsa#\x00', 0x80000000, 0x640080) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r9, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x2) ioctl$UI_SET_RELBIT(r9, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(r9, 0x5501, 0x0) socket$inet(0x2, 0x6, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_RELBIT(r10, 0x40045566, 0x8) ioctl$UI_DEV_SETUP(r10, 0x5501, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) r11 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r11, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x4, &(0x7f0000003680), &(0x7f0000000280)=0x4) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000003c0)={0x12, 0x28, &(0x7f0000000340)="880f14cc6c102fb7d9f197f39be6590615b765ed0966891c3efb86d8d31081153ee6eb1b438ff19f"}) 04:58:49 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f0000003040)=ANY=[@ANYBLOB="edbf259659a927b189010f39ae2a60746a05319327c0430989e8c7a3bcab51e6d5e0399d5ab0f0dd9c1993f023cdd83d99be6dc910c758347383efb902eaa2531cca225c5e8f52bb64e8ab0c5c2133eca46d8b0fc8058d59e4e8eeee18e7925adb55f9849ca8f72f30eb257d494222a539c1bc74ba1f1c224101f0fb99e1f560f800005f2a96c496c46d744817c0cacf1fce1b9644ac2ec6976c20c27242e24e22ec0efacab07631c8da72b239c20b8388206c6b27978d3b57e94e6d9e1f618ce44648634f1aeb2dbbcac7b7cc0124df89ed1b1b673e2a9b6169ca54b13bc54961a99c5d88daec3373a1b26b9e7ce92f3a62088c73a115edf765db4b2da7c962ac5965e7a555c6d4ce51e51a2e802fb4fa922171e4e0ebee1f7d5f5bbaa71254fb83381263bb65c1f1bb5f6a218aea3fcc0c5d33d4ff5ad2b6d92551c82dad13f40f897838104a45c81b7f25eabc531455e36917a44c1c6e7f3fb292a3bd814d99163ab35fe4d3a97ed1532e024e1d4a25a69a9a39873774db5efe32f6e7435b569fd393d50ee32ef9b810e792786429a85b315684aef7afbd1c5c947d35b58154bc000000000000000000000017fb91ffc6017e37bd7536225baf00e5ecdb4b2eee16173fca0f3c1ba71a461c580b3f4e38aefc9c76ab758748662f8b8f9363558f35f43f7b802dc98bcf0911a831a121a9d600e9a7be51dcbff5"], 0xa) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(0xffffffffffffffff, &(0x7f0000000180)="2000000012005f", 0x7) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000034, 0x0) [ 795.523838][T26986] input: syz1 as /devices/virtual/input/input4824 [ 795.535996][T27000] input: syz1 as /devices/virtual/input/input4825 04:58:49 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f0000003040)=ANY=[@ANYBLOB="edbf259659a927b189010f39ae2a60746a05319327c0430989e8c7a3bcab51e6d5e0399d5ab0f0dd9c1993f023cdd83d99be6dc910c758347383efb902eaa2531cca225c5e8f52bb64e8ab0c5c2133eca46d8b0fc8058d59e4e8eeee18e7925adb55f9849ca8f72f30eb257d494222a539c1bc74ba1f1c224101f0fb99e1f560f800005f2a96c496c46d744817c0cacf1fce1b9644ac2ec6976c20c27242e24e22ec0efacab07631c8da72b239c20b8388206c6b27978d3b57e94e6d9e1f618ce44648634f1aeb2dbbcac7b7cc0124df89ed1b1b673e2a9b6169ca54b13bc54961a99c5d88daec3373a1b26b9e7ce92f3a62088c73a115edf765db4b2da7c962ac5965e7a555c6d4ce51e51a2e802fb4fa922171e4e0ebee1f7d5f5bbaa71254fb83381263bb65c1f1bb5f6a218aea3fcc0c5d33d4ff5ad2b6d92551c82dad13f40f897838104a45c81b7f25eabc531455e36917a44c1c6e7f3fb292a3bd814d99163ab35fe4d3a97ed1532e024e1d4a25a69a9a39873774db5efe32f6e7435b569fd393d50ee32ef9b810e792786429a85b315684aef7afbd1c5c947d35b58154bc000000000000000000000017fb91ffc6017e37bd7536225baf00e5ecdb4b2eee16173fca0f3c1ba71a461c580b3f4e38aefc9c76ab758748662f8b8f9363558f35f43f7b802dc98bcf0911a831a121a9d600e9a7be51dcbff5"], 0xa) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(0xffffffffffffffff, &(0x7f0000000180)="2000000012005f", 0x7) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000300, 0x0) [ 795.588856][T26996] input: syz1 as /devices/virtual/input/input4828 04:58:49 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xd, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 795.627420][ T26] audit: type=1804 audit(1574053129.811:1853): pid=26982 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir018805161/syzkaller.KJHIj4/669/file0" dev="sda1" ino=17242 res=1 04:58:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x22, 0x7}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x3c, 0x0, &(0x7f0000000200)="e460cdfbef24080000000a9386dd6a000000000704eb3014cd3ec8a755c1e1380081ffad000000e8d5000000010000001400000500242f09880bd320", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_GET_PROG_INFO(0xc, &(0x7f0000000280)={r1, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) [ 795.750891][ T7678] ================================================================== [ 795.759167][ T7678] BUG: KCSAN: data-race in __dentry_kill / d_alloc_parallel [ 795.766439][ T7678] [ 795.768811][ T7678] read to 0xffff88812546e3c0 of 4 bytes by task 7365 on cpu 0: [ 795.776715][ T7678] __dentry_kill+0x1be/0x3c0 [ 795.781320][ T7678] dput+0x3b5/0x750 [ 795.785136][ T7678] terminate_walk+0x107/0x250 [ 795.789962][ T7678] path_lookupat.isra.0+0x27e/0x5a0 [ 795.795158][ T7678] filename_lookup+0x145/0x2b0 [ 795.799916][ T7678] user_path_at_empty+0x4c/0x70 [ 795.804761][ T7678] vfs_statx+0xd9/0x190 [ 795.808911][ T7678] __do_sys_newstat+0x51/0xb0 [ 795.813575][ T7678] __x64_sys_newstat+0x3a/0x50 [ 795.818353][ T7678] do_syscall_64+0xcc/0x370 [ 795.822849][ T7678] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 795.828721][ T7678] [ 795.831048][ T7678] write to 0xffff88812546e3c0 of 4 bytes by task 7678 on cpu 1: [ 795.838682][ T7678] d_alloc_parallel+0x533/0xe00 [ 795.843702][ T7678] __lookup_slow+0xb4/0x2a0 [ 795.848197][ T7678] lookup_slow+0x4f/0x70 [ 795.852642][ T7678] walk_component+0x4a2/0xe70 [ 795.857319][ T7678] link_path_walk.part.0+0x5d3/0xa90 [ 795.862630][ T7678] path_lookupat.isra.0+0x77/0x5a0 [ 795.867739][ T7678] filename_lookup+0x145/0x2b0 [ 795.872598][ T7678] user_path_at_empty+0x4c/0x70 [ 795.877443][ T7678] vfs_statx+0xd9/0x190 [ 795.881617][ T7678] __do_sys_newlstat+0x51/0xb0 [ 795.886376][ T7678] __x64_sys_newlstat+0x3a/0x50 [ 795.891237][ T7678] do_syscall_64+0xcc/0x370 [ 795.895753][ T7678] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 795.901653][ T7678] [ 795.903967][ T7678] Reported by Kernel Concurrency Sanitizer on: [ 795.910119][ T7678] CPU: 1 PID: 7678 Comm: udevd Not tainted 5.4.0-rc7+ #0 [ 795.917331][ T7678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 795.927413][ T7678] ================================================================== [ 795.935567][ T7678] Kernel panic - not syncing: panic_on_warn set ... [ 795.942161][ T7678] CPU: 1 PID: 7678 Comm: udevd Not tainted 5.4.0-rc7+ #0 [ 795.949255][ T7678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 795.959296][ T7678] Call Trace: [ 795.962607][ T7678] dump_stack+0x11d/0x181 [ 795.966933][ T7678] panic+0x210/0x640 [ 795.970824][ T7678] ? vprintk_func+0x8d/0x140 [ 795.975412][ T7678] kcsan_report.cold+0xc/0xd [ 795.980002][ T7678] kcsan_setup_watchpoint+0x3fe/0x460 [ 795.985498][ T7678] __tsan_unaligned_write4+0xc4/0x100 [ 795.990870][ T7678] d_alloc_parallel+0x533/0xe00 [ 795.995717][ T7678] ? _raw_spin_unlock_irqrestore+0x70/0x80 [ 796.001651][ T7678] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 796.007897][ T7678] ? __d_lookup+0x2b0/0x3f0 [ 796.012395][ T7678] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 796.018285][ T7678] __lookup_slow+0xb4/0x2a0 [ 796.022786][ T7678] lookup_slow+0x4f/0x70 [ 796.027029][ T7678] walk_component+0x4a2/0xe70 [ 796.031700][ T7678] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 796.037935][ T7678] ? inode_permission+0xa0/0x3c0 [ 796.043665][ T7678] link_path_walk.part.0+0x5d3/0xa90 [ 796.049055][ T7678] ? ___cache_free+0x2e/0x320 [ 796.053733][ T7678] path_lookupat.isra.0+0x77/0x5a0 [ 796.058848][ T7678] ? __read_once_size.constprop.0+0x12/0x20 [ 796.064766][ T7678] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 796.071618][ T7678] filename_lookup+0x145/0x2b0 [ 796.076387][ T7678] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 796.082639][ T7678] ? strncpy_from_user+0x219/0x2b0 [ 796.087784][ T7678] user_path_at_empty+0x4c/0x70 [ 796.092646][ T7678] vfs_statx+0xd9/0x190 [ 796.096801][ T7678] ? getname_flags+0x1a4/0x380 [ 796.101566][ T7678] __do_sys_newlstat+0x51/0xb0 [ 796.107112][ T7678] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 796.113368][ T7678] ? do_readlinkat+0x17d/0x220 [ 796.118127][ T7678] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 796.124361][ T7678] ? debug_smp_processor_id+0x4c/0x172 [ 796.129811][ T7678] __x64_sys_newlstat+0x3a/0x50 [ 796.134691][ T7678] do_syscall_64+0xcc/0x370 [ 796.139192][ T7678] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 796.145093][ T7678] RIP: 0033:0x7f5c2eff8d05 [ 796.149508][ T7678] Code: f7 d8 64 89 02 83 c8 ff c3 90 90 90 90 90 90 90 90 90 90 90 90 83 ff 01 48 89 f0 77 18 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 17 f3 c3 90 48 8b 05 01 51 2b 00 64 c7 00 16 [ 796.169204][ T7678] RSP: 002b:00007ffd5ad0d328 EFLAGS: 00000246 ORIG_RAX: 0000000000000006 [ 796.177621][ T7678] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5c2eff8d05 [ 796.185696][ T7678] RDX: 00007ffd5ad0d340 RSI: 00007ffd5ad0d340 RDI: 00007ffd5ad0d3d0 [ 796.193662][ T7678] RBP: 000000000041ef0e R08: 000000000041ef0e R09: 00007f5c2f04f7b0 [ 796.201725][ T7678] R10: 706e692f6c617574 R11: 0000000000000246 R12: 0000000001a89a90 [ 796.209689][ T7678] R13: 0000000001a89b80 R14: 0000000001a85250 R15: 0000000001a8ae10 [ 796.219677][ T7678] Kernel Offset: disabled [ 796.224008][ T7678] Rebooting in 86400 seconds..